diff --git a/build/azure-pipelines/cli/cli-compile.yml b/build/azure-pipelines/cli/cli-compile.yml
index eaa222dbd1d..ba0a70da645 100644
--- a/build/azure-pipelines/cli/cli-compile.yml
+++ b/build/azure-pipelines/cli/cli-compile.yml
@@ -48,17 +48,39 @@ steps:
               export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER="$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/bin/aarch64-linux-gnu-gcc"
               export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUSTFLAGS="-C link-arg=--sysroot=$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/sysroot"
               export CC_aarch64_unknown_linux_gnu="$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/bin/aarch64-linux-gnu-gcc --sysroot=$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/sysroot"
+              export OBJDUMP="$VSCODE_SYSROOT_DIR/aarch64-linux-gnu/aarch64-linux-gnu/bin/objdump"
             elif [ "$SYSROOT_ARCH" == "amd64" ]; then
               export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER="$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/bin/x86_64-linux-gnu-gcc"
               export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUSTFLAGS="-C link-arg=--sysroot=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot -C link-arg=-L$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot/usr/lib/x86_64-linux-gnu"
               export CC_x86_64_unknown_linux_gnu="$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/bin/x86_64-linux-gnu-gcc --sysroot=$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/sysroot"
+              export OBJDUMP="$VSCODE_SYSROOT_DIR/x86_64-linux-gnu/x86_64-linux-gnu/bin/objdump"
             elif [ "$SYSROOT_ARCH" == "armhf" ]; then
               export CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_LINKER="$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/bin/arm-rpi-linux-gnueabihf-gcc"
               export CARGO_TARGET_ARMV7_UNKNOWN_LINUX_GNUEABIHF_RUSTFLAGS="-C link-arg=--sysroot=$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/sysroot"
               export CC_armv7_unknown_linux_gnueabihf="$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/bin/arm-rpi-linux-gnueabihf-gcc --sysroot=$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/sysroot"
+              export OBJDUMP="$VSCODE_SYSROOT_DIR/arm-rpi-linux-gnueabihf/arm-rpi-linux-gnueabihf/bin/objdump"
             fi
           fi
+
           cargo build --release --target ${{ parameters.VSCODE_CLI_TARGET }} --bin=code
+
+          # verify glibc requirement
+          if [ -n "$SYSROOT_ARCH" ]; then
+            glibc_version="2.17"
+            while IFS= read -r line; do
+              if [[ $line == *"GLIBC_"* ]]; then
+                version=$(echo "$line" | awk '{print $5}' | tr -d '()')
+                version=${version#*_}
+                if [[ $(printf "%s\n%s" "$version" "$glibc_version" | sort -V | tail -n1) == "$version" ]]; then
+                  glibc_version=$version
+                fi
+              fi
+            done < <("$OBJDUMP" -T "$PWD/target/${{ parameters.VSCODE_CLI_TARGET }}/release/code")
+            if [[ "$glibc_version" != "2.17" ]]; then
+              echo "Error: binary has dependency on GLIBC > 2.17"
+              exit 1
+            fi
+          fi
         displayName: Compile ${{ parameters.VSCODE_CLI_TARGET }}
