diff --git a/.gitea/workflows/build.yaml b/.gitea/workflows/build.yaml
index f60fc48..dd6f04a 100644
--- a/.gitea/workflows/build.yaml
+++ b/.gitea/workflows/build.yaml
@@ -36,7 +36,7 @@ jobs:
           context: .
           builder: multiplatform-builder
           file: Dockerfile
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           push: true
           pull: true
           tags: ${{ steps.meta.outputs.tags }}
diff --git a/Dockerfile b/Dockerfile
index cbd3966..bab3021 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,29 +1,40 @@
 # syntax=docker/dockerfile:1
 
-FROM rust:1-slim AS builder
+FROM --platform=$BUILDPLATFORM rust:1-slim AS builder
 
-ARG RUST_TARGET=x86_64-unknown-linux-musl
+ARG TARGETARCH
 
-RUN sed -i 's|http://deb.debian.org|https://deb.debian.org|g' \
-        /etc/apt/sources.list.d/debian.sources 2>/dev/null || true \
- && apt-get update \
- && apt-get install -y --no-install-recommends musl-tools ca-certificates \
- && rm -rf /var/lib/apt/lists/* \
- && rustup target add "${RUST_TARGET}"
+RUN set -eu; \
+    case "${TARGETARCH}" in \
+        amd64) rust_target=x86_64-unknown-linux-musl; cross_packages="" ;; \
+        arm64) rust_target=aarch64-unknown-linux-musl; cross_packages="gcc-aarch64-linux-gnu" ;; \
+        *) echo "unsupported target architecture: ${TARGETARCH}" >&2; exit 1 ;; \
+    esac; \
+    printf '%s\n' "${rust_target}" > /tmp/rust-target; \
+    sed -i 's|http://deb.debian.org|https://deb.debian.org|g' \
+        /etc/apt/sources.list.d/debian.sources 2>/dev/null || true; \
+    apt-get update; \
+    apt-get install -y --no-install-recommends musl-tools ca-certificates ${cross_packages}; \
+    rm -rf /var/lib/apt/lists/*; \
+    rustup target add "${rust_target}"
 
 WORKDIR /app
 COPY Cargo.toml Cargo.lock ./
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     mkdir -p src \
  && printf 'fn main() {}' > src/main.rs \
- && cargo fetch --locked --target "${RUST_TARGET}"
+ && cargo fetch --locked --target "$(cat /tmp/rust-target)"
 
 COPY src ./src
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
     --mount=type=cache,target=/app/target \
-    cargo build --release --locked --target "${RUST_TARGET}" \
+    if [ "${TARGETARCH}" = "arm64" ]; then \
+        export CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_LINKER=aarch64-linux-gnu-gcc; \
+    fi \
+ && rust_target="$(cat /tmp/rust-target)" \
+ && cargo build --release --locked --target "${rust_target}" \
  && mkdir -p /out \
- && cp "/app/target/${RUST_TARGET}/release/hermes" /out/hermes
+ && cp "/app/target/${rust_target}/release/hermes" /out/hermes
 
 FROM scratch AS runtime
 
diff --git a/README.md b/README.md
index 811ab50..275b137 100644
--- a/README.md
+++ b/README.md
@@ -63,7 +63,7 @@ The `scratch` runtime contains no shell or healthcheck utility. Use `docker run
 
 ### Publishing
 
-The Gitea workflow in `.gitea/workflows/build.yaml` builds and publishes `linux/amd64` images to `gitea.woggioni.net/woggioni/hermes` when a tag matching `release/*` is pushed. For example, `release/v0.2.0` publishes `v0.2.0` and `latest` tags. The repository must define the `PUBLISHER_TOKEN` secret used for registry authentication.
+The Gitea workflow in `.gitea/workflows/build.yaml` builds and publishes multi-architecture `linux/amd64` and `linux/arm64` images to `gitea.woggioni.net/woggioni/hermes` when a tag matching `release/*` is pushed. The ARM64 binary is cross-compiled on the AMD64 builder without emulation. For example, `release/v0.2.0` publishes `v0.2.0` and `latest` tags containing both architectures. The repository must define the `PUBLISHER_TOKEN` secret used for registry authentication.
 
 ## YAML configuration