diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7adbe9e1..0c4a5f53 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -51,6 +51,9 @@ jobs:
       - name: Repository checkout
         uses: actions/checkout@v4
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@v3
 
@@ -67,6 +70,26 @@ jobs:
           push: false
           pull: true
           file: docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          tags: debos
+          cache-from: type=local,src=/tmp/.build-cache
+          cache-to: type=local,dest=/tmp/.build-cache,mode=max
+
+      # WORKAROUND:
+      # Docker buildx cannot export multi-platform images with type=docker,
+      # but only with type=oci. The latter cannot be imported without an
+      # intermediate registry. Thus export only the amd64 image for usage
+      # in the test stage.
+      #
+      # see https://docs.docker.com/reference/cli/docker/buildx/build/#docker
+      - name: Export amd64 Docker image for later usage
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false
+          pull: true
+          file: docker/Dockerfile
+          platforms: linux/amd64
           tags: debos
           cache-from: type=local,src=/tmp/.build-cache
           cache-to: type=local,dest=/tmp/.build-cache,mode=max
@@ -158,6 +181,7 @@ jobs:
         with:
           name: debos-image
           path: /tmp
+
       - name: Load image
         run: |
           docker load --input /tmp/debos-image.tar
@@ -241,6 +265,7 @@ jobs:
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           file: docker/Dockerfile
@@ -320,6 +345,7 @@ jobs:
         with:
           context: .
           push: true
+          platforms: linux/amd64,linux/arm64
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           file: docker/Dockerfile
diff --git a/docker/Dockerfile b/docker/Dockerfile
index dd4d3ab7..572e923c 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,9 +1,10 @@
 # Global ARGs shared by all stages
+ARG ARCH=
 ARG DEBIAN_FRONTEND=noninteractive
 ARG GOPATH=/usr/local/go
 
 ### first stage - builder ###
-FROM debian:bookworm-slim as builder
+FROM ${ARCH}debian:bookworm-slim AS builder
 
 ARG DEBIAN_FRONTEND
 ARG GOPATH
@@ -34,7 +35,24 @@ COPY docker/get-archlinux-keyring.sh /
 RUN /get-archlinux-keyring.sh /arch-keyring
 
 ### second stage - runner ###
-FROM debian:bookworm-slim as runner
+FROM ${ARCH}debian:bookworm-slim AS runner-amd64
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        linux-image-amd64 \
+        qemu-system-x86 \
+        user-mode-linux && \
+    rm -rf /var/lib/apt/lists/*
+
+FROM ${ARCH}debian:bookworm-slim AS runner-arm64
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        linux-image-arm64 \
+        qemu-system-arm \
+       # fixes: qemu-system-aarch64: failed to find romfile "efi-virtio.rom"
+       ipxe-qemu && \
+    rm -rf /var/lib/apt/lists/*
+
+FROM runner-${TARGETARCH} AS runner
 
 ARG DEBIAN_FRONTEND
 ARG GOPATH
@@ -78,11 +96,9 @@ RUN apt-get update && \
         pigz \
         libostree-1-1 \
         libslirp-helper \
-        linux-image-amd64 \
         openssh-client \
         parted \
         pkg-config \
-        qemu-system-x86 \
         qemu-user-static \
         qemu-utils \
         rsync \
@@ -91,7 +107,6 @@ RUN apt-get update && \
         systemd-resolved \
         u-boot-tools \
         unzip \
-        user-mode-linux \
         xfsprogs \
         xz-utils \
         zip \