diff --git a/tools/ctl/CMakeLists.txt b/tools/ctl/CMakeLists.txt
index 5c4c2dd315b5..ba897c99d126 100644
--- a/tools/ctl/CMakeLists.txt
+++ b/tools/ctl/CMakeLists.txt
@@ -11,6 +11,16 @@ target_link_libraries(sof-ctl PRIVATE
 	"-lasound"
 )
 
+# tools/lib is only needed as a -L link path for a locally built ALSA.
+# Do not let CMake also embed it as an ELF RPATH/RUNPATH: it points into
+# the build tree and, once stripped to empty on install, leaves an empty
+# DT_RUNPATH tag that trips distro ELF security scanners (scanelf reports
+# "NULL DT_RUNPATH"). Skip the build RPATH and keep the install RPATH
+# empty so no DT_RUNPATH tag is emitted. See thesofproject/sof#10070.
+set_target_properties(sof-ctl PROPERTIES
+	SKIP_BUILD_RPATH TRUE
+	INSTALL_RPATH "")
+
 target_compile_options(sof-ctl PRIVATE
 	-Wall -Werror
 )