         workingDirectory: $(Build.SourcesDirectory)/cli
         env:
diff --git a/build/checksums/vscode-sysroot.txt b/build/checksums/vscode-sysroot.txt
index 86da04db2ae..0b5f38c60ce 100644
--- a/build/checksums/vscode-sysroot.txt
+++ b/build/checksums/vscode-sysroot.txt
@@ -1,3 +1,6 @@
-a2d51dc505ed544c52757f90bcdab44920132295fc7a67166eff86b6e0e24aa8  aarch64-linux-gnu.tar.gz
-032cf16bf8b965e1351305f10f3dedabf4f9868027ac6d0e8f52321ca0b70d4a  arm-rpi-linux-gnueabihf.tar.gz
-360475a764d0faf4d3743aa866347eff78072639d20660def83e1a03eadf534c  x86_64-linux-gnu.tar.gz
+68a17006021975ff271a1dd615f9db9eda7c25f2cc65e750c87980dc57a06c94  aarch64-linux-gnu-glibc-2.17.tar.gz
+0de422a81683cf9e8cf875dbd1e0c27545ac3c775b2d53015daf3ca2b31d3f15  aarch64-linux-gnu-glibc-2.28.tar.gz
+3ced48cb479f2cdba95aa649710fcb7778685551c745bbd76ac706c3c0ead9fb  arm-rpi-linux-gnueabihf-glibc-2.17.tar.gz
+7aea163f7fad8cc50000c86b5108be880121d35e2f55d016ef8c96bbe54129eb  arm-rpi-linux-gnueabihf-glibc-2.28.tar.gz
+5aae21115f1d284c3cdf32c83db15771b59bc80793f1423032abf5a823c0d658  x86_64-linux-gnu-glibc-2.17.tar.gz
+dbb927408393041664a020661f2641c9785741be3d29b050b9dac58980967784  x86_64-linux-gnu-glibc-2.28.tar.gz
diff --git a/build/linux/debian/install-sysroot.js b/build/linux/debian/install-sysroot.js
index 40ca42efe78..f582558b331 100644
--- a/build/linux/debian/install-sysroot.js
+++ b/build/linux/debian/install-sysroot.js
@@ -67,7 +67,7 @@ async function fetchUrl(options, retries = 10, retryDelay = 1000) {
     try {
         const controller = new AbortController();
         const timeout = setTimeout(() => controller.abort(), 30 * 1000);
-        const version = '20231122-245579';
+        const version = '20240129-253798';
         try {
             const response = await fetch(`https://api.github.com/repos/Microsoft/vscode-linux-build-agent/releases/tags/v${version}`, {
                 headers: ghApiHeaders,
@@ -121,18 +121,19 @@ async function getVSCodeSysroot(arch) {
     let triple;
     switch (arch) {
         case 'amd64':
-            expectedName = `x86_64-linux-gnu.tar.gz`;
+            expectedName = `x86_64-linux-gnu-glibc-2.17.tar.gz`;
             triple = 'x86_64-linux-gnu';
             break;
         case 'arm64':
-            expectedName = `aarch64-linux-gnu.tar.gz`;
+            expectedName = `aarch64-linux-gnu-glibc-2.17.tar.gz`;
             triple = 'aarch64-linux-gnu';
             break;
         case 'armhf':
-            expectedName = `arm-rpi-linux-gnueabihf.tar.gz`;
+            expectedName = `arm-rpi-linux-gnueabihf-glibc-2.17.tar.gz`;
             triple = 'arm-rpi-linux-gnueabihf';
             break;
     }
+    console.log(`Fetching ${expectedName} for ${triple}`);
     const checksumSha256 = getVSCodeSysrootChecksum(expectedName);
     if (!checksumSha256) {
         throw new Error(`Could not find checksum for ${expectedName}`);
diff --git a/build/linux/debian/install-sysroot.ts b/build/linux/debian/install-sysroot.ts
index 37ea883d9bc..b704393b655 100644
--- a/build/linux/debian/install-sysroot.ts
+++ b/build/linux/debian/install-sysroot.ts
@@ -80,7 +80,7 @@ async function fetchUrl(options: IFetchOptions, retries = 10, retryDelay = 1000)
 	try {
 		const controller = new AbortController();
 		const timeout = setTimeout(() => controller.abort(), 30 * 1000);
-		const version = '20231122-245579';
