diff --git a/.github/actions/clp-core-build-containers/action.yaml b/.github/actions/clp-core-build-containers/action.yaml
index 767c6f62f0..9258bac882 100644
--- a/.github/actions/clp-core-build-containers/action.yaml
+++ b/.github/actions/clp-core-build-containers/action.yaml
@@ -17,6 +17,15 @@ inputs:
   token:
     description: "Registry token"
     required: true
+  arch:
+    description: >-
+      Target architecture (e.g. "amd64" or "arm64") when building a single arch of a
+      multi-arch image. When set, the image is tagged/published under an arch-suffixed
+      tag (e.g. ":main-amd64") within the single image_name repository, so a downstream
+      merge step can combine the per-arch tags into a multi-arch manifest. When empty,
+      the image is tagged/published under the bare branch tag (legacy behaviour).
+    required: false
+    default: ""
 
 runs:
   using: "composite"
@@ -33,6 +42,17 @@ runs:
     - id: "get_image_props"
       shell: "bash"
       run: |
+        # When `arch` is set, arch-suffix the tag/artifact so each arch of a multi-arch
+        # image is published/loaded under a distinct tag (e.g. ":main-amd64") within the
+        # single image_name repository. A downstream merge step combines them into a
+        # multi-arch ":main" manifest.
+        arch="${{inputs.arch}}"
+        if [[ -n "$arch" ]]; then
+          arch_suffix="-${arch}"
+        else
+          arch_suffix=""
+        fi
+
         if [[ "${{inputs.push_deps_image}}" == "true" ]] ; then
           # Docker doesn't support repository names with uppercase characters, so we convert to
           # lowercase here.
@@ -40,13 +60,13 @@ runs:
 
           echo "qualified_image_name=ghcr.io/${repository}/${{inputs.image_name}}" \
             >> "$GITHUB_OUTPUT"
-          echo "branch=${{github.ref_name}}" >> "$GITHUB_OUTPUT"
+          echo "branch=${{github.ref_name}}${arch_suffix}" >> "$GITHUB_OUTPUT"
           echo "output=type=registry" >> "$GITHUB_OUTPUT"
         else
-          image_path="/tmp/${{inputs.image_name}}.tar"
+          image_path="/tmp/${{inputs.image_name}}${arch_suffix}.tar"
           echo "image_path=${image_path}" >> "$GITHUB_OUTPUT"
 
-          echo "qualified_image_name=${{inputs.image_name}}" >> "$GITHUB_OUTPUT"
+          echo "qualified_image_name=${{inputs.image_name}}${arch_suffix}" >> "$GITHUB_OUTPUT"
           echo "branch=latest" >> "$GITHUB_OUTPUT"
           echo "output=type=docker,dest=${image_path}" >> "$GITHUB_OUTPUT"
         fi
diff --git a/.github/actions/run-on-image/action.yaml b/.github/actions/run-on-image/action.yaml
index 3d0c060873..d7342dc92f 100644
--- a/.github/actions/run-on-image/action.yaml
+++ b/.github/actions/run-on-image/action.yaml
@@ -11,34 +11,57 @@ inputs:
   run_command:
     description: "Command to execute"
     required: true
+  arch:
+    description: >-
+      Target architecture (e.g. "amd64" or "arm64") when consuming a single arch of a
+      multi-arch image. When set and using a published image, the bare multi-arch tag
+      ":main" is pulled (Docker auto-selects the runner's arch). When set and using a
+      locally-built image, the arch-suffixed artifact/image (e.g. "<image_name>-amd64")
+      produced by clp-core-build-containers is loaded. When empty, the bare image_name
+      is used (legacy behaviour).
+    required: false
+    default: ""
 
