diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 259429c..8c6f687 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -236,13 +236,15 @@ jobs:
             aarch64-*-linux-*) sudo apt-get -y install gcc-aarch64-linux-gnu ;;
           esac
 
-      - name: Install bindgen + clang toolchain (for aws-lc on musl/ARM)
-        if: matrix.job.os == 'ubuntu-latest' && contains(matrix.job.target, 'musl') && (startsWith(matrix.job.target, 'arm-') || startsWith(matrix.job.target, 'armv7-') || startsWith(matrix.job.target, 'aarch64-'))
+      - name: Install clang + bindgen for musl targets
+        if: matrix.job.os == 'ubuntu-latest' && contains(matrix.job.target, 'musl')
         shell: bash
         run: |
-          sudo apt-get -y install clang llvm-dev libclang-dev pkg-config cmake build-essential
+          set -euxo pipefail
+          sudo apt-get -y update
+          sudo apt-get -y install clang llvm-dev libclang-dev pkg-config cmake make build-essential
           cargo install --locked bindgen-cli
-          # Make sure libclang is visible if needed (version may differ):
+          # help bindgen find libclang
           echo "LIBCLANG_PATH=$(llvm-config --libdir)" >> $GITHUB_ENV
 
       - name: OpenSSL (vendored) toolchain for musl