diff --git a/.gitea/workflows/deb.yml b/.gitea/workflows/deb.yml
index 1cecf14d..8173feff 100644
--- a/.gitea/workflows/deb.yml
+++ b/.gitea/workflows/deb.yml
@@ -90,7 +90,11 @@ jobs:
           git config --global --add safe.directory "$PWD"
           # punktfunk-client-session is the Vulkan/Skia streamer the shell execs for a connect —
           # both client binaries must ship (build-client-deb.sh installs both).
-          cargo build --release --locked \
+          # --features punktfunk-host/nvenc: the direct-SDK NVENC path (real RFI + recovery anchor on
+          # Linux NVIDIA; design/linux-direct-nvenc.md). AMD/Intel-safe — NVENC/CUDA is dlopen'd at
+          # runtime (no link-time dep; identical DT_NEEDED to a plain build), and the encoder is only
+          # constructed for a CUDA capture frame + PUNKTFUNK_NVENC_DIRECT, never on VAAPI hosts.
+          cargo build --release --locked --features punktfunk-host/nvenc \
             -p punktfunk-host -p punktfunk-client-linux -p punktfunk-client-session
 
       - name: Build + smoke-boot web console (bun preset)
diff --git a/packaging/arch/PKGBUILD b/packaging/arch/PKGBUILD
index 953bccc1..ff6f3935 100644
--- a/packaging/arch/PKGBUILD
+++ b/packaging/arch/PKGBUILD
@@ -67,7 +67,12 @@ build() {
   # caveat the RPM documents): ln -s "$(find / -name libcuda.so -path '*stubs*'|head -1)" /usr/lib/
   # punktfunk-client-session is the Vulkan/Skia streamer the shell (punktfunk-client) execs for
   # a connect — both binaries must ship or streaming from the desktop client breaks.
-  cargo build --release --locked \
+  # `--features punktfunk-host/nvenc` compiles in the direct-SDK NVENC path (real RFI + recovery
+  # anchor on Linux NVIDIA; design/linux-direct-nvenc.md). AMD/Intel-SAFE: the NVENC/CUDA entry
+  # points are dlopen'd at RUNTIME (libloading), never link-imported — `objdump -p` shows the same
+  # DT_NEEDED as a plain build (no libcuda/libnvidia-encode), so the binary starts fine driver-less
+  # and only touches NVIDIA when a CUDA capture frame + PUNKTFUNK_NVENC_DIRECT actually select it.
+  cargo build --release --locked --features punktfunk-host/nvenc \
     -p punktfunk-host -p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-tray
   # Management web console (opt-in): the Nitro `bun`-preset .output bundle (Bun.serve TLS),
   # built AND run with bun.
diff --git a/packaging/rpm/punktfunk.spec b/packaging/rpm/punktfunk.spec
index 3676602e..b5d623c8 100644
--- a/packaging/rpm/punktfunk.spec
+++ b/packaging/rpm/punktfunk.spec
@@ -175,7 +175,11 @@ export PUNKTFUNK_BUILD_VERSION="%{version}-%{release}"
 # --locked: reproducible from (commit + Cargo.lock), matching the .deb build path.
 # punktfunk-client-session is the Vulkan/Skia streamer the shell execs for a connect — both
 # client binaries must ship or streaming from the desktop client breaks.
-cargo build --release --locked \
+# --features punktfunk-host/nvenc: the direct-SDK NVENC path (real RFI + recovery anchor on Linux
+# NVIDIA; design/linux-direct-nvenc.md). AMD/Intel-safe — the NVENC/CUDA entry points are dlopen'd
+# at runtime (no link-time dep; __requires_exclude already drops libcuda), so the binary starts
+# driver-less; the encoder is only built for a CUDA frame + PUNKTFUNK_NVENC_DIRECT, never on VAAPI.
+cargo build --release --locked --features punktfunk-host/nvenc \
   -p punktfunk-host -p punktfunk-client-linux -p punktfunk-client-session -p punktfunk-tray
 
 %if %{with web}