 runs:
   using: "composite"
   steps:
-    - if: "inputs.use_published_image == 'false'"
-      uses: "actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e"
-      with:
-        name: "${{inputs.image_name}}"
-        path: "/tmp"
-
-    - if: "inputs.use_published_image == 'false'"
-      name: "Load image"
-      run: "docker load --input '/tmp/${{inputs.image_name}}.tar'"
-      shell: "bash"
-
     - id: "get_image_props"
       run: |
+        arch="${{inputs.arch}}"
+        if [[ -n "$arch" ]]; then
+          arch_suffix="-${arch}"
+        else
+          arch_suffix=""
+        fi
+
         if [[ "${{inputs.use_published_image}}" == "true" ]] ; then
           # Docker doesn't support repository names with uppercase characters, so we convert to
-          # lowercase here.
+          # lowercase here. The published image is a multi-arch manifest tagged ":main", so Docker
+          # auto-selects the runner's architecture on pull.
           repository=$(echo '${{github.repository}}' | tr '[:upper:]' '[:lower:]')
           echo "qualified_image_name=ghcr.io/${repository}/${{inputs.image_name}}:main" \
             >> "$GITHUB_OUTPUT"
         else
-          echo "qualified_image_name=${{inputs.image_name}}:latest" >> "$GITHUB_OUTPUT"
+          # The locally-built image (from clp-core-build-containers) is tagged/loaded under
+          # an arch-suffixed name when `arch` is set.
+          local_name="${{inputs.image_name}}${arch_suffix}"
+          echo "artifact_name=${local_name}" >> "$GITHUB_OUTPUT"
+          echo "tar_path=/tmp/${local_name}.tar" >> "$GITHUB_OUTPUT"
+          echo "qualified_image_name=${local_name}:latest" >> "$GITHUB_OUTPUT"
         fi
       shell: "bash"
 
+    - if: "inputs.use_published_image == 'false'"
+      uses: "actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e"
+      with:
+        name: "${{steps.get_image_props.outputs.artifact_name}}"
+        path: "/tmp"
+
+    - if: "inputs.use_published_image == 'false'"
+      name: "Load image"
+      run: "docker load --input '${{steps.get_image_props.outputs.tar_path}}'"
+      shell: "bash"
+
     - run: "./tools/scripts/deps-download/init.sh"
       shell: "bash"
 
diff --git a/.github/workflows/clp-artifact-build.yaml b/.github/workflows/clp-artifact-build.yaml
index 9aeb978d0e..2ce47c7595 100644
--- a/.github/workflows/clp-artifact-build.yaml
+++ b/.github/workflows/clp-artifact-build.yaml
@@ -19,6 +19,10 @@ env:
   BINARIES_ARTIFACT_NAME_PREFIX: "clp-core-binaries-"
   PYTHON_WHEELS_ARTIFACT_NAME_PREFIX: "clp-python-wheels-"
   DEPS_IMAGE_NAME_PREFIX_X86: "clp-core-dependencies-x86-"
+  # Bare (no arch) prefix for multi-arch dependency images; the arch is carried in the tag
+  # (e.g. ":main-amd64") by clp-core-build-containers' `arch` input and merged into a
+  # multi-arch ":main" manifest by the *-deps-image-merge jobs.
+  DEPS_IMAGE_NAME_PREFIX: "clp-core-dependencies-"
 
