diff --git a/jenkins_wrapper.sh b/jenkins_wrapper.sh
index f2df7f2..2c69271 100755
--- a/jenkins_wrapper.sh
+++ b/jenkins_wrapper.sh
@@ -43,6 +43,7 @@ LSST_DEPLOY_MODE=${LSST_DEPLOY_MODE:-}
 LSST_NO_FETCH=${LSST_NO_FETCH:-false}
 LSST_NO_BINARY_FETCH=${LSST_NO_BINARY_FETCH:-true}
 LSST_PREP_ONLY=${LSST_PREP_ONLY:-false}
+LSST_GLIBC_FLAG=${LSST_GLIBC_FLAG:-false}
 LSST_REFS=${LSST_REFS:-}
 
 fatal_vars() {
@@ -92,6 +93,18 @@ if [[ $LSST_DEPLOY_MODE == bleed ]]; then
   OPTS+=('-b')
 fi
 
+# Force the conda solver to target glibc 2.17 so the rebuild's conda env
+# (captured in stack/src/env/<tag>.env via `conda list --explicit`) resolves
+# packages that run on RHEL7-era hosts such as USDF cvmfs. Only affects the
+# env create/install done by ./bin/deploy; unset before the build runs so it
+# never influences runtime. Linux/x86_64 only -- irrelevant on macOS, and we
+# don't override glibc on aarch64. We also need to pass a flag from Jenkins to
+# avoid false positives.
+if [[ $LSST_GLIBC_FLAG = "true" && $(uname -s) == Linux && $(uname -m) == x86_64 ]] && \
+  [[ $(printf '%s\n' "13.0.0" "$LSST_SPLENV_REF" | sort -V | tail -n1) == "$LSST_SPLENV_REF" ]]; then
+  export CONDA_OVERRIDE_GLIBC=2.17
+fi
+
 if [[ -z "$RUBINENV_ORG_FORK" ]]; then
   # The LSST_SPLENV_REF can refer to a rubin-env version
   #  or to an old scipipe_conda_env SHA1
@@ -116,6 +129,9 @@ else
   LSST_CONDA_ENV_NAME="$(cat rubinenv-feedstock/env.name)"
 fi
 
+# glibc override applies only to the env-create step above, never at build/runtime
+unset CONDA_OVERRIDE_GLIBC
+
 export LSST_CONDA_ENV_NAME
 
 "${SCRIPT_DIR}/lsstswBuild.sh" "${ARGS[@]}"