diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9bc27a6..2eb4ed6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,32 +54,37 @@ jobs:
           mkdir -p backend/frontend/build
           cp -r frontend/build/* backend/frontend/build/
 
+      - name: Cache Go build cache
+        uses: actions/cache@v4
+        with:
+          path: /tmp/go-build-cache
+          key: go-build-${{ runner.os }}-${{ hashFiles('backend/go.sum') }}
+          restore-keys: go-build-${{ runner.os }}-
+
       - name: Build binaries for multiple architectures
         run: |
-          mkdir -p build/amd64 build/arm64
+          mkdir -p build/amd64 build/arm64 /tmp/go-build-cache
 
-          # build amd64 binary
+          # build amd64 binary — static musl so no glibc floor on target systems
           sudo docker run --rm \
           -v "$(pwd)":/app \
+          -v /tmp/go-build-cache:/root/.cache/go-build \
           -w /app/backend \
-          -e CGO_ENABLED=1 \
-          -e GOOS=linux \
-          -e GOARCH=amd64 \
-          golang:1.25.10 \
-          go build -trimpath \
-          -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }}' \
-          -tags production -o ../build/amd64/phishingclub main.go
+          golang:1.25.10-alpine \
+          sh -c "apk add --no-cache gcc musl-dev && go build -trimpath \
+          -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
+          -tags production -o ../build/amd64/phishingclub main.go"
 
-          # build arm64 binary
+          # build arm64 binary — run natively under QEMU (already set up above)
           sudo docker run --rm \
+          --platform linux/arm64 \
           -v "$(pwd)":/app \
+          -v /tmp/go-build-cache:/root/.cache/go-build \
           -w /app/backend \
-          -e CGO_ENABLED=1 \
-          -e GOOS=linux \
-          -e GOARCH=arm64 \
-          -e CC=aarch64-linux-gnu-gcc \
-          golang:1.25.10 \
-          bash -c "apt-get update && apt-get install -y gcc-aarch64-linux-gnu && go build -trimpath -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }}' -tags production -o ../build/arm64/phishingclub main.go"
+          golang:1.25.10-alpine \
+          sh -c "apk add --no-cache gcc musl-dev && go build -trimpath \
+          -ldflags='-X github.com/phishingclub/phishingclub/version.hash=ph${{ steps.get_version.outputs.HASH }} -X github.com/phishingclub/phishingclub/version.version=${{ steps.get_version.outputs.VERSION }} -linkmode=external -extldflags=-static' \
+          -tags production -o ../build/arm64/phishingclub main.go"
 
       - name: Fix build directory permissions
         run: |