diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5bd5268a..cc38f272 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -78,9 +78,6 @@ jobs:
         with:
           components: clippy,miri,rustfmt,rust-src
 
-      # Installed *after* nightly so it is the default.
-      - uses: dtolnay/rust-toolchain@stable
-
       - uses: Swatinem/rust-cache@v2
 
       - uses: taiki-e/install-action@v2
@@ -333,6 +330,10 @@ jobs:
           brew bundle
           echo $(brew --prefix curl)/bin >> $GITHUB_PATH
           echo $(brew --prefix llvm)/bin >> $GITHUB_PATH
+          # Point bpf-linker's build.rs to the brew prefixes with static
+          # libraries it needs.
+          echo "CXXSTDLIB_PATH=$(brew --prefix llvm)/lib/c++" >> $GITHUB_ENV
+          echo "ZLIB_PATH=$(brew --prefix zlib)/lib" >> $GITHUB_ENV
 
           # https://github.com/actions/setup-python/issues/577
           find /usr/local/bin -type l -exec sh -c 'readlink -f "$1" \
@@ -382,6 +383,7 @@ jobs:
               ;;
             macOS)
               target=${arch}-apple-darwin
+              echo "LLVM_LINK_FEATURE=llvm-link-static" >> $GITHUB_ENV
               ;;
             *)
               echo "::error::Unsupported runner OS: ${{ runner.os }}"
@@ -395,8 +397,13 @@ jobs:
       # NB: rustc doesn't ship libLLVM.so on macOS, so disable proxying (default feature). We also
       # --force so that bpf-linker gets always relinked against the latest LLVM downloaded above.
       #
+      # Add the downloaded LLVM to PATH for this build step.
+      #
       # Do this on all system (not just macOS) to avoid relying on rustc-provided libLLVM.so.
-      - run: cargo install --git https://github.com/aya-rs/bpf-linker.git bpf-linker --no-default-features --features llvm-21 --force
+      - run: |
+          cargo install \
+            --git https://github.com/aya-rs/bpf-linker.git bpf-linker \
+            --no-default-features --features "llvm-21,${LLVM_LINK_FEATURE}" --force
 
       - uses: actions/cache@v4
         with:
diff --git a/Brewfile b/Brewfile
index 285773b9..fe52a392 100644
--- a/Brewfile
+++ b/Brewfile
@@ -12,6 +12,9 @@ brew "lynx"
 brew "pkg-config"
 brew "qemu"
 
+# macOS provides only dynamic zlib. Install the static one.
+brew "zlib"
+
 # We need a musl C toolchain to compile our `test-distro` since some of our
 # dependencies have build scripts that compile C code (i.e xz2).
 tap  "filosottile/musl-cross"
diff --git a/test/integration-test/Cargo.toml b/test/integration-test/Cargo.toml
index e81d705c..aed0ab90 100644
--- a/test/integration-test/Cargo.toml
+++ b/test/integration-test/Cargo.toml
@@ -48,7 +48,7 @@ aya-build = { path = "../../aya-build" }
 cargo_metadata = { workspace = true }
 # TODO(https://github.com/rust-lang/cargo/issues/12375): this should be an artifact dependency, but
 # it's not possible to tell cargo to use `-Z build-std` to build it. We cargo-in-cargo in the build
-# script to build this, but we want to teach cargo about the dependecy so that cache invalidation
+# script to build this, but we want to teach cargo about the dependency so that cache invalidation
 # works properly.
 #
 # Finally note that *any* usage of `artifact = ...` in *any* Cargo.toml in the workspace breaks