As hinted by this previous post, it seems that setting a dune flag on your binary has a useful effect.
In my case, I was starting my web server via a dumb binary that simply calls into my internal web library.
The undefined symbol error disappears for me with this extra flag.
$ tail -n+1 *
==> dune <==
(executable
(name main)
(flags :standard -cclib -largon2)
(libraries web))
==> main.ml <==
let () = Web.start ()