diff --git a/.cirrus.yml b/.cirrus.yml
index d79db495a0c..cff3db6b0c4 100644
--- a/.cirrus.yml
+++ b/.cirrus.yml
@@ -151,6 +151,8 @@ task:
     chown -R rootless.rootless /home/rootless
     # set PATH
     echo 'export PATH=/usr/local/go/bin:/usr/local/bin:$PATH' >> /root/.bashrc
+    # set CGO_CFLAGS
+    echo 'export CGO_CFLAGS="-DDONT_USE_PR_GET_TID_ADDRESS=1"' >> /root/.bashrc
     # Setup ssh localhost for terminal emulation (script -e did not work)
     ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N ""
     cat /root/.ssh/id_ed25519.pub >> /root/.ssh/authorized_keys
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 933176c581b..cad845378e8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -29,6 +29,7 @@ jobs:
         race: ["-race", ""]
         criu: ["", "criu-dev"]
         dmz: ["", "runc_nodmz"]
+        tidscan: ["", "-DDONT_USE_PR_GET_TID_ADDRESS=1"]
         exclude:
           # Disable most of criu-dev jobs, as they are expensive
           # (need to compile criu) and don't add much value/coverage.
@@ -151,6 +152,7 @@ jobs:
     - name: build
       env:
         EXTRA_BUILDTAGS: ${{ matrix.dmz }}
+        CGO_CFLAGS: ${{ matrix.tidscan }}
       run: sudo -E PATH="$PATH" make EXTRA_FLAGS="${{ matrix.race }}" all
 
     - name: install bats
@@ -162,6 +164,7 @@ jobs:
       if: matrix.rootless != 'rootless'
       env:
         EXTRA_BUILDTAGS: ${{ matrix.dmz }}
+        CGO_CFLAGS: ${{ matrix.tidscan }}
       run: sudo -E PATH="$PATH" -- make TESTFLAGS="${{ matrix.race }}" localunittest
 
     - name: add rootless user
diff --git a/libcontainer/nsenter/nsexec.c b/libcontainer/nsenter/nsexec.c
index c11ba50779d..c4b64374a76 100644
--- a/libcontainer/nsenter/nsexec.c
+++ b/libcontainer/nsenter/nsexec.c
@@ -327,6 +327,9 @@ pid_t gettid(void)
 #  define RUNC_TID_KLUDGE 0
 #endif
 #if RUNC_TID_KLUDGE
+#  if !defined(DONT_USE_PR_GET_TID_ADDRESS)
+#    define DONT_USE_PR_GET_TID_ADDRESS 0
+#  endif
 #  define TID_OFFSET_SCAN_MAX 1024
 static int tid_offset = 0;
 
@@ -392,6 +395,7 @@ static pid_t *find_tls_tid_address(void)
 		.tid = gettid(),
 	};
 
+#  if !DONT_USE_PR_GET_TID_ADDRESS
 	if (!prctl(PR_GET_TID_ADDRESS, &tid_addr))
 		/*
 		 * Make sure the address actually contains the current TID. musl uses a
@@ -399,8 +403,10 @@ static pid_t *find_tls_tid_address(void)
 		 * succeeding doesn't mean the address is the one we want.
 		 */
 		if (tid_addr && *tid_addr == main_tid.tid) {
-			goto got_tid_addr;
+			return tid_addr;
 		}
+#  endif
+	write_log(DEBUG, "let's try using tid scan to find out the tid address in struct thread");
 
 	/*
 	 * If we cannot use PR_GET_TID_ADDRESS to get &PTHREAD_SELF->tid, we
@@ -440,7 +446,6 @@ static pid_t *find_tls_tid_address(void)
 		tid_addr = (pid_t *) (main_tid.handle + tid_offset);
 	}
 
-got_tid_addr:
 	return tid_addr;
 }
 #endif /* RUNC_TID_KLUDGE */