diff --git a/.github/workflows/container_dev.yml b/.github/workflows/container_dev.yml
index 27ef98caef..14f52e8b35 100644
--- a/.github/workflows/container_dev.yml
+++ b/.github/workflows/container_dev.yml
@@ -44,7 +44,12 @@ jobs:
 
       - name: Install musl tools (amd64)
         if: ${{ !matrix.cross }}
-        run: sudo apt-get install -y musl-tools
+        run: |
+          sudo apt-get install -y musl-tools
+          # C deps (aws-lc-sys) must compile against musl headers, not the host
+          # gcc's glibc headers — glibc's C23 redirects (__isoc23_sscanf,
+          # __isoc23_strtol) don't exist in musl and fail the link.
+          echo "CC_x86_64_unknown_linux_musl=musl-gcc" >> "$GITHUB_ENV"
 
       - name: Install cross-compilation tools (arm64)
         if: matrix.cross
@@ -53,6 +58,31 @@ jobs:
           echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
           # Disable glibc fortify source — its __memcpy_chk etc. symbols don't exist in musl
           echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
+          # aws-lc-sys compiles against glibc headers, which redirect
+          # sscanf/strtol to C23 __isoc23_* symbols musl does not provide.
+          # Link a tiny forwarding shim so those references resolve to the
+          # musl implementations. Prototypes are declared manually: including
+          # glibc headers here would re-redirect the calls back to __isoc23_*.
+          cat > /tmp/isoc23-shim.c <<'SHIM'
+          #include <stdarg.h>
+          extern int vsscanf(const char *s, const char *fmt, va_list ap);
+          extern long strtol(const char *nptr, char **endptr, int base);
+          int __isoc23_sscanf(const char *s, const char *fmt, ...) {
+              va_list ap;
+              va_start(ap, fmt);
+              int r = vsscanf(s, fmt, ap);
+              va_end(ap);
+              return r;
+          }
+          long __isoc23_strtol(const char *nptr, char **endptr, int base) {
+              return strtol(nptr, endptr, base);
+          }
+          SHIM
+          aarch64-linux-gnu-gcc -O2 -c /tmp/isoc23-shim.c -o /tmp/isoc23-shim.o
+          # link-args land after libc on the link line; rescan musl libc so
+          # the shim's own vsscanf/strtol references resolve, and libgcc for
+          # the fp128 builtins musl's vfscanf/floatscan pull in on aarch64.
+          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=-Clink-arg=/tmp/isoc23-shim.o -Clink-arg=-lc -Clink-arg=-lgcc" >> "$GITHUB_ENV"
 
       - name: Cache cargo registry and target
         if: runner.environment == 'github-hosted'
diff --git a/.github/workflows/container_latest.yml b/.github/workflows/container_latest.yml
index 25760aa7c1..95d2130616 100644
--- a/.github/workflows/container_latest.yml
+++ b/.github/workflows/container_latest.yml
@@ -88,7 +88,12 @@ jobs:
 
       - name: Install musl tools (amd64)
         if: ${{ !matrix.cross }}
-        run: sudo apt-get install -y musl-tools
+        run: |
+          sudo apt-get install -y musl-tools
+          # C deps (aws-lc-sys) must compile against musl headers, not the host
+          # gcc's glibc headers — glibc's C23 redirects (__isoc23_sscanf,
+          # __isoc23_strtol) don't exist in musl and fail the link.
+          echo "CC_x86_64_unknown_linux_musl=musl-gcc" >> "$GITHUB_ENV"
 
