diff --git a/recipes/incoming-go/gocryptfs.toml b/recipes/incoming-go/gocryptfs.toml
index 029ae4bf..0d39517f 100644
--- a/recipes/incoming-go/gocryptfs.toml
+++ b/recipes/incoming-go/gocryptfs.toml
@@ -14,7 +14,8 @@ compiler = "zig-cc"
 target   = "x86_64-linux-musl"
 link     = "static"
 flags    = []
+cgo      = true   # stupidgcm linkea libcrypto (openssl) vía cgo — caso cgo-lib-EXTERNA
 
-# buildInputs de nix (no usados con CGO off): go, pandoc-cli, openssl
+# openssl provee libcrypto.a + libcrypto.pc; pkgconf resuelve el `#cgo pkg-config: libcrypto`.
 [deps]
-build = ["go"]
+build = ["go", "openssl", "pkgconf"]