diff --git a/ct/networkoptimizer.sh b/ct/networkoptimizer.sh
index 0860508c8..1f9b5f05c 100644
--- a/ct/networkoptimizer.sh
+++ b/ct/networkoptimizer.sh
@@ -43,6 +43,9 @@ function update_script() {
     RID="linux-x64"
     [[ "$(dpkg --print-architecture)" == "arm64" ]] && RID="linux-arm64"
     cd /opt/networkoptimizer
+    export MSBUILDDISABLENODEREUSE=1
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    export DOTNET_SYSTEM_NET_DISABLEIPV6=1
     $STD dotnet publish src/NetworkOptimizer.Web -c Release -r "$RID" --self-contained -o /opt/networkoptimizer/publish
     chmod +x /opt/networkoptimizer/publish/NetworkOptimizer.Web
     mkdir -p /opt/networkoptimizer/publish/tools
diff --git a/install/networkoptimizer-install.sh b/install/networkoptimizer-install.sh
index 1ab1518e2..7636380a1 100644
--- a/install/networkoptimizer-install.sh
+++ b/install/networkoptimizer-install.sh
@@ -35,6 +35,12 @@ RID="linux-x64"
 [[ "$(dpkg --print-architecture)" == "arm64" ]] && RID="linux-arm64"
 cd /opt/networkoptimizer
 export MinVerVersionOverride="$(cat ~/.networkoptimizer)"
+# MSBuild's persistent worker nodes can deadlock in unprivileged LXC, and a
+# flaky IPv6 path can stall NuGet restore for minutes per package - both look
+# like an indefinite hang. Neither costs anything for a one-shot publish.
+export MSBUILDDISABLENODEREUSE=1
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+export DOTNET_SYSTEM_NET_DISABLEIPV6=1
 $STD dotnet publish src/NetworkOptimizer.Web -c Release -r "$RID" --self-contained -o /opt/networkoptimizer/publish
 chmod +x /opt/networkoptimizer/publish/NetworkOptimizer.Web
 msg_ok "Built NetworkOptimizer"