diff --git a/Dockerfile b/Dockerfile
index 6017cda..5d7d6e7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -4,7 +4,10 @@
 # That is deliberate — see tasks/6.1-hardened-image.md. It also means the binary
 # must be fully static, hence CGO_ENABLED=0.
 
-FROM golang:1.25-bookworm AS build
+# --platform=$BUILDPLATFORM pins the build stage to the machine doing the
+# building, then Go cross-compiles to $TARGETARCH. Without it, building an
+# amd64 image from an arm64 workstation runs the whole toolchain under QEMU.
+FROM --platform=$BUILDPLATFORM golang:1.25-bookworm AS build
 
 WORKDIR /src
 
@@ -15,13 +18,17 @@ RUN go mod download
 
 COPY . .
 
-# VERSION is stamped in by CI as the commit SHA so a running pod can be traced
-# back to an exact commit.
+# VERSION is stamped in so a running pod can be traced back to an exact build.
 ARG VERSION=dev
 
+# TARGETARCH is supplied by buildx from --platform. Defaulted to amd64 because
+# every node in the cluster is amd64; a plain `docker build` on an arm64
+# workstation would otherwise silently produce an unrunnable image.
+ARG TARGETARCH=amd64
+
 # -trimpath strips local filesystem paths from the binary.
 # -w -s drop DWARF and the symbol table; nothing debugs off the production image.
-RUN CGO_ENABLED=0 GOOS=linux go build \
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} go build \
       -trimpath \
       -ldflags="-w -s -X main.version=${VERSION}" \
       -o /out/gateway ./cmd/gateway