diff --git a/ci/scripts/build.sh b/ci/scripts/build.sh
index f595bede10d2..b525c33d230d 100755
--- a/ci/scripts/build.sh
+++ b/ci/scripts/build.sh
@@ -44,7 +44,7 @@ if [[ "$profile" == "ci-dev" ]]; then
     RISINGWAVE_FEATURE_FLAGS=(--features rw-dynamic-link --no-default-features)
 else
     RISINGWAVE_FEATURE_FLAGS=(--features rw-static-link)
-    export OPENSSL_STATIC=1
+    configure_static_openssl
 fi
 
 cargo build \
@@ -62,8 +62,8 @@ cargo build \
 
 artifacts=(risingwave sqlsmith compaction-test risingwave_regress_test risingwave_e2e_extended_mode_test risedev-dev delete-range-test)
 
-echo "--- Show link info"
-ldd target/"$profile"/risingwave
+echo "--- Check link info"
+check_link_info "$profile"
 
 echo "--- Upload artifacts"
 echo -n "${artifacts[*]}" | parallel -d ' ' "mv target/$profile/{} ./{}-$profile && compress-and-upload-artifact ./{}-$profile"
diff --git a/ci/scripts/check.sh b/ci/scripts/check.sh
index b0d0b3e678ae..d51c2e13a6fb 100755
--- a/ci/scripts/check.sh
+++ b/ci/scripts/check.sh
@@ -17,6 +17,9 @@ done
 
 source ci/scripts/common.sh
 
+echo "--- Set openssl static link env vars"
+configure_static_openssl
+
 echo "--- Run trailing spaces check"
 scripts/check/check-trailing-spaces.sh
 
@@ -28,11 +31,11 @@ sccache --show-stats
 sccache --zero-stats
 
 echo "--- Run clippy check (release)"
-OPENSSL_STATIC=1 cargo clippy --release --all-targets --features "rw-static-link" --locked -- -D warnings
+cargo clippy --release --all-targets --features "rw-static-link" --locked -- -D warnings
 
 echo "--- Run cargo check on building the release binary (release)"
-OPENSSL_STATIC=1 cargo check -p risingwave_cmd_all --features "rw-static-link" --profile release
-OPENSSL_STATIC=1 cargo check -p risingwave_cmd --bin risectl --features "rw-static-link" --profile release
+cargo check -p risingwave_cmd_all --features "rw-static-link" --profile release
+cargo check -p risingwave_cmd --bin risectl --features "rw-static-link" --profile release
 
 echo "--- Show sccache stats"
 sccache --show-stats
diff --git a/ci/scripts/common.sh b/ci/scripts/common.sh
index 31896410a762..ad66670b3dd9 100755
--- a/ci/scripts/common.sh
+++ b/ci/scripts/common.sh
@@ -127,3 +127,22 @@ get_latest_cassandra_download_url() {
     local download_url="https://downloads.apache.org/cassandra/${latest_version}/apache-cassandra-${latest_version}-bin.tar.gz"
     echo "$download_url"
 }
+
+configure_static_openssl() {
+    export OPENSSL_STATIC=1
+    export OPENSSL_LIB_DIR="$(dpkg -L libssl-dev | grep libssl.a | xargs dirname)"
+    export OPENSSL_INCLUDE_DIR="$(dpkg -L libssl-dev | grep openssl/ssl.h | xargs dirname)"
+    echo "OPENSSL_STATIC: $OPENSSL_STATIC"
+    echo "OPENSSL_LIB_DIR: $OPENSSL_LIB_DIR"
+    echo "OPENSSL_INCLUDE_DIR: $OPENSSL_INCLUDE_DIR"
+}
+
+check_link_info() {
+  ldd_output=$(ldd target/"$1"/risingwave)
+  echo "$ldd_output"
+  # enforce that libssl is not present if we are building with static openssl
+  if [[ "$profile" == "ci-release" ]] && [[ "$ldd_output" == *"libssl"* ]]; then
+      echo "libssl should not be dynamically linked"
+      exit 1
+  fi
+}
\ No newline at end of file
diff --git a/ci/scripts/release.sh b/ci/scripts/release.sh
index 94fd38e2c9c7..31b3e9743e8c 100755
--- a/ci/scripts/release.sh
+++ b/ci/scripts/release.sh
@@ -71,8 +71,12 @@ if [ "${ARCH}" == "aarch64" ]; then
   # see https://github.com/tikv/jemallocator/blob/802969384ae0c581255f3375ee2ba774c8d2a754/jemalloc-sys/build.rs#L218
   export JEMALLOC_SYS_WITH_LG_PAGE=16
 fi
-OPENSSL_STATIC=1 cargo build -p risingwave_cmd_all --features "rw-static-link" --features external-udf --features wasm-udf --features js-udf --profile release
-OPENSSL_STATIC=1 cargo build -p risingwave_cmd --bin risectl --features "rw-static-link" --profile release
+
+configure_static_openssl
+cargo build -p risingwave_cmd_all --features "rw-static-link" --features external-udf --features wasm-udf --features js-udf --profile release
+cargo build -p risingwave_cmd --bin risectl --features "rw-static-link" --profile release
+check_link_info release
+
 cd target/release && chmod +x risingwave risectl
 
 echo "--- Upload nightly binary to s3"