diff --git a/src/vm.ts b/src/vm.ts
index 006df16..5c6d966 100644
--- a/src/vm.ts
+++ b/src/vm.ts
@@ -161,6 +161,17 @@ async function installPersistentTooling(log?: (msg: string) => void): Promise<vo
     await run(
       $`container exec --user ${USER} ${CONTAINER_NAME} env ${`RUSTUP_HOME=${CONTAINER_ENV.RUSTUP_HOME}`} ${`CARGO_HOME=${CONTAINER_ENV.CARGO_HOME}`} bash -c ${"curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y"}`,
       "Rust installation")
+    // Add musl target so Rust can link without a system C linker
+    await run(
+      $`container exec --user ${USER} ${CONTAINER_NAME} env ${`RUSTUP_HOME=${CONTAINER_ENV.RUSTUP_HOME}`} ${`CARGO_HOME=${CONTAINER_ENV.CARGO_HOME}`} ${`PATH=${CONTAINER_ENV.CARGO_HOME}/bin:$PATH`} rustup target add aarch64-unknown-linux-musl`,
+      "Rust musl target")
+  }
+
+  // Ensure cargo config exists for musl target (even if Rust was already installed)
+  const hasCargoConfig = await $`container exec --user ${USER} ${CONTAINER_NAME} test -f /sandlot/.cargo/config.toml`.nothrow().quiet()
+  if (hasCargoConfig.exitCode !== 0) {
+    const cargoConfig = `[target.aarch64-unknown-linux-musl]\nlinker = "rust-lld"\n\n[build]\ntarget = "aarch64-unknown-linux-musl"\n`
+    await $`container exec --user ${USER} ${CONTAINER_NAME} bash -c ${`echo -e '${cargoConfig}' > /sandlot/.cargo/config.toml`}`.quiet()
   }
 
   // Go — skip if already installed on the persistent mount