+		const version = '20240129-253798';
 		try {
 			const response = await fetch(`https://api.github.com/repos/Microsoft/vscode-linux-build-agent/releases/tags/v${version}`, {
 				headers: ghApiHeaders,
@@ -139,18 +139,19 @@ export async function getVSCodeSysroot(arch: DebianArchString): Promise<string>
 	let triple: string;
 	switch (arch) {
 		case 'amd64':
-			expectedName = `x86_64-linux-gnu.tar.gz`;
+			expectedName = `x86_64-linux-gnu-glibc-2.17.tar.gz`;
 			triple = 'x86_64-linux-gnu';
 			break;
 		case 'arm64':
-			expectedName = `aarch64-linux-gnu.tar.gz`;
+			expectedName = `aarch64-linux-gnu-glibc-2.17.tar.gz`;
 			triple = 'aarch64-linux-gnu';
 			break;
 		case 'armhf':
-			expectedName = `arm-rpi-linux-gnueabihf.tar.gz`;
+			expectedName = `arm-rpi-linux-gnueabihf-glibc-2.17.tar.gz`;
 			triple = 'arm-rpi-linux-gnueabihf';
 			break;
 	}
+	console.log(`Fetching ${expectedName} for ${triple}`);
 	const checksumSha256 = getVSCodeSysrootChecksum(expectedName);
 	if (!checksumSha256) {
 		throw new Error(`Could not find checksum for ${expectedName}`);
diff --git a/build/linux/rpm/dep-lists.js b/build/linux/rpm/dep-lists.js
index e824f19c177..b9a6e80d5f3 100644
--- a/build/linux/rpm/dep-lists.js
+++ b/build/linux/rpm/dep-lists.js
@@ -42,10 +42,7 @@ exports.referenceGeneratedDepsByArch = {
         'libc.so.6(GLIBC_2.15)(64bit)',
         'libc.so.6(GLIBC_2.16)(64bit)',
         'libc.so.6(GLIBC_2.17)(64bit)',
-        'libc.so.6(GLIBC_2.18)(64bit)',
         'libc.so.6(GLIBC_2.2.5)(64bit)',
-        'libc.so.6(GLIBC_2.25)(64bit)',
-        'libc.so.6(GLIBC_2.27)(64bit)',
         'libc.so.6(GLIBC_2.28)(64bit)',
         'libc.so.6(GLIBC_2.3)(64bit)',
         'libc.so.6(GLIBC_2.3.2)(64bit)',
@@ -141,9 +138,6 @@ exports.referenceGeneratedDepsByArch = {
         'libc.so.6(GLIBC_2.15)',
         'libc.so.6(GLIBC_2.16)',
         'libc.so.6(GLIBC_2.17)',
-        'libc.so.6(GLIBC_2.18)',
-        'libc.so.6(GLIBC_2.25)',
-        'libc.so.6(GLIBC_2.27)',
         'libc.so.6(GLIBC_2.28)',
         'libc.so.6(GLIBC_2.4)',
         'libc.so.6(GLIBC_2.6)',
@@ -245,9 +239,6 @@ exports.referenceGeneratedDepsByArch = {
         'libatspi.so.0()(64bit)',
         'libc.so.6()(64bit)',
         'libc.so.6(GLIBC_2.17)(64bit)',
-        'libc.so.6(GLIBC_2.18)(64bit)',
-        'libc.so.6(GLIBC_2.25)(64bit)',
-        'libc.so.6(GLIBC_2.27)(64bit)',
         'libc.so.6(GLIBC_2.28)(64bit)',
         'libcairo.so.2()(64bit)',
         'libcurl.so.4()(64bit)',
diff --git a/build/linux/rpm/dep-lists.ts b/build/linux/rpm/dep-lists.ts
index 1c38df695db..275d88b95a8 100644
--- a/build/linux/rpm/dep-lists.ts
+++ b/build/linux/rpm/dep-lists.ts
@@ -41,10 +41,7 @@ export const referenceGeneratedDepsByArch = {
 		'libc.so.6(GLIBC_2.15)(64bit)',
 		'libc.so.6(GLIBC_2.16)(64bit)',
 		'libc.so.6(GLIBC_2.17)(64bit)',
-		'libc.so.6(GLIBC_2.18)(64bit)',
 		'libc.so.6(GLIBC_2.2.5)(64bit)',
-		'libc.so.6(GLIBC_2.25)(64bit)',
-		'libc.so.6(GLIBC_2.27)(64bit)',
 		'libc.so.6(GLIBC_2.28)(64bit)',
 		'libc.so.6(GLIBC_2.3)(64bit)',
 		'libc.so.6(GLIBC_2.3.2)(64bit)',
@@ -140,9 +137,6 @@ export const referenceGeneratedDepsByArch = {
 		'libc.so.6(GLIBC_2.15)',
 		'libc.so.6(GLIBC_2.16)',
 		'libc.so.6(GLIBC_2.17)',
-		'libc.so.6(GLIBC_2.18)',
-		'libc.so.6(GLIBC_2.25)',
-		'libc.so.6(GLIBC_2.27)',
 		'libc.so.6(GLIBC_2.28)',
