diff --git a/.azure-pipelines/publish-docker.yml b/.azure-pipelines/publish-docker.yml
new file mode 100644
index 000000000..48ef7f9a6
--- /dev/null
+++ b/.azure-pipelines/publish-docker.yml
@@ -0,0 +1,122 @@
+# Trigger: any `v*` release tag (e.g. v1.40.0).
+# Can also be queued manually from the ADO UI.
+trigger:
+  tags:
+    include:
+      - v*
+    exclude:
+      - v*-*
+
+pr: none
+
+parameters:
+- name: releaseChannel
+  displayName: "IMPORTANT: set this to 'canary' when triggering manually"
+  type: string
+  default: stable
+  values:
+  - stable
+  - canary
+
+resources:
+  repositories:
+  - repository: 1esPipelines
+    type: git
+    name: 1ESPipelineTemplates/1ESPipelineTemplates
+    ref: refs/tags/release
+
+extends:
+  template: v1/1ES.Official.PipelineTemplate.yml@1esPipelines
+  parameters:
+    pool:
+      name: DevDivPlaywrightAzurePipelinesUbuntu2204
+      os: linux
+    sdl:
+      sourceAnalysisPool:
+        name: DevDivPlaywrightAzurePipelinesWindows2022
+        # The image must be windows-based due to restrictions of the SDL tools. See: https://aka.ms/AAo6v8e
+        os: windows
+      suppression:
+        suppressionFile: $(Build.SourcesDirectory)\.azure-pipelines\guardian\SDL\.gdnsuppress
+    stages:
+    - stage: Publish
+      jobs:
+      - job: PublishDocker
+        displayName: "Publish Docker images to ACR"
+        # arm64 images are cross-built under QEMU emulation, which is slow.
+        timeoutInMinutes: 360
+        steps:
+        - checkout: self
+          displayName: "Checkout code"
+
+        - task: UseNode@1
+          inputs:
+            version: '26.x'
+          displayName: "Install Node.js"
+
+        # Relocate the Docker data-root to the large /mnt volume: this job builds
+        # 6 images (jammy/noble/resolute x amd64/arm64) and `docker system prune`s
+        # between them, so the default disk fills up.
+        - task: Bash@3
+          displayName: "Setup docker"
+          inputs:
+            targetType: "inline"
+            script: |
+              set -x
+              sudo service docker stop
+              sudo mkdir -p /etc/docker
+              echo '{ "data-root": "/mnt/docker" }' | sudo tee /etc/docker/daemon.json
+              sudo service docker start
+
+        # Used by scripts/download_driver.sh on the host. The repository root is the
+        # Docker build context, so .dockerignore keeps this file out of the images.
+        - task: Bash@3
+          displayName: "setup .npmrc"
+          inputs:
+            targetType: "inline"
+            script: |
+              echo "registry=https://devdiv.pkgs.visualstudio.com/DevDiv/_packaging/DevDiv_PublicPackages/npm/registry/" >> .npmrc
+
+        - task: npmAuthenticate@0
+          displayName: "authenticate the private npm registry"
+          inputs:
+            workingFile: .npmrc
+
+        # Must run before MavenAuthenticate@0 so the credentials it injects into
+        # ~/.m2/settings.xml are not overwritten by the copy.
+        - bash: |
+            mkdir -p ~/.m2
+            cp .azure-pipelines/settings.xml ~/.m2/settings.xml
+          displayName: 'Copy settings.xml (mirror Maven Central to DevDiv_PublicPackages)'
+
+        - task: MavenAuthenticate@0
+          displayName: 'Authenticate to DevDiv_PublicPackages feed'
+          inputs:
+            artifactsFeeds: DevDiv_PublicPackages
+
+        - task: AzureCLI@2
+          displayName: "Login to ACR via OIDC"
+          inputs:
+            azureSubscription: "Playwright-CDN"
+            scriptType: "bash"
+            scriptLocation: "inlineScript"
+            inlineScript: "az acr login --name playwright"
+
+        - task: Bash@3
+          displayName: "Register QEMU (binfmt) for arm64 cross-build"
+          inputs:
+            targetType: "inline"
+            script: "docker run --rm --privileged ${ACR_CACHE_PREFIX}tonistiigi/binfmt --install arm64"
+          env:
+            ACR_CACHE_PREFIX: "playwright.azurecr.io/cached/"
+
+        - task: Bash@3
+          displayName: "Build & publish Docker images"
+          inputs:
+            targetType: "inline"
+            # The authenticated settings.xml is passed to `docker build` as a secret so
+            # that Maven inside the image also resolves from DevDiv_PublicPackages.
+            script: MAVEN_SETTINGS_SECRET="$HOME/.m2/settings.xml" ./utils/docker/publish_docker.sh ${{ parameters.releaseChannel }}
+          env:
+            ACR_CACHE_PREFIX: "playwright.azurecr.io/cached/"
+            UBUNTU_MIRROR_PREFIX: "azure."
diff --git a/.azure-pipelines/settings.xml b/.azure-pipelines/settings.xml
index 34e9be56f..1617d36e9 100644
--- a/.azure-pipelines/settings.xml
+++ b/.azure-pipelines/settings.xml
@@ -1,6 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
-  Maven settings used only by the Azure Pipelines release build (publish.yml).
+  Maven settings used only by the Azure Pipelines release builds (publish.yml and
+  publish-docker.yml).
 
