diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0fc9129857..c78756ac69 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -269,26 +269,25 @@ if(NOT (WIN32 OR APPLE OR USE_STATIC))
 		# Some systems support $ORIGIN in RPATH to enable relocatable
 		# binaries. In other cases, only absolute paths can be used.
 		# https://www.lekensteyn.nl/rpath.html
+		#
+		# Also note that some systems (notably those using GNU libc)
+		# silently ignore $ORIGIN in RPATH for binaries that are
+		# setuid root or use privileged capabilities.
+		#
 		if(CMAKE_SYSTEM_NAME MATCHES "^(Linux|SunOS|FreeBSD)$")
 			set(_enable_rpath_origin TRUE)
-			if(BUILD_dumpcap AND ENABLE_PCAP)
-				# dumpcap will most likely be installed with
-				# capabilities or setuid. Relative RPATHs that
-				# resolve to non-standard library directories
-				# are ignored for such binaries and since we
-				# cannot achieve relocatable builds, just
-				# disable it by default.
-				set(_enable_rpath_origin FALSE)
-			endif()
-			# Provide a knob to optionally force absolute rpaths,
-			# to support old/buggy systems and as a user preference
-			# for hardening.
-			set(ENABLE_RPATH_ORIGIN ${_enable_rpath_origin} CACHE BOOL
-				"Use $ORIGIN with INSTALL_RPATH")
-			mark_as_advanced(ENABLE_RPATH_ORIGIN)
 		else()
-			set(ENABLE_RPATH_ORIGIN FALSE)
+			set(_enable_rpath_origin FALSE)
 		endif()
+
+		# Provide a knob to optionally force absolute rpaths,
+		# to support old/buggy systems and as a user preference
+		# for hardening.
+		# XXX Should this be a CMake option?
+		set(ENABLE_RPATH_ORIGIN ${_enable_rpath_origin} CACHE BOOL
+			"Use $ORIGIN with INSTALL_RPATH")
+		mark_as_advanced(ENABLE_RPATH_ORIGIN)
+
 		if(ENABLE_RPATH_ORIGIN)
 			set(LIBRARY_INSTALL_RPATH     "$ORIGIN")
 			set(EXECUTABLE_INSTALL_RPATH  "$ORIGIN/../${CMAKE_INSTALL_LIBDIR}")
@@ -3131,7 +3130,7 @@ endif()
 if(BUILD_dumpcap AND PCAP_FOUND)
 	set(dumpcap_LIBS
 		writecap
-		wsutil
+		wsutil_static
 		caputils
 		ui
 		version_info
diff --git a/capture/CMakeLists.txt b/capture/CMakeLists.txt
index f25ddb31e6..f899667156 100644
--- a/capture/CMakeLists.txt
+++ b/capture/CMakeLists.txt
@@ -48,9 +48,9 @@ add_library(caputils STATIC
 
 target_link_libraries(caputils
 	PUBLIC
-		wsutil
 		$<$<BOOL:${PCAP_FOUND}>:pcap::pcap>
 	PRIVATE
+		wsutil_static
 		${NL_LIBRARIES}
 		${WIN_IPHLPAPI_LIBRARY}
 )
diff --git a/docbook/release-notes.adoc b/docbook/release-notes.adoc
index 2dc5924a6b..a0009dd782 100644
--- a/docbook/release-notes.adoc
+++ b/docbook/release-notes.adoc
@@ -36,6 +36,9 @@ Previously it was ``$XDG_CONFIG_HOME/wireshark/extcap``.
 The installation target no longer installs development headers by default.
 That must be done explicitly using ``cmake --install <builddir> --component Development``.
 
+The Wireshark installation is relocatable on Linux (and other ELF platforms
+with support for relative RPATHs).
+
 Many other improvements have been made.
 See the “New and Updated Features” section below for more details.
 
diff --git a/wsutil/CMakeLists.txt b/wsutil/CMakeLists.txt
index 08e16ee37a..002e11bfbb 100644
--- a/wsutil/CMakeLists.txt
+++ b/wsutil/CMakeLists.txt
@@ -333,6 +333,38 @@ install(TARGETS wsutil
 	ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
 )
 
+add_library(wsutil_static STATIC
+	${WSUTIL_FILES}
+	$<TARGET_OBJECTS:wmem>
+)
+
+target_compile_definitions(wsutil_static PRIVATE
+	ENABLE_STATIC
+	BUILD_WSUTIL
+)
+
+target_link_libraries(wsutil_static
+	PUBLIC
+		${GLIB2_LIBRARIES}
+		${GMODULE2_LIBRARIES}
+		${GNUTLS_LIBRARIES}
+		${PCRE2_LIBRARIES}
+		${GCRYPT_LIBRARIES}
+	PRIVATE
+		${APPLE_CORE_FOUNDATION_LIBRARY}
+		${CMAKE_DL_LIBS}
+		${M_LIBRARIES}
+		${WIN_IPHLPAPI_LIBRARY}
+		${WIN_WS2_32_LIBRARY}
+)
+
+target_include_directories(wsutil_static
+	SYSTEM PUBLIC
+		${GCRYPT_INCLUDE_DIRS}
+		${GNUTLS_INCLUDE_DIRS}
+		${PCRE2_INCLUDE_DIRS}
+)
+
 add_executable(test_wsutil EXCLUDE_FROM_ALL
 	test_wsutil.c
 )