 concurrency:
   group: "${{github.workflow}}-${{github.ref}}"
@@ -38,10 +42,8 @@ jobs:
       }}
     outputs:
       centos_stream_9_image_changed: "${{steps.filter.outputs.centos_stream_9_image}}"
-      manylinux_2_28_aarch64_image_changed: "${{steps.filter.outputs.manylinux_2_28_aarch64_image}}"
-      manylinux_2_28_x86_64_image_changed: "${{steps.filter.outputs.manylinux_2_28_x86_64_image}}"
-      musllinux_1_2_aarch64_image_changed: "${{steps.filter.outputs.musllinux_1_2_aarch64_image}}"
-      musllinux_1_2_x86_64_image_changed: "${{steps.filter.outputs.musllinux_1_2_x86_64_image}}"
+      manylinux_2_28_image_changed: "${{steps.filter.outputs.manylinux_2_28_image}}"
+      musllinux_1_2_image_changed: "${{steps.filter.outputs.musllinux_1_2_image}}"
       ubuntu_jammy_image_changed: "${{steps.filter.outputs.ubuntu_jammy_image}}"
       clp_changed: "${{steps.filter.outputs.clp}}"
       yscope_clp_core_changed: "${{steps.filter.outputs.yscope-clp-core}}"
@@ -80,21 +82,13 @@ jobs:
               - *_deps_images_common_paths
               - "components/core/tools/docker-images/clp-env-base-centos-stream-9/**"
               - "components/core/tools/scripts/lib_install/centos-stream-9/**"
-            manylinux_2_28_aarch64_image:
+            manylinux_2_28_image:
               - *_deps_images_common_paths
-              - "components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/**"
+              - "components/core/tools/docker-images/clp-env-base-manylinux_2_28/**"
               - "components/core/tools/scripts/lib_install/manylinux_2_28/**"
-            manylinux_2_28_x86_64_image:
+            musllinux_1_2_image:
               - *_deps_images_common_paths
-              - "components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/**"
-              - "components/core/tools/scripts/lib_install/manylinux_2_28/**"
-            musllinux_1_2_aarch64_image:
-              - *_deps_images_common_paths
-              - "components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/**"
-              - "components/core/tools/scripts/lib_install/musllinux_1_2/**"
-            musllinux_1_2_x86_64_image:
-              - *_deps_images_common_paths
-              - "components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/**"
+              - "components/core/tools/docker-images/clp-env-base-musllinux_1_2/**"
               - "components/core/tools/scripts/lib_install/musllinux_1_2/**"
             ubuntu_jammy_image:
               - *_deps_images_common_paths
@@ -146,11 +140,19 @@ jobs:
             ${{github.event_name != 'pull_request' && github.ref == 'refs/heads/main'}}
           token: "${{secrets.GITHUB_TOKEN}}"
 
-  manylinux_2_28-aarch64-deps-image:
-    name: "manylinux_2_28-aarch64-deps-image"
-    if: "needs.filter-relevant-changes.outputs.manylinux_2_28_aarch64_image_changed == 'true'"
+  manylinux_2_28-deps-image:
+    name: "manylinux_2_28-${{matrix.arch}}-deps-image"
+    if: "needs.filter-relevant-changes.outputs.manylinux_2_28_image_changed == 'true'"
     needs: "filter-relevant-changes"
-    runs-on: "ubuntu-24.04-arm"
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: "amd64"
+            runner: *runner
+          - arch: "arm64"
+            runner: "ubuntu-24.04-arm"
+    runs-on: "${{matrix.runner}}"
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -164,71 +166,102 @@ jobs:
         env:
           OS_NAME: "manylinux_2_28"
         with:
-          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX_AARCH64}}${{env.OS_NAME}}"
+          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX}}${{env.OS_NAME}}"
+          arch: "${{matrix.arch}}"
           docker_context: "components/core"
-          docker_file: "components/core/tools/docker-images/clp-env-base-${{env.OS_NAME}}-aarch64\
+          docker_file: "components/core/tools/docker-images/clp-env-base-${{env.OS_NAME}}\
             /Dockerfile"
           push_deps_image: >-
             ${{github.event_name != 'pull_request' && github.ref == 'refs/heads/main'}}
           token: "${{secrets.GITHUB_TOKEN}}"
 
