As discussed[0] and described[1].
Basically do
setcap 'cap_net_bind_service=+ep' /path/to/program
Which doesn't alter the programs data bytes but does allow it to bind to low ports on the installed system, so that's an install time step not a build one.
[0] StackOverflow 36875673
[1] Apache.org Wiki