diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 482d407..6f287ce 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -14,6 +14,13 @@ jobs:
       contents: read
       packages: write
 
+    strategy:
+      fail-fast: true
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -49,7 +56,7 @@ jobs:
         uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
         with:
           context: .
-          platforms: linux/amd64,linux/arm64
+          platforms: ${{ matrix.platform }}
           push: ${{ github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/Cargo.toml b/Cargo.toml
index 55053ae..98ce953 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -16,6 +16,9 @@ repository.workspace = true
 resolver = "2"
 publish = false
 
+[profile.release]
+lto = true
+
 [profile.dev]
 debug = 0
 
diff --git a/Dockerfile b/Dockerfile
index bdf3d4b..4f9361a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,18 @@
-FROM rust:1.84-alpine AS chef
-RUN apk add --no-cache musl-dev \
-  && rustup target add x86_64-unknown-linux-musl \
+FROM --platform=$BUILDPLATFORM rust:1.84-alpine AS chef
+
+ARG TARGETPLATFORM
+ARG BUILDPLATFORM
+
+# Stupid workaound with tempfiles since environment variables
+# from RUN commands don't persist across stages
+RUN case $TARGETPLATFORM in \
+  "linux/amd64") echo x86_64-unknown-linux-musl > /tmp/rust_target;; \
+  "linux/arm64") echo aarch64-unknown-linux-musl > /tmp/rust_target;; \
+  *) echo "Unsupported platform ${TARGETPLATFORM}"; exit 1;;  \
+  esac
+
+RUN apk add --no-cache musl-dev gcc \
+  && rustup target add "$(cat /tmp/rust_target)" \
   && cargo install cargo-chef --locked \
   && rm -rf "$CARGO_HOME/registry"
 
@@ -16,10 +28,10 @@ FROM chef AS builder
 # x86_64-unknown-linux-musl does static linking by default
 WORKDIR /rustical
 COPY --from=planner /rustical/recipe.json recipe.json
-RUN cargo chef cook --release --target x86_64-unknown-linux-musl
+RUN cargo chef cook --release --target "$(cat /tmp/rust_target)"
 
 COPY . .
-RUN --mount=type=cache,target=target cargo install --target x86_64-unknown-linux-musl --path .
+RUN --mount=type=cache,target=target cargo install --target $TARGET --path .
 
 FROM scratch
 COPY --from=builder /usr/local/cargo/bin/rustical /usr/local/bin/rustical