-  manylinux_2_28-x86_64-deps-image:
-    name: "manylinux_2_28-x86_64-deps-image"
-    if: "needs.filter-relevant-changes.outputs.manylinux_2_28_x86_64_image_changed == 'true'"
-    needs: "filter-relevant-changes"
+  manylinux_2_28-deps-image-merge:
+    name: "manylinux_2_28-deps-image-merge"
+    # Only merge per-arch tags into a multi-arch ":main" manifest on push to main; on PRs the
+    # deps image is consumed as a local tar artifact, so no merge is needed. Gated on the
+    # manylinux deps-image matrix result, which is 'success' only when both arch legs
+    # (amd64 + arm64) succeeded and pushed their arch-suffixed ":main-<arch>" tags.
+    if: >-
+      github.event_name != 'pull_request'
+      && github.ref == 'refs/heads/main'
+      && needs.manylinux_2_28-deps-image.result == 'success'
+    needs:
+      - "manylinux_2_28-deps-image"
     runs-on: *runner
     steps:
-      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+      - name: "Login to Image Registry"
+        uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121"  # v4.1.0
         with:
-          submodules: "recursive"
+          registry: "ghcr.io"
+          username: "${{github.actor}}"
+          password: "${{secrets.GITHUB_TOKEN}}"
 
-      - name: "Work around actions/runner-images/issues/6775"
-        run: "chown $(id -u):$(id -g) -R ."
+      - name: "Sanitize Repository Name"
+        id: "sanitization"
         shell: "bash"
+        run: |
+          echo "REPOSITORY=$(echo '${{github.repository}}' | tr '[:upper:]' '[:lower:]')" \
+            >> "$GITHUB_OUTPUT"
 
-      - uses: "./.github/actions/clp-core-build-containers"
-        env:
-          OS_NAME: "manylinux_2_28"
-        with:
-          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX_X86}}${{env.OS_NAME}}"
-          docker_context: "components/core"
-          docker_file: "components/core/tools/docker-images/clp-env-base-${{env.OS_NAME}}-x86_64\
-            /Dockerfile"
-          push_deps_image: >-
-            ${{github.event_name != 'pull_request' && github.ref == 'refs/heads/main'}}
-          token: "${{secrets.GITHUB_TOKEN}}"
-
-  musllinux_1_2-aarch64-deps-image:
-    name: "musllinux_1_2-aarch64-deps-image"
-    if: "needs.filter-relevant-changes.outputs.musllinux_1_2_aarch64_image_changed == 'true'"
-    needs: "filter-relevant-changes"
-    runs-on: "ubuntu-24.04-arm"
+      - name: "Create and Push Multi-arch Manifest"
+        shell: "bash"
+        run: |
+          image_base="ghcr.io/${{steps.sanitization.outputs.REPOSITORY}}/${{env.DEPS_IMAGE_NAME_PREFIX}}manylinux_2_28"
+          docker manifest create "${image_base}:main" \
+            "${image_base}:main-amd64" \
+            "${image_base}:main-arm64"
+          docker manifest push "${image_base}:main"
+
+  musllinux_1_2-deps-image-merge:
+    name: "musllinux_1_2-deps-image-merge"
+    # Only merge per-arch tags into a multi-arch ":main" manifest on push to main; on PRs the
+    # deps image is consumed as a local tar artifact, so no merge is needed. Gated on the
+    # musllinux deps-image matrix result, which is 'success' only when both arch legs
+    # (amd64 + arm64) succeeded and pushed their arch-suffixed ":main-<arch>" tags.
+    if: >-
+      github.event_name != 'pull_request'
+      && github.ref == 'refs/heads/main'
+      && needs.musllinux_1_2-deps-image.result == 'success'
+    needs:
+      - "musllinux_1_2-deps-image"
+    runs-on: *runner
     steps:
-      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
+      - name: "Login to Image Registry"
+        uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121"  # v4.1.0
         with:
-          submodules: "recursive"
+          registry: "ghcr.io"
+          username: "${{github.actor}}"
+          password: "${{secrets.GITHUB_TOKEN}}"
 
-      - name: "Work around actions/runner-images/issues/6775"
-        run: "chown $(id -u):$(id -g) -R ."
+      - name: "Sanitize Repository Name"
+        id: "sanitization"
         shell: "bash"
+        run: |
+          echo "REPOSITORY=$(echo '${{github.repository}}' | tr '[:upper:]' '[:lower:]')" \
+            >> "$GITHUB_OUTPUT"
 
