diff --git a/scripts/deploy.z-run b/scripts/deploy.z-run
index f66ebec..0c0451a 100644
--- a/scripts/deploy.z-run
+++ b/scripts/deploy.z-run
@@ -9,6 +9,7 @@
 
 
 --:: deploy / rsync / * / linux / x86_64 :: exec -- "${ZRUN[@]}" ':: deploy / rsync / *' linux--x86_64 "${@}"
+--:: deploy / rsync / * / linux / x86_64 / seccomp :: exec -- "${ZRUN[@]}" ':: deploy / rsync / *' linux--x86_64--seccomp "${@}"
 --:: deploy / rsync / * / darwin / x86_64 :: exec -- "${ZRUN[@]}" ':: deploy / rsync / *' darwin--x86_64 "${@}"
 --:: deploy / rsync / * / darwin / aarch64 :: exec -- "${ZRUN[@]}" ':: deploy / rsync / *' darwin--aarch64 "${@}"
 --:: deploy / rsync / * / freebsd / x86_64 :: exec -- "${ZRUN[@]}" ':: deploy / rsync / *' freebsd--x86_64 "${@}"
@@ -78,7 +79,11 @@
 			if test "${_main_0}" != all -a "${_main_0}" != "${_main}" ; then
 				continue
 			fi
-			for _os in linux--x86_64 darwin--x86_64 darwin--aarch64 freebsd--x86_64 openbsd--x86_64 android--aarch64 ; do
+			for _os in linux--x86_64 linux--x86_64--seccomp darwin--x86_64 darwin--aarch64 freebsd--x86_64 openbsd--x86_64 android--aarch64 ; do
+				case "${_main}::${_os}" in
+					( kawipiko-server::linux--x86_64--seccomp ) ;;
+					( *::linux--x86_64--seccomp ) continue ;;
+				esac
 				if test -e "./.publish/${_os}/${_main}--${_os}--v${_build_version}${_build_suffix}" ; then
 					printf -- '[ee]  release already exists for `%s` for `%s`!\n' "${_main}" "${_os}" >&2
 					exit -- 1
@@ -133,13 +138,18 @@
 	
 	printf -- '[ii]  publishing all for `%s`...\n' "${_build_version}${_build_suffix}" >&2
 	
-	for _os in linux--x86_64 darwin--x86_64 darwin--aarch64 freebsd--x86_64 openbsd--x86_64 android--aarch64 ; do
+	for _os in linux--x86_64 linux--x86_64--seccomp darwin--x86_64 darwin--aarch64 freebsd--x86_64 openbsd--x86_64 android--aarch64 ; do
 		for _main in kawipiko-wrapper kawipiko-archiver kawipiko-server kawipiko-server-dummy ; do
 			
 			if test "${_main_0}" != all -a "${_main_0}" != "${_main}" ; then
 				continue
 			fi
 			
+			case "${_main}::${_os}" in
+				( kawipiko-server::linux--x86_64--seccomp ) ;;
+				( *::linux--x86_64--seccomp ) continue ;;
+			esac
+			
 			printf -- '[ii]  publishing `%s` for `%s` for `%s`...\n' "${_main}" "${_os}" "${_build_version}${_build_suffix}" >&2
 			printf -- '[--]\n' >&2
 			
@@ -185,13 +195,18 @@
 		
 		printf -- '[ii]  publishing all for `%s` (on GitHub)...\n' "${_build_version}${_build_suffix}" >&2
 		
-		for _os in linux--x86_64 darwin--x86_64 darwin--aarch64 freebsd--x86_64 openbsd--x86_64 android--aarch64 ; do
+		for _os in linux--x86_64 linux--x86_64--seccomp darwin--x86_64 darwin--aarch64 freebsd--x86_64 openbsd--x86_64 android--aarch64 ; do
 			for _main in kawipiko-wrapper kawipiko-archiver kawipiko-server kawipiko-server-dummy ; do
 				
 				if test "${_main_0}" != all -a "${_main_0}" != "${_main}" ; then
 					continue
 				fi
 				
+				case "${_main}::${_os}" in
+					( kawipiko-server::linux--x86_64--seccomp ) ;;
+					( *::linux--x86_64--seccomp ) continue ;;
+				esac
+				
 				printf -- '[ii]  publishing `%s` for `%s` for `%s` (on GitHub)...\n' "${_main}" "${_os}" "${_build_version}${_build_suffix}" >&2
 				
