Also, there’s now a --shrinkwrap option to patchelf, which might help and probably should be used in the CA builds?
It gets all the transitive dependencies of a binary (so including those of libraries that are used) and pins them all with their full path into the binary’s ELF header. Speeds up loading but might also solve that linker order?