-      - uses: "./.github/actions/clp-core-build-containers"
-        env:
-          OS_NAME: "musllinux_1_2"
-        with:
-          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX_AARCH64}}${{env.OS_NAME}}"
-          docker_context: "components/core"
-          docker_file: "components/core/tools/docker-images/clp-env-base-${{env.OS_NAME}}-aarch64\
-            /Dockerfile"
-          push_deps_image: >-
-            ${{github.event_name != 'pull_request' && github.ref == 'refs/heads/main'}}
-          token: "${{secrets.GITHUB_TOKEN}}"
-
-  musllinux_1_2-x86_64-deps-image:
-    name: "musllinux_1_2-x86_64-deps-image"
-    if: "needs.filter-relevant-changes.outputs.musllinux_1_2_x86_64_image_changed == 'true'"
+      - name: "Create and Push Multi-arch Manifest"
+        shell: "bash"
+        run: |
+          image_base="ghcr.io/${{steps.sanitization.outputs.REPOSITORY}}/${{env.DEPS_IMAGE_NAME_PREFIX}}musllinux_1_2"
+          docker manifest create "${image_base}:main" \
+            "${image_base}:main-amd64" \
+            "${image_base}:main-arm64"
+          docker manifest push "${image_base}:main"
+
+  musllinux_1_2-deps-image:
+    name: "musllinux_1_2-${{matrix.arch}}-deps-image"
+    if: "needs.filter-relevant-changes.outputs.musllinux_1_2_image_changed == 'true'"
     needs: "filter-relevant-changes"
-    runs-on: *runner
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: "amd64"
+            runner: *runner
+          - arch: "arm64"
+            runner: "ubuntu-24.04-arm"
+    runs-on: "${{matrix.runner}}"
     steps:
       - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"  # v6.0.2
         with:
@@ -242,9 +275,10 @@ jobs:
         env:
           OS_NAME: "musllinux_1_2"
         with:
-          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX_X86}}${{env.OS_NAME}}"
+          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX}}${{env.OS_NAME}}"
+          arch: "${{matrix.arch}}"
           docker_context: "components/core"
-          docker_file: "components/core/tools/docker-images/clp-env-base-${{env.OS_NAME}}-x86_64\
+          docker_file: "components/core/tools/docker-images/clp-env-base-${{env.OS_NAME}}\
             /Dockerfile"
           push_deps_image: >-
             ${{github.event_name != 'pull_request' && github.ref == 'refs/heads/main'}}
@@ -348,9 +382,13 @@ jobs:
     # Run if the ancestor jobs succeeded OR they were skipped and clp was changed.
     if: >-
       success()
-      || (!cancelled() && !failure() && needs.filter-relevant-changes.outputs.clp_changed == 'true')
+      || (!cancelled() && !failure() && (
+        needs.filter-relevant-changes.outputs.clp_changed == 'true'
+        || needs.filter-relevant-changes.outputs.manylinux_2_28_image_changed == 'true'
+      ))
     needs:
-      - "manylinux_2_28-x86_64-deps-image"
+      - "manylinux_2_28-deps-image"
+      - "manylinux_2_28-deps-image-merge"
       - "filter-relevant-changes"
     strategy:
       matrix:
@@ -372,9 +410,10 @@ jobs:
         env:
           OS_NAME: "manylinux_2_28"
         with:
-          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX_X86}}${{env.OS_NAME}}"
+          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX}}${{env.OS_NAME}}"
+          arch: "amd64"
           use_published_image: >-
-            ${{needs.filter-relevant-changes.outputs.manylinux_2_28_x86_64_image_changed == 'false'
+            ${{needs.filter-relevant-changes.outputs.manylinux_2_28_image_changed == 'false'
             || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')}}
           run_command: >-
             CLP_CPP_MAX_PARALLELISM_PER_BUILD_TASK=$(getconf _NPROCESSORS_ONLN) task deps:core
@@ -390,10 +429,12 @@ jobs:
       success() || (!cancelled() && !failure() && (
         needs.filter-relevant-changes.outputs.clp_changed == 'true'
         || needs.filter-relevant-changes.outputs.yscope_clp_core_changed == 'true'
+        || needs.filter-relevant-changes.outputs.manylinux_2_28_image_changed == 'true'
       ))
     needs:
       - "filter-relevant-changes"
-      - "manylinux_2_28-x86_64-deps-image"
+      - "manylinux_2_28-deps-image"
+      - "manylinux_2_28-deps-image-merge"
     env:
       OS_NAME: "manylinux_2_28"
     name: "manylinux_2_28-x86_64-python-wheels"
@@ -410,9 +451,10 @@ jobs:
 
