diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e71c916..acd5bf6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,6 +51,18 @@ jobs:
           python-version: ${{ matrix.python }}
       - run: make pytest
 
+  runtime-package:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Exercise the actual Dockerfile and context without the large vLLM base.
+      - name: Fetch and execute DMTCP in the runtime Docker build
+        run: |
+          docker build --target dmtcp -f deploy/kubernetes/Dockerfile \
+            --build-arg BASE=debian:bookworm-slim@sha256:99c0b25c46d0214d5a2091092e7908907dcaecd6a962cde0ac700acee222b6f3 .
+
   lint:
     runs-on: ubuntu-24.04
     steps:
diff --git a/.github/workflows/runtime-image.yml b/.github/workflows/runtime-image.yml
index 66c9514..81f87a0 100644
--- a/.github/workflows/runtime-image.yml
+++ b/.github/workflows/runtime-image.yml
@@ -58,6 +58,12 @@ jobs:
           tar -xzf "$RUNNER_TEMP/release/warmctl-$RELEASE-linux-amd64.tar.gz" -C bin cuinterpose
       - name: Build the released runtime
         run: |
+          # beta.17's Docker context omitted this newly added package fetcher.
+          # Keep the tag immutable; repair only context and system dependencies.
+          if [ "$RELEASE" = v2.0.0-beta.17 ]; then
+            printf '\n!scripts/fetch-dmtcp.sh\n' >> deploy/kubernetes/Dockerfile.dockerignore
+            sed -i 's/ libstdc++6/ libstdc++6 libatomic1/g' deploy/kubernetes/Dockerfile
+          fi
           args=()
           if [ -n "$BASE_IMAGE" ]; then args+=(--build-arg "BASE=$BASE_IMAGE"); fi
           docker build -t "localhost:5000/warmctl/runtime:$IMAGE_TAG" \
diff --git a/README.md b/README.md
index a30cfb8..b9035ee 100644
--- a/README.md
+++ b/README.md
@@ -161,7 +161,8 @@ Keep `warmctl`, `cuinterpose/` and the versioned `dmtcp/` directory from the
 linux-amd64 archive side by side; the installer does this automatically.
 Linux arm64 archives include DMTCP but no cuInterpose yet and are CPU-tested,
 not GPU-qualified. The native DMTCP packages require Debian 12-compatible
-glibc (>= 2.36) and libstdc++. macOS builds run the registry side: `catalog`,
+glibc (>= 2.36), libstdc++ and libatomic (`libstdc++6` and `libatomic1` on
+Debian/Ubuntu). macOS builds run the registry side: `catalog`,
 `images`, `mirror`, `push`, `pull`. Source builds use `make build cuinterpose`;
 see [DMTCP runtime installation and upgrades](docs/dmtcp.md).
 Every release is signed and has build provenance
diff --git a/RELEASING.md b/RELEASING.md
index 08dca54..a3046a9 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -61,7 +61,8 @@ native Linux amd64 and arm64 packages containing both the runtime and fdkeep.
 The plugin source is maintained in that fork's `plugin/fdkeep`, not duplicated
 here. DMTCP and its shared libraries are native Linux code, not portable Go
 executables. Packages are built on Debian 12 (glibc >= 2.36 and compatible
-libstdc++); macOS archives contain only the warmctl client.
+libstdc++ and libatomic); macOS archives contain only the warmctl client.
+Minimal Debian/Ubuntu hosts need `libstdc++6` and `libatomic1` installed.
 
 For an update, first publish and verify the DMTCP release. Update
 `internal/dmtcp/VERSION` and copy its published archive checksums into
diff --git a/deploy/kubernetes/Dockerfile b/deploy/kubernetes/Dockerfile
index b3aa364..4908bee 100644
--- a/deploy/kubernetes/Dockerfile
+++ b/deploy/kubernetes/Dockerfile
@@ -32,7 +32,7 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
 FROM ${BASE} AS dmtcp
 COPY scripts/fetch-dmtcp.sh /src/scripts/fetch-dmtcp.sh
 COPY internal/dmtcp/VERSION internal/dmtcp/SHA256SUMS /src/internal/dmtcp/
-RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl libstdc++6 \
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates curl libstdc++6 libatomic1 \
     && sh /src/scripts/fetch-dmtcp.sh amd64 /opt/warmctl/dmtcp \
     && /opt/warmctl/dmtcp/bin/dmtcp_launch --version
 
@@ -44,7 +44,7 @@ FROM scratch AS cuinterpose
 FROM ${BASE}
 # The native DMTCP package also works with minimal Debian/Ubuntu test bases.
 # --no-upgrade keeps an existing runtime's C++ library unchanged.
-RUN apt-get update && apt-get install -y --no-install-recommends --no-upgrade libstdc++6 \
+RUN apt-get update && apt-get install -y --no-install-recommends --no-upgrade libstdc++6 libatomic1 \
     && rm -rf /var/lib/apt/lists/*
 ARG BASE
 ARG BASE_REF=${BASE}
diff --git a/deploy/kubernetes/Dockerfile.dockerignore b/deploy/kubernetes/Dockerfile.dockerignore
index 032070c..b49aaa4 100644
--- a/deploy/kubernetes/Dockerfile.dockerignore
+++ b/deploy/kubernetes/Dockerfile.dockerignore
@@ -1,4 +1,4 @@
-# Only what the Go build and the extension need.
+# Only what the Go build, extension and released DMTCP package need.
 *
 !go.mod
 !go.sum
@@ -8,5 +8,6 @@
 !profiles
 !hardware
 !python/warmctl_vllm
+!scripts/fetch-dmtcp.sh
 **/*_test.go
 **/__pycache__
diff --git a/docs/dmtcp.md b/docs/dmtcp.md
index ace436a..46516d6 100644
--- a/docs/dmtcp.md
+++ b/docs/dmtcp.md
@@ -86,7 +86,8 @@ existing snapshots. Use an old snapshot's original runtime image or explicit
 replace an existing runtime image. See the fork's
 [release procedure](https://github.com/TensorRails/dmtcp/blob/v5.0.0-warmctl.1/RELEASING.md).
 
-The packages require glibc >= 2.36 and compatible libstdc++. ARM64 passes
+The packages require glibc >= 2.36, compatible libstdc++ and libatomic
+(`libstdc++6` and `libatomic1` on Debian/Ubuntu). ARM64 passes
 native CPU checkpoint/restore tests, including fdkeep; GPU serving has not
 been qualified on ARM64. Parallel pread is x86-64-only; ARM64 uses the
 ordinary reader with optional huge pages.