 		'libc.so.6(GLIBC_2.4)',
 		'libc.so.6(GLIBC_2.6)',
@@ -244,9 +238,6 @@ export const referenceGeneratedDepsByArch = {
 		'libatspi.so.0()(64bit)',
 		'libc.so.6()(64bit)',
 		'libc.so.6(GLIBC_2.17)(64bit)',
-		'libc.so.6(GLIBC_2.18)(64bit)',
-		'libc.so.6(GLIBC_2.25)(64bit)',
-		'libc.so.6(GLIBC_2.27)(64bit)',
 		'libc.so.6(GLIBC_2.28)(64bit)',
 		'libcairo.so.2()(64bit)',
 		'libcurl.so.4()(64bit)',
diff --git a/src/vs/workbench/contrib/remote/browser/remoteConnectionHealth.ts b/src/vs/workbench/contrib/remote/browser/remoteConnectionHealth.ts
index c75b9c543f7..e75900e7fa7 100644
--- a/src/vs/workbench/contrib/remote/browser/remoteConnectionHealth.ts
+++ b/src/vs/workbench/contrib/remote/browser/remoteConnectionHealth.ts
@@ -49,7 +49,7 @@ export class InitialRemoteConnectionHealthContribution implements IWorkbenchCont
 
 		const { result, checkboxChecked } = await this.dialogService.prompt<ConnectionChoice>({
 			type: Severity.Warning,
-			message: localize('unsupportedGlibcWarning', "You are about to connect to an OS that is unsupported by {0}", this.productService.nameLong),
+			message: localize('unsupportedGlibcWarning', "You are about to connect to an OS version that is unsupported by {0}.", this.productService.nameLong),
 			buttons: [
 				{
 					label: localize({ key: 'allow', comment: ['&& denotes a mnemonic'] }, "&&Allow"),
@@ -64,7 +64,7 @@ export class InitialRemoteConnectionHealthContribution implements IWorkbenchCont
 				run: () => ConnectionChoice.Cancel
 			},
 			checkbox: {
-				label: localize('remember', "Do not ask me again"),
+				label: localize('remember', "Do not show again"),
 			}
 		});
 
@@ -73,8 +73,8 @@ export class InitialRemoteConnectionHealthContribution implements IWorkbenchCont
 		}
 
 		const allowed = result === ConnectionChoice.Allow;
-		if (checkboxChecked) {
-			this.storageService.store(REMOTE_UNSUPPORTED_CONNECTION_CHOICE_KEY, allowed, StorageScope.PROFILE, StorageTarget.MACHINE);
+		if (allowed && checkboxChecked) {
+			this.storageService.store(`${REMOTE_UNSUPPORTED_CONNECTION_CHOICE_KEY}.${this._environmentService.remoteAuthority}`, allowed, StorageScope.PROFILE, StorageTarget.MACHINE);
 		}
 
 		return allowed;
@@ -85,7 +85,7 @@ export class InitialRemoteConnectionHealthContribution implements IWorkbenchCont
 			const environment = await this._remoteAgentService.getRawEnvironment();
 
 			if (environment && environment.isUnsupportedGlibc) {
-				let allowed = this.storageService.getBoolean(REMOTE_UNSUPPORTED_CONNECTION_CHOICE_KEY, StorageScope.PROFILE);
+				let allowed = this.storageService.getBoolean(`${REMOTE_UNSUPPORTED_CONNECTION_CHOICE_KEY}.${this._environmentService.remoteAuthority}`, StorageScope.PROFILE);
 				if (allowed === undefined) {
 					allowed = await this._confirmConnection();
 				}
@@ -98,7 +98,7 @@ export class InitialRemoteConnectionHealthContribution implements IWorkbenchCont
 					];
 					this.bannerService.show({
 						id: 'unsupportedGlibcWarning.banner',
-						message: localize('unsupportedGlibcWarning.banner', "You are connected to an OS that is unsupported by {0}.", this.productService.nameLong),
+						message: localize('unsupportedGlibcWarning.banner', "You are connected to an OS version that is unsupported by {0}.", this.productService.nameLong),
 						actions,
 						icon: Codicon.warning,
 						disableCloseAction: true