       - uses: "./.github/actions/run-on-image"
         with:
-          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX_X86}}${{env.OS_NAME}}"
+          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX}}${{env.OS_NAME}}"
+          arch: "amd64"
           use_published_image: >-
-            ${{needs.filter-relevant-changes.outputs.manylinux_2_28_x86_64_image_changed == 'false'
+            ${{needs.filter-relevant-changes.outputs.manylinux_2_28_image_changed == 'false'
             || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')}}
           run_command: >-
             CLP_CPP_MAX_PARALLELISM_PER_BUILD_TASK=$(getconf _NPROCESSORS_ONLN)
@@ -441,9 +483,13 @@ jobs:
     # Run if the ancestor jobs succeeded OR they were skipped and clp was changed.
     if: >-
       success()
-      || (!cancelled() && !failure() && needs.filter-relevant-changes.outputs.clp_changed == 'true')
+      || (!cancelled() && !failure() && (
+        needs.filter-relevant-changes.outputs.clp_changed == 'true'
+        || needs.filter-relevant-changes.outputs.musllinux_1_2_image_changed == 'true'
+      ))
     needs:
-      - "musllinux_1_2-x86_64-deps-image"
+      - "musllinux_1_2-deps-image"
+      - "musllinux_1_2-deps-image-merge"
       - "filter-relevant-changes"
     strategy:
       matrix:
@@ -465,9 +511,10 @@ jobs:
         env:
           OS_NAME: "musllinux_1_2"
         with:
-          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX_X86}}${{env.OS_NAME}}"
+          image_name: "${{env.DEPS_IMAGE_NAME_PREFIX}}${{env.OS_NAME}}"
+          arch: "amd64"
           use_published_image: >-
-            ${{needs.filter-relevant-changes.outputs.musllinux_1_2_x86_64_image_changed == 'false'
+            ${{needs.filter-relevant-changes.outputs.musllinux_1_2_image_changed == 'false'
             || (github.event_name != 'pull_request' && github.ref == 'refs/heads/main')}}
           run_command: >-
             CLP_CPP_MAX_PARALLELISM_PER_BUILD_TASK=$(getconf _NPROCESSORS_ONLN) task deps:core
diff --git a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/build.sh b/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/build.sh
deleted file mode 100755
index c70983c4f8..0000000000
--- a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/build.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-component_root="${script_dir}/../../../"
-
-# Corporate proxy support — see corporate-proxy-host.sh for details.
-source "${script_dir}/../../scripts/corporate-proxy-host.sh"
-prepare_ca_cert_for_build "$component_root"
-trap 'cleanup_ca_cert "$component_root"' EXIT
-
-build_cmd=(
-    docker buildx build
-    --platform linux/arm64
-    --tag clp-core-dependencies-aarch64-manylinux_2_28:dev
-    "$component_root"
-    --file "${script_dir}/Dockerfile"
-    --load
-)
-
-# Optional env vars:
-#   HTTP_PROXY / HTTPS_PROXY / NO_PROXY / ALL_PROXY — Forwarded into the build container
-#   DNF_MIRROR_BASE_URL — Override AlmaLinux mirrors (organization-internal or regional)
-#   DOCKER_NETWORK      — Override Docker network mode (auto: host for localhost proxies)
-#   DOCKER_PULL=true    — Force pull the latest base image from the registry
-finalize_build build_cmd "$script_dir" DNF_MIRROR_BASE_URL
diff --git a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/Dockerfile b/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/Dockerfile
deleted file mode 100644
index 206de12f63..0000000000
--- a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/Dockerfile
+++ /dev/null
@@ -1,56 +0,0 @@
-# syntax=docker/dockerfile:1
-
-FROM quay.io/pypa/manylinux_2_28_x86_64
-
-WORKDIR /root
-
-RUN mkdir -p ./tools/scripts/lib_install
-COPY --link ./tools/scripts/lib_install ./tools/scripts/lib_install
-COPY --link ./tools/scripts/corporate-proxy-container.sh ./tools/scripts/corporate-proxy-container.sh
-COPY --link ./tools/scripts/ca-certificates.crt ./tools/scripts/ca-certificates.crt