 				if test "${_build_release}" == true ; then
@@ -235,10 +250,14 @@
 		if test "${_main_0}" != all -a "${_main_0}" != "${_main}" ; then
 			continue
 		fi
-		for _os in linux--x86_64 darwin--x86_64 darwin--aarch64 freebsd--x86_64 openbsd--x86_64 android--aarch64 ; do
+		for _os in linux--x86_64 linux--x86_64--seccomp darwin--x86_64 darwin--aarch64 freebsd--x86_64 openbsd--x86_64 android--aarch64 ; do
 			if test "${_os_0}" != all -a "${_os_0}" != "${_os}" ; then
 				continue
 			fi
+			case "${_main}::${_os}" in
+				( kawipiko-server::linux--x86_64--seccomp ) ;;
+				( *::linux--x86_64--seccomp ) continue ;;
+			esac
 			"${ZRUN[@]}" ':: go / build / all / publish' "${_os}" "${_main#kawipiko-}"
 		done
 	done
diff --git a/scripts/go.z-run b/scripts/go.z-run
index 786eb95..77498b8 100644
--- a/scripts/go.z-run
+++ b/scripts/go.z-run
@@ -334,30 +334,8 @@
 	fi
 	test "${#}" -eq 0
 	"${ZRUN[@]}" ':: sources / embedded / bundle'
-	_tags=(
-			netgo
-		)
-	_flags=(
-		#?	-buildmode exe
-		)
-	_gcflags=()
-	_ldflags=()
-	if test "${__BUILD_QUICK:-false}" != true ; then
-		_flags+=( -trimpath -a )
-		_gcflags+=( 'all=-l=4' )
-		_ldflags+=( 'all=-s' )
-	fi
-	_ldflags+=(
-			-X "github.com/volution/kawipiko/embedded.BUILD_TARGET=release"
-			-X "github.com/volution/kawipiko/embedded.BUILD_GIT_HASH=$( exec -- cat -- ./.outputs/markers/build-git-hash.txt )"
-		)
-	_flags+=(
-			-tags "$( printf -- '%s,' "${_tags[@]}" )"
-			-gcflags "$( printf -- '%s ' "${_gcflags[@]}" )"
-			-ldflags "$( printf -- '%s ' "${_ldflags[@]}" )"
-		)
 	_outputs="$( exec -- readlink -e -- ./.outputs )"
-	for _platform in linux--x86_64 darwin--x86_64 darwin--aarch64 openbsd--x86_64 freebsd--x86_64 android--aarch64 ; do
+	for _platform in linux--x86_64 linux--x86_64--seccomp darwin--x86_64 darwin--aarch64 openbsd--x86_64 freebsd--x86_64 android--aarch64 ; do
 		if test "${_platform_0}" != all -a "${_platform_0}" != "${_platform}" ; then
 			continue
 		fi
@@ -365,12 +343,16 @@
 			if test "${_component_0}" != all -a "${_component_0}" != "${_component}" ; then
 				continue
 			fi
+			case "${_component}::${_platform}" in
+				( server::linux--x86_64--seccomp ) ;;
+				( *::linux--x86_64--seccomp ) continue ;;
+			esac
 			if test -e "${_outputs}/binaries/publish/kawipiko-${_component}--${_platform}" ; then
 				rm -f -- "${_outputs}/binaries/publish/kawipiko-${_component}--${_platform}"
 			fi
 		done
 	done
-	for _platform in linux--x86_64 darwin--x86_64 darwin--aarch64 openbsd--x86_64 freebsd--x86_64 android--aarch64 ; do
+	for _platform in linux--x86_64 linux--x86_64--seccomp darwin--x86_64 darwin--aarch64 openbsd--x86_64 freebsd--x86_64 android--aarch64 ; do
 		if test "${_platform_0}" != all -a "${_platform_0}" != "${_platform}" ; then
 			continue
 		fi
@@ -378,10 +360,14 @@
 			if test "${_component_0}" != all -a "${_component_0}" != "${_component}" ; then
 				continue
 			fi
+			case "${_component}::${_platform}" in
+				( server::linux--x86_64--seccomp ) ;;
+				( *::linux--x86_64--seccomp ) continue ;;
+			esac
 			test ! -e "${_outputs}/binaries/publish/kawipiko-${_component}--${_platform}"
 			printf -- '[ii]  building `%s` for `%s`...\n' "${_component}" "${_platform}" >&2
 			case "${_platform}" in
-				( linux--x86_64 )
+				( linux--x86_64 | linux--x86_64--seccomp )
 					export -- GOOS=linux
 					export -- GOARCH=amd64
 				;;
@@ -409,6 +395,42 @@
 					exit -- 1
 				;;
 			esac
+			if test "${_platform}" == linux--x86_64--seccomp ; then
+				_seccomp=true
+			else
+				_seccomp=false
+			fi
+			_tags=(
+					netgo
+				)
+			_flags=(
+				#?	-buildmode exe
+				)
+			_gcflags=()
+			_ldflags=()
+			if test "${__BUILD_QUICK:-false}" != true ; then
+				_flags+=( -trimpath -a )
+				_gcflags+=( 'all=-l=4' )
+				_ldflags+=( 'all=-s' )
+			fi
+			_ldflags+=(
+					-X "github.com/volution/kawipiko/embedded.BUILD_TARGET=release"
+					-X "github.com/volution/kawipiko/embedded.BUILD_GIT_HASH=$( exec -- cat -- ./.outputs/markers/build-git-hash.txt )"
+				)
+			if test "${_seccomp}" == true ; then
+				_tags+=(
+						seccomp
+					)
+				_ldflags+=(
+						-linkmode external
+						-extldflags -static
+					)
+			fi
+			_flags+=(
+					-tags "$( printf -- '%s,' "${_tags[@]}" )"
+					-gcflags "$( printf -- '%s ' "${_gcflags[@]}" )"
+					-ldflags "$( printf -- '%s ' "${_ldflags[@]}" )"
+				)
 			nodaemon \
 				nice -n 19 -- \
 			"${ZRUN[@]}" ':: go / tool' \