diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 016b139..f5a8c26 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -18,6 +18,9 @@ jobs:
     permissions:
       contents: read
       packages: write
+    outputs:
+      # The bare short SHA tag, consumed by the downstream deployment test.
+      image_tag: ${{ steps.tag.outputs.value }}
 
     steps:
       - name: Checkout
@@ -35,6 +38,10 @@ jobs:
             type=raw,value=latest,enable={{is_default_branch}}
             type=sha,prefix=
 
+      - name: Derive the short SHA tag
+        id: tag
+        run: echo "value=$(echo ${{ github.sha }} | cut -c1-7)" >> "$GITHUB_OUTPUT"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -50,10 +57,27 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
+          # linux/amd64 only until now, which broke Apple Silicon and ARM
+          # runners. Buildx was already set up; the platforms list was simply
+          # never passed.
+          platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-
+  # Verify the freshly published image actually deploys. Without this, a change
+  # here that breaks the deployment manifests stays invisible until somebody
+  # happens to touch the deploy repo.
+  deployment-test:
+    name: Deployment test
+    needs: build
+    if: github.event_name != 'pull_request'
+    uses: kube-workspaces/deploy/.github/workflows/deployment-test.yaml@main
+    with:
+      component: controller
+      # docker/metadata-action is configured with type=sha,prefix= so the tag is
+      # the bare short SHA. Take it from the build job rather than reconstructing
+      # it here, so the two cannot drift.
+      image_tag: ${{ needs.build.outputs.image_tag }}
diff --git a/Dockerfile b/Dockerfile
index d59dd1f..e8c1b1c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,19 @@
-FROM golang:1.24-alpine AS builder
+# --platform=$BUILDPLATFORM keeps the toolchain running natively; the target
+# architecture is passed to the compiler instead. Without this, a multi-arch
+# build emulates the whole Go compile under QEMU, which is an order of magnitude
+# slower and occasionally flaky.
+FROM --platform=$BUILDPLATFORM golang:1.24-alpine AS builder
+
+ARG TARGETOS
+ARG TARGETARCH
 
 WORKDIR /workspace
 COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -a -o manager ./cmd/main.go
+RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} \
+    go build -a -o manager ./cmd/main.go
 
 FROM gcr.io/distroless/static:nonroot
 LABEL org.opencontainers.image.source="https://github.com/kube-workspaces/controller"