-# Corporate proxy support: install host CA certificates into the container's
-# trust store so tools like curl and dnf can verify TLS through intercepting
-# proxies (e.g., Zscaler, Fortinet, Palo Alto). See corporate-proxy-host.sh
-# for details.
-RUN ./tools/scripts/corporate-proxy-container.sh
-
-# Point pip/pipx and curl at the CA bundle installed by corporate-proxy-container.sh.
-# This path is outside the system package manager's control, so it survives reinstalls of
-# ca-certificates (which regenerates the system bundle).
-ENV CURL_CA_BUNDLE=/opt/corp-ca/ca-bundle.crt \
-    PIP_CERT=/opt/corp-ca/ca-bundle.crt \
-    REQUESTS_CA_BUNDLE=/opt/corp-ca/ca-bundle.crt \
-    SSL_CERT_FILE=/opt/corp-ca/ca-bundle.crt
-
-# Optional: override AlmaLinux mirrors (e.g., organization-internal or regional).
-# Usage: DNF_MIRROR_BASE_URL=<url> ./build.sh
-ARG DNF_MIRROR_BASE_URL
-RUN if [ -n "${DNF_MIRROR_BASE_URL:-}" ]; then \
-        sed -i 's|^mirrorlist=|#mirrorlist=|g' /etc/yum.repos.d/almalinux*.repo && \
-        sed -i "s|^# *baseurl=https\?://repo.almalinux.org/almalinux|baseurl=${DNF_MIRROR_BASE_URL}|g" /etc/yum.repos.d/almalinux*.repo && \
-        dnf clean all && dnf makecache; \
-    fi
-
-RUN pipx uninstall cmake
-RUN pipx uninstall uv
-
-RUN ./tools/scripts/lib_install/manylinux_2_28/install-all.sh || { \
-        echo ""; \
-        echo "==============================================================="; \
-        echo "ERROR: Package installation failed."; \
-        echo ""; \
-        echo "If the error above mentions download failures, timeouts, or"; \
-        echo "unreachable mirrors, try overriding with a different mirror:"; \
-        echo "  DNF_MIRROR_BASE_URL=<url> ./build.sh"; \
-        echo ""; \
-        echo "Use your organization's internal mirror or pick one from:"; \
-        echo "  https://mirrors.almalinux.org/"; \
-        echo "==============================================================="; \
-        exit 1; \
-    }
-
-# Remove cached files
-RUN dnf clean all && rm -rf /var/cache/dnf /tmp/* /var/tmp/*
-
-# NOTE: Don't flatten the image or else we'll lose any environment modifications from the base
-# image.
diff --git a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/build.sh b/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/build.sh
deleted file mode 100755
index e575592e64..0000000000
--- a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64/build.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-component_root="${script_dir}/../../../"
-
-# Corporate proxy support — see corporate-proxy-host.sh for details.
-source "${script_dir}/../../scripts/corporate-proxy-host.sh"
-prepare_ca_cert_for_build "$component_root"
-trap 'cleanup_ca_cert "$component_root"' EXIT
-
-build_cmd=(
-    docker buildx build
-    --platform linux/amd64
-    --tag clp-core-dependencies-x86-manylinux_2_28:dev
-    "$component_root"
-    --file "${script_dir}/Dockerfile"
-    --load
-)
-
-# Optional env vars:
-#   HTTP_PROXY / HTTPS_PROXY / NO_PROXY / ALL_PROXY — Forwarded into the build container
-#   DNF_MIRROR_BASE_URL — Override AlmaLinux mirrors (organization-internal or regional)
-#   DOCKER_NETWORK      — Override Docker network mode (auto: host for localhost proxies)
-#   DOCKER_PULL=true    — Force pull the latest base image from the registry
-finalize_build build_cmd "$script_dir" DNF_MIRROR_BASE_URL
diff --git a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/Dockerfile b/components/core/tools/docker-images/clp-env-base-manylinux_2_28/Dockerfile
similarity index 92%
rename from components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/Dockerfile
rename to components/core/tools/docker-images/clp-env-base-manylinux_2_28/Dockerfile
index 09607d4c03..470fb74b9f 100644
--- a/components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64/Dockerfile
+++ b/components/core/tools/docker-images/clp-env-base-manylinux_2_28/Dockerfile
@@ -1,6 +1,8 @@
 # syntax=docker/dockerfile:1
 