   Routes all remote artifact and plugin resolution through the DevDiv_PublicPackages
   Azure Artifacts feed instead of Maven Central, as required by SFI-ES4.2.4.
diff --git a/.claude/skills/playwright-java-release/SKILL.md b/.claude/skills/playwright-java-release/SKILL.md
index e38b88689..93b6450fb 100644
--- a/.claude/skills/playwright-java-release/SKILL.md
+++ b/.claude/skills/playwright-java-release/SKILL.md
@@ -73,4 +73,4 @@ gh pr create --repo microsoft/playwright-java --head <user>:mark-v-1.X.0 --base
 
 ## 4. Publish
 
-The user publishes the draft release manually once the `mark-v-1.X.0` PR is merged. After publishing, CI pushes the artifacts to Maven Central and runs the Docker workflow automatically: https://github.com/microsoft/playwright-java/actions.
+The user publishes the draft release manually once the `mark-v-1.X.0` PR is merged. After publishing, the `v1.X.0` tag triggers the Azure DevOps pipelines that push the artifacts to Maven Central (`.azure-pipelines/publish.yml`) and the Docker images to ACR (`.azure-pipelines/publish-docker.yml`).
diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 000000000..f609d7b5c
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,5 @@
+# The repository root is the Docker build context (see utils/docker/build.sh).
+# Keep registry credentials written by the release pipeline out of the images.
+**/.npmrc
+# Downloaded by publish_docker.sh after the first push.
+utils/docker/oras
diff --git a/.github/workflows/publish_docker.yml b/.github/workflows/publish_docker.yml
deleted file mode 100644
index bf1fd3338..000000000
--- a/.github/workflows/publish_docker.yml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: Publish Release Docker
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-jobs:
-  publish-canary-docker:
-    name: publish to DockerHub
-    runs-on: ubuntu-22.04
-    permissions:
-      id-token: write   # This is required for OIDC login (azure/login) to succeed
-      contents: read    # This is required for actions/checkout to succeed
-    environment: Docker
-    if: github.repository == 'microsoft/playwright-java'
-    steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - name: Azure login
-      uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1
-      with:
-        client-id: ${{ secrets.AZURE_DOCKER_CLIENT_ID }}
-        tenant-id: ${{ secrets.AZURE_DOCKER_TENANT_ID }}
-        subscription-id: ${{ secrets.AZURE_DOCKER_SUBSCRIPTION_ID }}
-    - name: Login to ACR via OIDC
-      run: az acr login --name playwright
-    - name: Set up Docker QEMU for arm64 docker builds
-      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
-      with:
-        platforms: arm64
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - run: ./utils/docker/publish_docker.sh stable
diff --git a/utils/docker/Dockerfile.jammy b/utils/docker/Dockerfile.jammy
index aa64ef493..f049bb896 100644
--- a/utils/docker/Dockerfile.jammy
+++ b/utils/docker/Dockerfile.jammy
@@ -1,15 +1,19 @@
-FROM ubuntu:jammy
+ARG ACR_CACHE_PREFIX
+FROM ${ACR_CACHE_PREFIX}ubuntu:jammy
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=America/Los_Angeles
 ARG DOCKER_IMAGE_NAME_TEMPLATE="mcr.microsoft.com/playwright/java:v%version%-jammy"
+ARG UBUNTU_MIRROR_PREFIX
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 
 # === INSTALL JDK and Maven ===
 
