diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index 8c7ecfa..81065ed 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -73,6 +73,8 @@ jobs:
             runner: macos-latest
           - target: linux_x86_64
             runner: ubuntu-latest
+          - target: linux_aarch64
+            runner: ubuntu-24.04-arm
           - target: windows_x86_64
             runner: windows-latest
     defaults:
@@ -111,8 +113,8 @@ jobs:
         # independently, so a target failing partway through wouldn't
         # necessarily fail the whole `mix release` invocation. Not everyone
         # installing this uses Homebrew (no tap exists yet anyway - see
-        # #14/CRY-37), so linux_x86_64/macos_aarch64 are the primary
-        # install path for a lot of users; silently shipping a release
+        # #14/CRY-37), so linux_x86_64/linux_aarch64/macos_aarch64 are the
+        # primary install path for a lot of users; silently shipping a release
         # missing one of them is worse than failing loudly here.
         # windows_x86_64 stays best-effort, as it always has.
         name: Verify this target actually built
@@ -130,6 +132,20 @@ jobs:
                   exit 1
               fi
           fi
+      -
+        # Smoke-test the linux_aarch64 binary on the native ARM64 runner:
+        # proves the binary executes (right architecture), the OTP app boots,
+        # and all NIFs (exqlite via elixir_make/Zig, mdex_native via
+        # rustler_precompiled) load correctly. `lc version` runs in
+        # interactive mode (no LINEAR_CLI_DAEMON=true), starts an empty
+        # supervisor, prints the version, and exits 0 - no API key or network
+        # needed. Only runs for linux_aarch64 because that's the only target
+        # whose runner architecture matches the binary (macos/Windows smoke
+        # tests are out of scope for CRY-48).
+        if: matrix.target == 'linux_aarch64'
+        name: Smoke-test the linux_aarch64 binary boots and NIFs load
+        timeout-minutes: 1
+        run: ./burrito_out/lc_linux_aarch64 version
       -
         # Handed off to burrito-package below, which needs every target's
         # binary gathered back into one place before it can build the
diff --git a/app/mix.exs b/app/mix.exs
index 791adae..9093d33 100644
--- a/app/mix.exs
+++ b/app/mix.exs
@@ -22,6 +22,7 @@ defmodule LinearCli.MixProject do
   # Burrito's own docs/source, and exqlite's NIF cross-compilation verified
   # empirically (built+ran the linux_x86_64 target under podman/QEMU) - see
   # documents/phase-8-plan.adoc. macOS Intel intentionally not targeted.
+  # Kept in sync with .github/workflows/main.yaml's burrito-build matrix.
   defp releases do
     [
       lc: [
@@ -30,6 +31,7 @@ defmodule LinearCli.MixProject do
           targets: [
             macos_aarch64: [os: :darwin, cpu: :aarch64],
             linux_x86_64: [os: :linux, cpu: :x86_64],
+            linux_aarch64: [os: :linux, cpu: :aarch64],
             windows_x86_64: [os: :windows, cpu: :x86_64]
           ]
         ]
diff --git a/install.sh b/install.sh
index cec9d5d..026070f 100755
--- a/install.sh
+++ b/install.sh
@@ -32,8 +32,9 @@ detect_target() {
         Linux)
             case "$(uname -m)" in
                 x86_64) printf '%s\n' linux_x86_64 ;;
+                aarch64) printf '%s\n' linux_aarch64 ;;
                 *)
-                    printf 'error: unsupported Linux architecture: %s (only x86_64 is built)\n' "$(uname -m)" >&2
+                    printf 'error: unsupported Linux architecture: %s (only x86_64 and aarch64 are built)\n' "$(uname -m)" >&2
                     exit 1
                     ;;
             esac