diff --git a/script/setup/install-runc b/script/setup/install-runc
index e55f671f58..f9f8956bf3 100755
--- a/script/setup/install-runc
+++ b/script/setup/install-runc
@@ -38,7 +38,14 @@ function install_runc() {
 	git clone "${RUNC_REPO}" "${TMPROOT}"/runc
 	pushd "${TMPROOT}"/runc
 	git checkout "${RUNC_VERSION}"
-	env -u VERSION make BUILDTAGS='seccomp' runc
+	# Static build, like the runc release binaries, so the binary does not
+	# depend on the build host's glibc and libseccomp. Needs libseccomp.a;
+	# set RUNC_DYNAMIC=1 where it is not available (e.g. EL).
+	if [ -n "${RUNC_DYNAMIC:-}" ]; then
+		env -u VERSION make BUILDTAGS='seccomp' runc
+	else
+		env -u VERSION make BUILDTAGS='seccomp' static
+	fi
 	$SUDO make install
 	popd
 }
diff --git a/script/vm/provision.sh b/script/vm/provision.sh
index 5aaac15051..330b7586dd 100755
--- a/script/vm/provision.sh
+++ b/script/vm/provision.sh
@@ -78,8 +78,9 @@ fi
 
 cd "${containerd_dir}"
 
-# Install runc (pass RUNC_FLAVOR=crun to install crun as runc)
-RUNC_FLAVOR="${RUNC_FLAVOR}" script/setup/install-runc
+# Install runc (pass RUNC_FLAVOR=crun to install crun as runc).
+# EL has no libseccomp-static, so build runc dynamically like runc's own CI does.
+RUNC_FLAVOR="${RUNC_FLAVOR}" RUNC_DYNAMIC=1 script/setup/install-runc
 type runc
 runc --version
 # "type -ap" may print the same file under multiple names, e.g., on