-RUN apt-get update && \
+RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
+      -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
+    apt-get update && \
     apt-get install -y --no-install-recommends openjdk-25-jdk \
     # Install utilities required for downloading browsers
     wget \
@@ -47,7 +51,10 @@ RUN mkdir /ms-playwright && \
 
 COPY . /tmp/pw-java
 
-RUN cd /tmp/pw-java && \
+# The optional Maven settings secret routes dependency resolution through a mirror
+# (see .azure-pipelines/publish-docker.yml).
+RUN --mount=type=secret,id=mavensettings,target=/root/.m2/settings.xml,required=false \
+    cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \
                      -D exec.args="install-driver" -f playwright/pom.xml --no-transfer-progress && \
diff --git a/utils/docker/Dockerfile.noble b/utils/docker/Dockerfile.noble
index eafb59ba4..59c01754e 100644
--- a/utils/docker/Dockerfile.noble
+++ b/utils/docker/Dockerfile.noble
@@ -1,15 +1,19 @@
-FROM ubuntu:noble
+ARG ACR_CACHE_PREFIX
+FROM ${ACR_CACHE_PREFIX}ubuntu:noble
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=America/Los_Angeles
 ARG DOCKER_IMAGE_NAME_TEMPLATE="mcr.microsoft.com/playwright/java:v%version%-noble"
+ARG UBUNTU_MIRROR_PREFIX
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 
 # === INSTALL JDK and Maven ===
 
-RUN apt-get update && \
+RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
+      -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
+    apt-get update && \
     apt-get install -y --no-install-recommends openjdk-25-jdk \
     # Install utilities required for downloading browsers
     wget \
@@ -47,7 +51,10 @@ RUN mkdir /ms-playwright && \
 
 COPY . /tmp/pw-java
 
-RUN cd /tmp/pw-java && \
+# The optional Maven settings secret routes dependency resolution through a mirror
+# (see .azure-pipelines/publish-docker.yml).
+RUN --mount=type=secret,id=mavensettings,target=/root/.m2/settings.xml,required=false \
+    cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \
                      -D exec.args="install-driver" -f playwright/pom.xml --no-transfer-progress && \
diff --git a/utils/docker/Dockerfile.resolute b/utils/docker/Dockerfile.resolute
index 64a68de4a..fb9b72c7f 100644
--- a/utils/docker/Dockerfile.resolute
+++ b/utils/docker/Dockerfile.resolute
@@ -1,15 +1,19 @@
-FROM ubuntu:resolute
+ARG ACR_CACHE_PREFIX
+FROM ${ACR_CACHE_PREFIX}ubuntu:resolute
 
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=America/Los_Angeles
 ARG DOCKER_IMAGE_NAME_TEMPLATE="mcr.microsoft.com/playwright/java:v%version%-resolute"
+ARG UBUNTU_MIRROR_PREFIX
 
