diff --git a/.gitmodules b/.gitmodules
index 08c66f5ed3..03ba0fd05c 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -64,3 +64,7 @@
 	path = builder/third_party/yaml-cpp
 	url = https://github.com/jbeder/yaml-cpp.git
 	branch = master
+[submodule "builder/third_party/bpftool"]
+	path = builder/third_party/bpftool
+	url = https://github.com/libbpf/bpftool
+	branch = v7.3.0
diff --git a/builder/Dockerfile b/builder/Dockerfile
index 4aee6a0c9c..ecb01b1bec 100644
--- a/builder/Dockerfile
+++ b/builder/Dockerfile
@@ -12,6 +12,7 @@ RUN dnf -y update \
         bison \
         ca-certificates \
         clang-17.0.6 \
+        llvm-17.0.6 \
         cmake \
         cracklib-dicts \
         diffutils \
@@ -42,7 +43,6 @@ RUN dnf -y update \
         valgrind \
         wget \
         which \
-        bpftool \
         # for USDT support
         systemtap-sdt-devel \
     && dnf clean all
diff --git a/builder/install/90-bpftool.sh b/builder/install/90-bpftool.sh
new file mode 100755
index 0000000000..c377d8fc0e
--- /dev/null
+++ b/builder/install/90-bpftool.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -e
+
+cd third_party/bpftool
+
+# Replace libbpf with our submodule
+rm -rf libbpf/
+ln -s ../libbpf libbpf
+
+mkdir src/build
+make V=1 -C src ${NPROCS:+-j ${NPROCS}} all install
diff --git a/builder/third_party/bpftool b/builder/third_party/bpftool
new file mode 160000
index 0000000000..687e7f06f2
--- /dev/null
+++ b/builder/third_party/bpftool
@@ -0,0 +1 @@
+Subproject commit 687e7f06f2ee104ed6515ec3a9816af77bfa7a17
diff --git a/collector/container/konflux.Dockerfile b/collector/container/konflux.Dockerfile
index fd93d76f64..06b45f783b 100644
--- a/collector/container/konflux.Dockerfile
+++ b/collector/container/konflux.Dockerfile
@@ -19,7 +19,7 @@ RUN /tmp/.konflux/scripts/subscription-manager-bro.sh register /mnt && \
         wget \
         unzip \
         clang \
-        bpftool \
+        llvm \
         cmake-3.18.2-9.el8 \
         gcc-c++ \
         openssl-devel \
diff --git a/falcosecurity-libs b/falcosecurity-libs
index 4984d2703a..20fb632793 160000
--- a/falcosecurity-libs
+++ b/falcosecurity-libs
@@ -1 +1 @@
-Subproject commit 4984d2703a1c66513a1e4b994f7c11e6831aded2
+Subproject commit 20fb632793f59bd7bf863459a85804e0349a9c09