diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3f6c66946..12a2e3058 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -47,6 +47,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `/proc/self/exe` sealing we introduced in runc [1.2.0][]. (#5141)
 
 ### Changed ###
+- Our release binaries and default build configuration now use [libpathrs][] by
+  default, providiung better hardening against certain kinds of attacks. Users
+  of runc should not see any changes as a result of this, but pacakgers will
+  need to adjust their packaging accordingly. runc can still be built without
+  libpathrs (by building without the `libpathrs` build tag), but we currently
+  plan to make runc 1.6 *require* libpathrs. (#5103)
 - Previously we made an attempt to make our `runc.armhf` release binaries work
   with ARMv6 (which would allow runc to work on the original Raspberry Pi).
   Unfortunately, this has effectively always been broken (because we
@@ -54,6 +60,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   it) and so we are now officially matching [the Debian definition of `armhf`][debian-armhf]
   (that is, ARMv7). (#5103)
 
+[libpathrs]: https://github.com/cyphar/libpathrs
 [debian-armhf]: https://wiki.debian.org/ArmHardFloatPort
 
 ## [1.4.0] - 2025-11-27
diff --git a/Makefile b/Makefile
index 0a00e6607..de5cc2e6a 100644
--- a/Makefile
+++ b/Makefile
@@ -12,7 +12,7 @@ GIT_BRANCH_CLEAN := $(shell echo $(GIT_BRANCH) | sed -e "s/[^[:alnum:]]/-/g")
 RUNC_IMAGE := runc_dev$(if $(GIT_BRANCH_CLEAN),:$(GIT_BRANCH_CLEAN))
 PROJECT := github.com/opencontainers/runc
 EXTRA_BUILDTAGS :=
-BUILDTAGS := seccomp urfave_cli_no_docs
+BUILDTAGS := seccomp urfave_cli_no_docs libpathrs
 BUILDTAGS += $(EXTRA_BUILDTAGS)
 
 COMMIT := $(shell git describe --dirty --long --always)
diff --git a/README.md b/README.md
index cf1df2369..84f6b9e9c 100644
--- a/README.md
+++ b/README.md
@@ -112,7 +112,7 @@ make EXTRA_BUILDTAGS="runc_nocriu"
 | Build Tag     | Feature                               | Enabled by Default | Dependencies        |
 |---------------|---------------------------------------|--------------------|---------------------|
 | `seccomp`     | Syscall filtering using `libseccomp`. | yes                | `libseccomp`        |
-| `libpathrs`   | Use [`libpathrs`][] for path safety.  | no                 | [`libpathrs`][]     |
+| `libpathrs`   | Use [`libpathrs`][] for path safety.  | yes                | [`libpathrs`][]     |
 | `runc_nocriu` | **Disables** runc checkpoint/restore. | no                 | `criu`              |
 
 The following build tags were used earlier, but are now obsoleted: