diff --git a/Dockerfile b/Dockerfile
index 94c7756ded..9008897087 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -45,6 +45,7 @@ RUN apt-get update && apt-get install -y \
 	iptables \
 	libapparmor-dev \
 	libcap-dev \
+	libltdl-dev \
 	libsqlite3-dev \
 	libsystemd-journal-dev \
 	mercurial \
diff --git a/hack/make.sh b/hack/make.sh
index fd60e41400..4e015b4d6e 100755
--- a/hack/make.sh
+++ b/hack/make.sh
@@ -98,7 +98,7 @@ fi
 if [ "$DOCKER_EXPERIMENTAL" ] || [ "$DOCKER_REMAP_ROOT" ]; then
 	echo >&2 '# WARNING! DOCKER_EXPERIMENTAL is set: building experimental features'
 	echo >&2
-	DOCKER_BUILDTAGS+=" experimental"
+	DOCKER_BUILDTAGS+=" experimental pkcs11"
 fi
 
 if [ -z "$DOCKER_CLIENTONLY" ]; then
diff --git a/hack/make/binary b/hack/make/binary
index 19f4d7c4f4..55a54d1e13 100644
--- a/hack/make/binary
+++ b/hack/make/binary
@@ -25,6 +25,10 @@ if [ "$(go env GOHOSTOS)/$(go env GOHOSTARCH)" == "windows/amd64" ] && [ "$(go e
 	export LDFLAGS_STATIC_DOCKER="$LDFLAGS_STATIC_DOCKER -linkmode=internal"
 fi
 
+if [ "$IAMSTATIC" == "true" ]; then
+	export BUILDFLAGS=( "${BUILDFLAGS[@]/pkcs11 /}" ) # we cannot dlopen in pkcs11 in a static binary
+fi
+
 echo "Building: $DEST/$BINARY_FULLNAME"
 go build \
 	-o "$DEST/$BINARY_FULLNAME" \