diff --git a/.goreleaser.yml b/.goreleaser.yml
index 8d634275..04512980 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -13,6 +13,10 @@ builds:
       - "-linkmode=external -extldflags=-static -s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}}"
     goos: [ linux ]
     goarch: [ amd64 ]
+    hooks:
+      post:
+        - cmd: ./scripts/check-cpu-baseline.sh "{{ .Path }}" # catch x86-64-v3 C code, see #2092
+          output: true
   - id: ntfy_linux_armv6
     binary: ntfy
     env:
diff --git a/Makefile b/Makefile
index 367eec12..31f480c2 100644
--- a/Makefile
+++ b/Makefile
@@ -117,6 +117,7 @@ build-deps-ubuntu:
 		gcc-mingw-w64-x86-64 \
 		python3 \
 		python3-venv \
+		qemu-user \
 		jq
 	which pip3 || sudo apt-get install -y python3-pip
 
diff --git a/scripts/check-cpu-baseline.sh b/scripts/check-cpu-baseline.sh
new file mode 100755
index 00000000..23932ffc
--- /dev/null
+++ b/scripts/check-cpu-baseline.sh
@@ -0,0 +1,21 @@
+#!/bin/bash
+# Runs an amd64 binary on an emulated baseline x86-64 CPU (qemu64: no AVX2, BMI2, MOVBE), to catch
+# statically linked C code (glibc, SQLite) that was built for newer CPUs, see #2092.
+#
+# Fails without qemu-x86_64 in CI (CI is set by GitHub Actions), skips with a warning elsewhere.
+set -euo pipefail
+
+binary="$1"
+if ! command -v qemu-x86_64 >/dev/null; then
+  if [ -n "${CI:-}" ]; then
+    echo "ERROR: qemu-x86_64 not found, cannot check $binary on a baseline x86-64 CPU. On Ubuntu, run: apt install qemu-user"
+    exit 1
+  fi
+  echo "WARNING: qemu-x86_64 not found, skipping baseline x86-64 CPU check of $binary"
+  exit 0
+fi
+if ! qemu-x86_64 -cpu qemu64 "$binary" --help >/dev/null; then
+  echo "ERROR: $binary does not run on a baseline x86-64 CPU (qemu64), it likely contains x86-64-v3 instructions (see #2092)"
+  exit 1
+fi
+echo "$binary runs on a baseline x86-64 CPU (qemu64)"