diff --git a/.github/workflows/test-build.yml b/.github/workflows/test-build.yml
index 8834247..c11e456 100644
--- a/.github/workflows/test-build.yml
+++ b/.github/workflows/test-build.yml
@@ -65,19 +65,15 @@ jobs:
           -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
           -tags production -o ../build/amd64/phishingclub main.go"
 
-          # build arm64 binary — cross-compile with musl.cc toolchain, pinned by SHA512
+          # build arm64 binary — run natively under QEMU (already set up above)
           sudo docker run --rm \
+          --platform linux/arm64 \
           -v "$(pwd)":/app \
           -w /app/backend \
-          golang:1.25.10 \
-          bash -c "set -e && \
-            curl -fsSL https://musl.cc/aarch64-linux-musl-cross.tgz -o /tmp/cross.tgz && \
-            echo '8695ff86979cdf30fbbcd33061711f5b1ebc3c48a87822b9ca56cde6d3a22abd4dab30fdcd1789ac27c6febbaeb9e5bde59d79d66552fae53d54cc1377a19272  /tmp/cross.tgz' | sha512sum -c && \
-            tar -xzf /tmp/cross.tgz -C /tmp && \
-            CGO_ENABLED=1 GOOS=linux GOARCH=arm64 CC=/tmp/aarch64-linux-musl-cross/bin/aarch64-linux-musl-gcc \
-            go build -trimpath \
-            -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
-            -tags production -o ../build/arm64/phishingclub main.go"
+          golang:1.25.10-alpine \
+          sh -c "apk add --no-cache gcc musl-dev && go build -trimpath \
+          -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
+          -tags production -o ../build/arm64/phishingclub main.go"
 
       - name: Fix build directory permissions
         run: |