diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index cfdf4fb8725..5ce7d07384a 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -76,8 +76,14 @@ jobs:
         uses: actions/setup-go@v5
         with:
           go-version: "${{ env.GO_VERSION }}"
+      - name: install deps
+        run: |
+          sudo apt update
+          sudo apt -y install libseccomp-dev
       - name: compile with no build tags
         run: make BUILDTAGS=""
+      - name: compile with runc_nocr build tag
+        run: make EXTRA_BUILDTAGS="runc_nocr"
 
   codespell:
     runs-on: ubuntu-24.04
diff --git a/README.md b/README.md
index 50fcd4e9222..d4e3f9a9e92 100644
--- a/README.md
+++ b/README.md
@@ -103,9 +103,17 @@ e.g. to disable seccomp:
 make BUILDTAGS=""
 ```
 
+To add some more build tags to the default set, use the `EXTRA_BUILDTAGS`
+make variable, e.g. to disable checkpoint/restore:
+
+```bash
+make EXTRA_BUILDTAGS="runc_nocr"
+```
+
 | Build Tag     | Feature                               | Enabled by Default | Dependencies        |
 |---------------|---------------------------------------|--------------------|---------------------|
 | `seccomp`     | Syscall filtering using `libseccomp`. | yes                | `libseccomp`        |
+| `runc_nocr`   | Disables runc checkpoint/restore.     | no                 | `criu`              |
 
 The following build tags were used earlier, but are now obsoleted:
  - **runc_nodmz** (since runc v1.2.1 runc dmz binary is dropped)
diff --git a/libcontainer/criu_linux.go b/libcontainer/criu_linux.go
index 65bd08ea1ed..7886b5ec2b6 100644
--- a/libcontainer/criu_linux.go
+++ b/libcontainer/criu_linux.go
@@ -1,3 +1,5 @@
+//go:build !runc_nocr
+
 package libcontainer
 
 import (