 ENV LANG=C.UTF-8
 ENV LC_ALL=C.UTF-8
 
 # === INSTALL JDK and Maven ===
 
-RUN apt-get update && \
+RUN find /etc/apt -type f \( -name '*.list' -o -name '*.sources' \) \
+      -exec sed -i "s|http://archive.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}archive.ubuntu.com|g; s|http://ports.ubuntu.com|http://${UBUNTU_MIRROR_PREFIX}ports.ubuntu.com|g" {} + && \
+    apt-get update && \
     apt-get install -y --no-install-recommends openjdk-25-jdk \
     # Install utilities required for downloading browsers
     wget \
@@ -47,7 +51,10 @@ RUN mkdir /ms-playwright && \
 
 COPY . /tmp/pw-java
 
-RUN cd /tmp/pw-java && \
+# The optional Maven settings secret routes dependency resolution through a mirror
+# (see .azure-pipelines/publish-docker.yml).
+RUN --mount=type=secret,id=mavensettings,target=/root/.m2/settings.xml,required=false \
+    cd /tmp/pw-java && \
     mvn install -D skipTests --no-transfer-progress && \
     mvn exec:java -e -D exec.mainClass=com.microsoft.playwright.CLI \
                      -D exec.args="install-driver" -f playwright/pom.xml --no-transfer-progress && \
diff --git a/utils/docker/build.sh b/utils/docker/build.sh
index 649922f07..efd5e6670 100755
--- a/utils/docker/build.sh
+++ b/utils/docker/build.sh
@@ -38,4 +38,36 @@ PW_TARGET_ARCH=$(echo $1 | cut -c3-)
 # it up via `COPY . /tmp/pw-java`.
 ../../scripts/download_driver.sh
 
-docker build --platform "${PLATFORM}" --build-arg "PW_TARGET_ARCH=${PW_TARGET_ARCH}" -t "$3" -f "Dockerfile.$2" ../../
+SECRET_ARGS=()
+if [[ -n "${MAVEN_SETTINGS_SECRET:-}" ]]; then
+  SECRET_ARGS+=(--secret "id=mavensettings,src=${MAVEN_SETTINGS_SECRET}")
+fi
+
+# Keep each arch image a plain single-platform manifest without the unknown/unknown platform entry.
+export BUILDX_NO_DEFAULT_ATTESTATIONS=1
+
+# arm64 images are cross-built under QEMU user-mode emulation, where Ubuntu 22.04's
+# ldconfig segfaults intermittently at startup (tonistiigi/binfmt#298, every binfmt
+# build since QEMU 8.1.4). apt's libc-bin trigger runs ldconfig, so a crash fails the
+# whole `docker build`. Retry: BuildKit keeps the layers that already succeeded, so a
+# retry re-runs only the failed RUN step.
+MAX_ATTEMPTS=1
+if [[ "${PLATFORM}" == "linux/arm64" ]]; then
+  MAX_ATTEMPTS=3
+fi
+
+for ((attempt = 1; attempt <= MAX_ATTEMPTS; attempt++)); do
+  if docker build --platform "${PLATFORM}" \
+      --build-arg "PW_TARGET_ARCH=${PW_TARGET_ARCH}" \
+      --build-arg ACR_CACHE_PREFIX="${ACR_CACHE_PREFIX}" \
+      --build-arg UBUNTU_MIRROR_PREFIX="${UBUNTU_MIRROR_PREFIX}" \
+      "${SECRET_ARGS[@]}" \
+      -t "$3" -f "Dockerfile.$2" ../../; then
+    exit 0
+  fi
+  if (( attempt < MAX_ATTEMPTS )); then
+    echo "docker build failed (attempt ${attempt}/${MAX_ATTEMPTS}), retrying..." >&2
+  fi
+done
+echo "ERROR: docker build failed after ${MAX_ATTEMPTS} attempt(s)" >&2
+exit 1
diff --git a/utils/docker/publish_docker.sh b/utils/docker/publish_docker.sh
index fb5ea2bb8..2e50745d4 100755
--- a/utils/docker/publish_docker.sh
+++ b/utils/docker/publish_docker.sh
@@ -8,41 +8,61 @@ cd "$(dirname "$0")"
 
