diff --git a/docker/build_in_rocky9.sh b/docker/build_in_rocky9.sh
index 71aa71b0..6f02a7a9 100755
--- a/docker/build_in_rocky9.sh
+++ b/docker/build_in_rocky9.sh
@@ -42,12 +42,20 @@ docker run --rm \
 
         echo "===================== ldd jfjoch_viewer ====================="
         ldd "$bin" | sort
-        echo "===================== shed-lib check ========================"
-        # These should ALL be gone now (libpcre2-16 is Qt s own and legitimately stays).
-        shed="dbus|systemd|zstd|lz4|selinux|glib|gthread|libpcre\.|libpcre2-8|gcrypt|gpg-error"
-        if ldd "$bin" | grep -Ei "$shed"; then
-            echo ">>> UNEXPECTED: the above libs are still linked"
+        echo "========== dbus/systemd tail (what the static libdbus removes) =========="
+        # These only ever entered via the system libdbus-1.so -> libsystemd chain, so they MUST be gone.
+        tail_re="libdbus-1|libsystemd|libzstd|liblz4|libgcrypt|libgpg-error|libcap\."
+        if ldd "$bin" | grep -Ei "$tail_re"; then
+            echo ">>> FAIL: the dbus/systemd tail is still linked"
         else
-            echo ">>> CLEAN: dbus / systemd / glib / selinux tail all gone"
+            echo ">>> OK: libdbus/libsystemd/zstd/lz4/cap/gcrypt/gpg-error all gone"
         fi
+        echo "========== residual glib/selinux (expected on RHEL9, NOT from us) =========="
+        # libglib here is pulled by the system harfbuzz/fontconfig/freetype text stack (glib-linked on
+        # RHEL9), not by Qt -- QT_FEATURE_glib=OFF is honoured (Qt is off the glib event loop) but cannot
+        # drop the font-stack glib. libselinux/libpcre2-8 come from the krb5/GSSAPI stack that static
+        # curl links for auth (kept for the reverse-proxy Kerberos plan) -- same bucket as libcrypto.
+        # Shedding these would mean static-linking the whole font stack / dropping krb5. (libpcre2-16 is
+        # Qt-owned and legitimately stays.)
+        ldd "$bin" | grep -Ei "libglib|gthread|selinux|libpcre\.|libpcre2-8" || echo "(none)"
     '