diff --git a/Makefile b/Makefile
index 6682563..746b6c8 100644
--- a/Makefile
+++ b/Makefile
@@ -15,13 +15,22 @@ FRONTEND_WEB_SRC := $(shell find cmd/frontend/web/src -type f 2>/dev/null) \
 FRONTEND_WEB_DIST := cmd/frontend/web/dist/index.html
 
 NATIVE_ARCH  := $(shell go env GOARCH)
-VERSION      := 0.9.1
+VERSION      := 0.9.2
 COMMIT_HASH  := $(shell git rev-parse --short HEAD 2>/dev/null || echo unknown)
 DATE         := $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 LDFLAGS      := -X '$(MODULE)/cmd.version=$(VERSION)' \
                 -X '$(MODULE)/cmd.commit=$(COMMIT_HASH)' \
                 -X '$(MODULE)/cmd.date=$(DATE)'
 
+# CGO_ENABLED=0 produces fully static binaries: no libc dependency, so the
+# debian package runs on any Linux-amd64/arm64 host regardless of glibc
+# version (or musl). The only behavioural change is that Go's net package
+# uses the pure-Go resolver instead of libc's getaddrinfo, which skips
+# /etc/nsswitch.conf and NSS modules — fine for DNS-only lookups, which is
+# all maglevd does. govpp has no cgo (its binapi is hand-marshalled Go
+# structs) so this has no effect on multi-VPP-version compatibility.
+export CGO_ENABLED := 0
+
 TEST ?= tests/
 
 VPP_API_DIR ?= $(HOME)/src/vpp/build-root/install-vpp_debug-native/vpp/share/vpp/api