 MCR_IMAGE_NAME="playwright/java"
 
+RELEASE_CHANNEL="$1"
+if [[ "${RELEASE_CHANNEL}" != "stable" && "${RELEASE_CHANNEL}" != "canary" ]]; then
+  echo "ERROR: unknown release channel - '${RELEASE_CHANNEL}'"
+  echo "Must be either 'stable' or 'canary'"
+  exit 1
+fi
+
 POM_FILE=../../pom.xml
 if [[ ! -f ${POM_FILE} ]]; then
   echo "ERROR: pom.xml not found at ${POM_FILE}"
   exit 1;
 fi
 PW_VERSION=$(mvn exec:exec -Dexec.executable='echo' -Dexec.args='${project.version}' -f ${POM_FILE} --non-recursive -q 2>/dev/null)
-
-RELEASE_CHANNEL="$1"
-if [[ "${RELEASE_CHANNEL}" == "stable" ]]; then
-  if [[ ! "${PW_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-    echo "ERROR: cannot publish stable docker with Playwright version '${PW_VERSION}'"
-    exit 1
-  fi
-else
-  echo "ERROR: unknown release channel - ${RELEASE_CHANNEL}"
-  echo "Must be either 'stable' or 'canary'"
+if [[ "${RELEASE_CHANNEL}" == "stable" && ! "${PW_VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  echo "ERROR: cannot publish stable docker with Playwright version '${PW_VERSION}'"
   exit 1
 fi
+VERSION_TAG="v${PW_VERSION}"
+if [[ "${RELEASE_CHANNEL}" == "canary" ]]; then
+  VERSION_TAG="v${PW_VERSION}-canary-$(date -u +'%Y%m%d%H%M%S')"
+  echo "== CANARY build: publishing to ${VERSION_TAG}-* tags =="
+fi
 
 # Ubuntu 22.04
 JAMMY_TAGS=(
-  "v${PW_VERSION}-jammy"
+  "${VERSION_TAG}-jammy"
 )
 
 # Ubuntu 24.04
 NOBLE_TAGS=(
-  "v${PW_VERSION}"
-  "v${PW_VERSION}-noble"
+  "${VERSION_TAG}-noble"
 )
+if [[ "${RELEASE_CHANNEL}" == "stable" ]]; then
+  NOBLE_TAGS+=("${VERSION_TAG}")
+fi
 
 # Ubuntu 26.04
 RESOLUTE_TAGS=(
-  "v${PW_VERSION}-resolute"
+  "${VERSION_TAG}-resolute"
 )
 
+tags_for_flavor() {
+  local FLAVOR="$1"
+  if [[ "$FLAVOR" == "jammy" ]]; then
+    echo "${JAMMY_TAGS[@]}"
+  elif [[ "$FLAVOR" == "noble" ]]; then
+    echo "${NOBLE_TAGS[@]}"
+  elif [[ "$FLAVOR" == "resolute" ]]; then
+    echo "${RESOLUTE_TAGS[@]}"
+  else
+    echo "ERROR: unknown flavor - $FLAVOR. Must be either 'jammy', 'noble', or 'resolute'" >&2
+    exit 1
+  fi
+}
+
 tag_and_push() {
   local source="$1"
   local target="$2"
@@ -66,25 +86,19 @@ install_oras_if_needed() {
     return
   fi
   local version="1.1.0"
-  curl -sLO "https://github.com/oras-project/oras/releases/download/v${version}/oras_${version}_linux_amd64.tar.gz"
+  local arch="amd64"
+  if [[ "$(uname -m)" == "aarch64" || "$(uname -m)" == "arm64" ]]; then
+    arch="arm64"
+  fi
+  curl -sLO "https://github.com/oras-project/oras/releases/download/v${version}/oras_${version}_linux_${arch}.tar.gz"
   mkdir -p oras
-  tar -zxf oras_${version}_linux_amd64.tar.gz -C oras
-  rm oras_${version}_linux_amd64.tar.gz
+  tar -zxf oras_${version}_linux_${arch}.tar.gz -C oras
+  rm oras_${version}_linux_${arch}.tar.gz
 }
 
