diff --git a/justfile b/justfile
index a394cd2..d9a1388 100644
--- a/justfile
+++ b/justfile
@@ -10,15 +10,19 @@ default:
 build:
     go build -o ctask.exe .
 
-# Cross-compile a Linux amd64 binary into dist/
+# Cross-compile a Linux amd64 binary into dist/. CGO_ENABLED=0 forces a
+# pure-Go static link so the binary works in minimal containers (Alpine,
+# distroless, scratch). Without this, native Linux builds default to
+# CGO_ENABLED=1 and link against the host glibc.
 build-linux:
     mkdir -p dist
-    GOOS=linux GOARCH=amd64 go build -o dist/ctask-linux-amd64 ./
+    CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o dist/ctask-linux-amd64 ./
 
-# Cross-compile a Windows amd64 binary into dist/
+# Cross-compile a Windows amd64 binary into dist/. CGO_ENABLED=0 keeps
+# the artifact pure Go, matching the spec's "no cgo" rule.
 build-windows:
     mkdir -p dist
-    GOOS=windows GOARCH=amd64 go build -o dist/ctask-windows-amd64.exe ./
+    CGO_ENABLED=0 GOOS=windows GOARCH=amd64 go build -o dist/ctask-windows-amd64.exe ./
 
 # Build both Windows and Linux artifacts into dist/
 build-all: build-windows build-linux