diff --git a/.github/actions/build-package/action.yml b/.github/actions/build-package/action.yml
index 6ff216b..6db2a33 100644
--- a/.github/actions/build-package/action.yml
+++ b/.github/actions/build-package/action.yml
@@ -83,7 +83,8 @@ runs:
         # Source gcc-toolset environment (version depends on distro)
         if [ -f /etc/profile.d/gcc-toolset-15.sh ]; then
           source /etc/profile.d/gcc-toolset-15.sh
-        # Fallback for Rocky Linux 8/9
+        elif [ -f /etc/profile.d/gcc-toolset-14.sh ]; then
+          source /etc/profile.d/gcc-toolset-14.sh
         elif [ -f /etc/profile.d/gcc-toolset-13.sh ]; then
           source /etc/profile.d/gcc-toolset-13.sh
         fi
@@ -92,8 +93,15 @@ runs:
         export DISABLE_WERRORS=yes
         export BUILD_TLS=yes
         export USE_SYSTEMD=yes
-        # Override RediSearch's new LTO=1 default; toolchain support TBD.
-        export LTO=0
+        # Enable RediSearch LTO only where our LLVM toolchain is installed.
+        # Rocky 8 and 9 lacks a compatible libstdc++ runtime for the prebuilt LLVM
+        # binaries so it has no /opt/llvm; Rocky 10 does.
+        if [ -x /opt/llvm/bin/clang ]; then
+          export LTO=1
+          export PATH=/opt/llvm/bin:$PATH
+        else
+          export LTO=0
+        fi
 
         if [ "${{ steps.version.outputs.VERSION }}" = "unstable" ]; then
           # Clone Redis unstable branch instead of downloading release tarball
diff --git a/dockerfiles/Dockerfile.rockylinux10 b/dockerfiles/Dockerfile.rockylinux10
index 8cc46ca..3715ba4 100644
--- a/dockerfiles/Dockerfile.rockylinux10
+++ b/dockerfiles/Dockerfile.rockylinux10
@@ -42,8 +42,12 @@ RUN echo '[goreleaser]\nname=GoReleaser\nbaseurl=https://repo.goreleaser.com/yum
 COPY install/install_cmake.sh /tmp/
 RUN bash /tmp/install_cmake.sh
 
+# Install LLVM 21 for RediSearch LTO (Rocky 10 only; see install_llvm.sh).
+COPY install/install_llvm.sh /tmp/
+RUN bash /tmp/install_llvm.sh
+
 # Set environment
-ENV PATH="/usr/local/bin:/opt/venv/bin:${PATH}"
+ENV PATH="/opt/llvm/bin:/usr/local/bin:/opt/venv/bin:${PATH}"
 WORKDIR /build
 
 # Default command
diff --git a/install/install_llvm.sh b/install/install_llvm.sh
new file mode 100755
index 0000000..912a980
--- /dev/null
+++ b/install/install_llvm.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Install LLVM 21 for RediSearch's cross-language (C/Rust) LTO build.
+# LLVM has no dnf repo, so we use the official upstream tarball.
+#
+# Rocky 10 only: ships libstdc++ with GLIBCXX_3.4.32 which satisfies the
+# GLIBCXX_3.4.30+ requirement of the prebuilt LLVM 21 binaries.
+# Rocky 8 and Rocky 9 are not supported (incompatible libstdc++ at runtime).
+
+set -euo pipefail
+
+LLVM_VERSION="${LLVM_VERSION:-21.1.8}"
+MAJOR="${LLVM_VERSION%%.*}"
+
+case "$(uname -m)" in
+	x86_64)  asset="LLVM-${LLVM_VERSION}-Linux-X64.tar.xz" ;;
+	aarch64) asset="LLVM-${LLVM_VERSION}-Linux-ARM64.tar.xz" ;;
+	*) echo "Unsupported arch: $(uname -m)" >&2; exit 1 ;;
+esac
+
+install_root="/opt/llvm-${LLVM_VERSION}"
+mkdir -p "$install_root"
+curl -fsSL "https://github.com/llvm/llvm-project/releases/download/llvmorg-${LLVM_VERSION}/${asset}" \
+	| tar -xJ -C "$install_root" --strip-components=1
+ln -sfn "$install_root" /opt/llvm
+
+# RediSearch's build scripts look up clang-${MAJOR}, lld-${MAJOR}, etc. on PATH;
+# the upstream tarball ships unsuffixed names only, so alias them.
+for tool in clang clang++ clang-cpp lld ld.lld ld64.lld lld-link llc opt \
+            llvm-ar llvm-nm llvm-ranlib llvm-strip llvm-objcopy llvm-objdump \
+            llvm-readelf llvm-config; do
+	src="/opt/llvm/bin/${tool}"
+	dst="/opt/llvm/bin/${tool}-${MAJOR}"
+	[ -e "$src" ] && [ ! -e "$dst" ] && ln -sfn "$src" "$dst"
+done
+
+echo 'export PATH=/opt/llvm/bin:$PATH' > /etc/profile.d/llvm.sh
+
+/opt/llvm/bin/clang-${MAJOR} --version
+/opt/llvm/bin/ld.lld-${MAJOR} --version