 publish_docker_images_with_arch_suffix() {
   local FLAVOR="$1"
-  local TAGS=()
-  if [[ "$FLAVOR" == "jammy" ]]; then
-    TAGS=("${JAMMY_TAGS[@]}")
-  elif [[ "$FLAVOR" == "noble" ]]; then
-    TAGS=("${NOBLE_TAGS[@]}")
-  elif [[ "$FLAVOR" == "resolute" ]]; then
-    TAGS=("${RESOLUTE_TAGS[@]}")
-  else
-    echo "ERROR: unknown flavor - $FLAVOR. Must be either 'jammy', 'noble', or 'resolute'"
-    exit 1
-  fi
+  local TAGS=($(tags_for_flavor "$FLAVOR"))
   local ARCH="$2"
   if [[ "$ARCH" != "amd64" && "$ARCH" != "arm64" ]]; then
     echo "ERROR: unknown arch - $ARCH. Must be either 'amd64' or 'arm64'"
@@ -102,17 +116,7 @@ publish_docker_images_with_arch_suffix() {
 
 publish_docker_manifest () {
   local FLAVOR="$1"
-  local TAGS=()
-  if [[ "$FLAVOR" == "jammy" ]]; then
-    TAGS=("${JAMMY_TAGS[@]}")
-  elif [[ "$FLAVOR" == "noble" ]]; then
-    TAGS=("${NOBLE_TAGS[@]}")
-  elif [[ "$FLAVOR" == "resolute" ]]; then
-    TAGS=("${RESOLUTE_TAGS[@]}")
-  else
-    echo "ERROR: unknown flavor - $FLAVOR. Must be either 'jammy', 'noble', or 'resolute'"
-    exit 1
-  fi
+  local TAGS=($(tags_for_flavor "$FLAVOR"))
 
   for ((i = 0; i < ${#TAGS[@]}; i++)) do
     local TAG="${TAGS[$i]}"
@@ -129,14 +133,23 @@ publish_docker_manifest () {
   done
 }
 
-publish_docker_images_with_arch_suffix jammy amd64
-publish_docker_images_with_arch_suffix jammy arm64
-publish_docker_manifest jammy amd64 arm64
+build_and_push_arch() {
+  local ARCH="$1"
+  publish_docker_images_with_arch_suffix jammy "${ARCH}"     # Ubuntu 22.04
+  publish_docker_images_with_arch_suffix noble "${ARCH}"     # Ubuntu 24.04
+  publish_docker_images_with_arch_suffix resolute "${ARCH}"  # Ubuntu 26.04
+}
 
-publish_docker_images_with_arch_suffix noble amd64
-publish_docker_images_with_arch_suffix noble arm64
-publish_docker_manifest noble amd64 arm64
+publish_manifests() {
+  publish_docker_manifest jammy amd64 arm64     # Ubuntu 22.04
+  publish_docker_manifest noble amd64 arm64     # Ubuntu 24.04
+  publish_docker_manifest resolute amd64 arm64  # Ubuntu 26.04
+}
 
-publish_docker_images_with_arch_suffix resolute amd64
-publish_docker_images_with_arch_suffix resolute arm64
-publish_docker_manifest resolute amd64 arm64
+# arm64 first: its QEMU-emulated builds must run while the host is fresh. Running
+# them after the native amd64 builds have churned the host triggers a qemu
+# segfault in aarch64 ldconfig during libc-bin setup. amd64 is a native build and
+# is unaffected by preceding work, so it goes second.
+build_and_push_arch arm64
+build_and_push_arch amd64
+publish_manifests