diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 729f84c..36eba71 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -41,10 +41,17 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
       - name: Build and push release image
         uses: docker/build-push-action@v7
         with:
           context: .
+          platforms: linux/arm64
           push: true
           tags: ${{ steps.image.outputs.name }}:${{ env.RELEASE_TAG }}
           labels: org.opencontainers.image.version=${{ env.RELEASE_TAG }}
diff --git a/.replworks/TECH_STACK.md b/.replworks/TECH_STACK.md
index e3edfb2..bcccf18 100644
--- a/.replworks/TECH_STACK.md
+++ b/.replworks/TECH_STACK.md
@@ -72,9 +72,9 @@ Keywords MUST, MUST NOT are used in the RFC 2119 sense.
 ## 6. Deployment rules
 
 - Target: Coolify. One resource serves `if.repl.net`. Docker Compose MUST NOT be used.
-- Release: Coolify git integration deploys on push to the default branch.
+- Release: GitHub Actions MUST build a `linux/arm64` Docker image from the published release, push it to the private GitHub Container Registry package, and configure Coolify to pull and deploy that release-tagged image without building the source repository.
+- Container build MUST use `npm ci` and `npm run build`. Container start command MUST be `npm start`.
 - Install step MUST use `npm ci`.
-- Build step MUST run `npm run build`. Start command MUST be `npm start`.
 - CI system: GitHub Actions.
 - CI MUST run on pull requests and on pushes to the default branch: `npm ci`, `npm run typecheck`, `npm test`, `npm run build`.
 - License: none. `package.json` MUST set `"private": true`. No `LICENSE` file.