diff --git a/.gitea/workflows/build_and_test.yml b/.gitea/workflows/build_and_test.yml
index f85a93e6..661e08d5 100644
--- a/.gitea/workflows/build_and_test.yml
+++ b/.gitea/workflows/build_and_test.yml
@@ -124,6 +124,10 @@ jobs:
             use_cuda: 'OFF'
     steps:
       - uses: actions/checkout@v4
+      - name: Clean previous build
+        shell: bash
+        run: rm -rf build   # self-hosted runners reuse the workspace volume; a stale build dir
+                            # can leave the viewer linking a system libcurl instead of the vendored one
       - name: Configure viewer build
         shell: bash
         run: |
@@ -219,6 +223,10 @@ jobs:
             upload_url: https://gitea.psi.ch/api/packages/mx/debian/pool/noble/nocuda/upload
     steps:
       - uses: actions/checkout@v4
+      - name: Clean previous build
+        shell: bash
+        run: rm -rf build   # self-hosted runners reuse the workspace volume; a stale build dir
+                            # can leave the viewer linking a system libcurl instead of the vendored one
       - name: Setup build (cmake)
         shell: bash
         run: |
diff --git a/CMakeLists.txt b/CMakeLists.txt
index ced3b92d..fe778f4e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -296,6 +296,15 @@ IF (JFJOCH_VIEWER_BUILD OR JFJOCH_VIEWER_ONLY)
             GIT_TAG curl-8_11_1
             EXCLUDE_FROM_ALL)
     FetchContent_MakeAvailable(curl)
+    # The viewer must link the vendored static libcurl, never a system one. If FetchContent is
+    # ever short-circuited (find_package / a dependency provider resolving CURL to the OS libcurl,
+    # or a stale runner build dir), the libcurl_static target is absent -- fail loudly instead of
+    # silently linking the system curl with the wrong TLS/Kerberos backend.
+    IF (NOT TARGET libcurl_static)
+        MESSAGE(FATAL_ERROR
+                "libcurl was not built from FetchContent (libcurl_static target missing) -- a "
+                "system libcurl is shadowing the vendored one; wipe the build dir and reconfigure.")
+    ENDIF()
 ENDIF()
 
 IF (JFJOCH_VIEWER_ONLY)