diff --git a/.github/workflows/package-cli.yml b/.github/workflows/package-cli.yml
index 5b8a13eae29..e10d45cb8fa 100644
--- a/.github/workflows/package-cli.yml
+++ b/.github/workflows/package-cli.yml
@@ -61,12 +61,12 @@ jobs:
       fail-fast: false
       matrix:
         include:
+          # The MUSL target provide a statically linked CLI
           - target: x86_64-unknown-linux-musl
             suffix: linux-x86_64-musl
-            type: static
+          # The GNU target provide a dynamically linked CLI
           - target: x86_64-unknown-linux-gnu
             suffix: linux-x86_64-gnu
-            type: dynamic
     steps:
       - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # pin v4.2.1
         with:
@@ -107,11 +107,13 @@ jobs:
         timeout-minutes: 5
 
       - name: Build CLI
+        shell: bash
         run: >-
           cross build -p parsec-cli
-          --release
           --target=${{ matrix.target }}
-          ${{ matrix.type == 'static' && '--features=vendored-openssl' || '' }}
+          $(python make.py parsec-cli-release-cargo-flags)
+        env:
+          LIBPARSEC_FORCE_VENDORED_OPENSSL: ${{ matrix.target == 'x86_64-unknown-linux-musl' && 'true' || 'false' }}
         timeout-minutes: 15
 
       - name: Debug target folder
diff --git a/make.py b/make.py
index 66ea4afd171..ffffe48b0ea 100755
--- a/make.py
+++ b/make.py
@@ -68,6 +68,8 @@
 WEB_DEV_CARGO_FLAGS = "--dev -- --features test-utils"
 WEB_CI_CARGO_FLAGS = f"{WEB_DEV_CARGO_FLAGS} --profile=ci-rust"
 
+CLI_RELEASE_CARGO_FLAGS = f"--release {MAYBE_FORCE_VENDORED_OPENSSL}"
+
 # TL;DR: ONLY USE THE REAL ZSTD IN PRODUCTION !!!
 #
 # `libparsec_zstd` is just a shim over `zstd` crate to provide a simpler-to-build
@@ -244,6 +246,10 @@ def prepare(self) -> None:
     # Flags used in poetry's `server/build.py` when generating the dev wheel
     ("python-dev-libparsec-cargo-flags",): Echo(PYTHON_DEV_CARGO_FLAGS),
     #
+    # Parsec CLI
+    #
+    ("parsec-cli-release-cargo-flags",): Echo(CLI_RELEASE_CARGO_FLAGS),
+    #
     # Electron bindings
     #
     ("electron-dev-install", "ei"): (