       - name: Install cross-compilation tools (arm64)
         if: matrix.cross
@@ -97,6 +102,31 @@ jobs:
           echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
           # Disable glibc fortify source — its __memcpy_chk etc. symbols don't exist in musl
           echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
+          # aws-lc-sys compiles against glibc headers, which redirect
+          # sscanf/strtol to C23 __isoc23_* symbols musl does not provide.
+          # Link a tiny forwarding shim so those references resolve to the
+          # musl implementations. Prototypes are declared manually: including
+          # glibc headers here would re-redirect the calls back to __isoc23_*.
+          cat > /tmp/isoc23-shim.c <<'SHIM'
+          #include <stdarg.h>
+          extern int vsscanf(const char *s, const char *fmt, va_list ap);
+          extern long strtol(const char *nptr, char **endptr, int base);
+          int __isoc23_sscanf(const char *s, const char *fmt, ...) {
+              va_list ap;
+              va_start(ap, fmt);
+              int r = vsscanf(s, fmt, ap);
+              va_end(ap);
+              return r;
+          }
+          long __isoc23_strtol(const char *nptr, char **endptr, int base) {
+              return strtol(nptr, endptr, base);
+          }
+          SHIM
+          aarch64-linux-gnu-gcc -O2 -c /tmp/isoc23-shim.c -o /tmp/isoc23-shim.o
+          # link-args land after libc on the link line; rescan musl libc so
+          # the shim's own vsscanf/strtol references resolve, and libgcc for
+          # the fp128 builtins musl's vfscanf/floatscan pull in on aarch64.
+          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=-Clink-arg=/tmp/isoc23-shim.o -Clink-arg=-lc -Clink-arg=-lgcc" >> "$GITHUB_ENV"
 
       - name: Cache cargo registry and target
         if: runner.environment == 'github-hosted'
diff --git a/.github/workflows/container_release_unified.yml b/.github/workflows/container_release_unified.yml
index 924ee5cd1c..0698a6a3ea 100644
--- a/.github/workflows/container_release_unified.yml
+++ b/.github/workflows/container_release_unified.yml
@@ -67,7 +67,12 @@ jobs:
 
       - name: Install musl tools (amd64)
         if: ${{ !matrix.cross }}
-        run: sudo apt-get install -y musl-tools
+        run: |
+          sudo apt-get install -y musl-tools
+          # C deps (aws-lc-sys) must compile against musl headers, not the host
+          # gcc's glibc headers — glibc's C23 redirects (__isoc23_sscanf,
+          # __isoc23_strtol) don't exist in musl and fail the link.
+          echo "CC_x86_64_unknown_linux_musl=musl-gcc" >> "$GITHUB_ENV"
 
       - name: Install cross-compilation tools (arm64)
         if: matrix.cross
@@ -76,6 +81,31 @@ jobs:
           echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
           # Disable glibc fortify source — its __memcpy_chk etc. symbols don't exist in musl
           echo "CFLAGS_aarch64_unknown_linux_musl=-U_FORTIFY_SOURCE" >> "$GITHUB_ENV"
+          # aws-lc-sys compiles against glibc headers, which redirect
+          # sscanf/strtol to C23 __isoc23_* symbols musl does not provide.
+          # Link a tiny forwarding shim so those references resolve to the
+          # musl implementations. Prototypes are declared manually: including
+          # glibc headers here would re-redirect the calls back to __isoc23_*.
+          cat > /tmp/isoc23-shim.c <<'SHIM'
+          #include <stdarg.h>
+          extern int vsscanf(const char *s, const char *fmt, va_list ap);
+          extern long strtol(const char *nptr, char **endptr, int base);
+          int __isoc23_sscanf(const char *s, const char *fmt, ...) {
+              va_list ap;
+              va_start(ap, fmt);
+              int r = vsscanf(s, fmt, ap);
+              va_end(ap);
+              return r;
+          }
+          long __isoc23_strtol(const char *nptr, char **endptr, int base) {
+              return strtol(nptr, endptr, base);
+          }
+          SHIM
+          aarch64-linux-gnu-gcc -O2 -c /tmp/isoc23-shim.c -o /tmp/isoc23-shim.o
+          # link-args land after libc on the link line; rescan musl libc so
+          # the shim's own vsscanf/strtol references resolve, and libgcc for
+          # the fp128 builtins musl's vfscanf/floatscan pull in on aarch64.
+          echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=-Clink-arg=/tmp/isoc23-shim.o -Clink-arg=-lc -Clink-arg=-lgcc" >> "$GITHUB_ENV"
 
       - name: Cache cargo registry and target
         if: runner.environment == 'github-hosted'