-FROM quay.io/pypa/manylinux_2_28_aarch64
+# Multi-arch base image (amd64, arm64, ...). Build with `--platform` to select the
+# target architecture; see build.sh (PLATFORM env var for local cross-builds).
+FROM quay.io/pypa/manylinux_2_28
 
 WORKDIR /root
 
diff --git a/components/core/tools/docker-images/clp-env-base-manylinux_2_28/build.sh b/components/core/tools/docker-images/clp-env-base-manylinux_2_28/build.sh
new file mode 100755
index 0000000000..7ee10e657f
--- /dev/null
+++ b/components/core/tools/docker-images/clp-env-base-manylinux_2_28/build.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# Builds the CLP-core dependencies image for manylinux_2_28.
+#
+# By default the image is built for the host's native architecture. To cross-build
+# for a different architecture (using QEMU emulation), set the PLATFORM env var,
+# e.g.:
+#   PLATFORM=linux/arm64 ./build.sh
+# This requires binfmt/QEMU support on the host, e.g.:
+#   docker run --privileged --rm tonistiigi/binfmt --install all
+
+script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+component_root="${script_dir}/../../../"
+os_name="manylinux_2_28"
+
+# Determine the target platform and the arch-specific image tag prefix.
+if [[ -n "${PLATFORM:-}" ]]; then
+    platform="${PLATFORM}"
+else
+    case "$(uname -m)" in
+        x86_64|amd64) platform="linux/amd64" ;;
+        aarch64|arm64) platform="linux/arm64" ;;
+        *)
+            echo >&2 "ERROR: Unsupported native architecture '$(uname -m)'; set PLATFORM explicitly."
+            exit 1
+            ;;
+    esac
+fi
+case "${platform}" in
+    linux/amd64|linux/x86_64) arch_prefix="x86" ;;
+    linux/arm64|linux/aarch64) arch_prefix="aarch64" ;;
+    *)
+        echo >&2 "ERROR: Unsupported platform '${platform}' (expected linux/amd64 or linux/arm64)."
+        exit 1
+        ;;
+esac
+
+# Corporate proxy support — see corporate-proxy-host.sh for details.
+source "${script_dir}/../../scripts/corporate-proxy-host.sh"
+prepare_ca_cert_for_build "$component_root"
+trap 'cleanup_ca_cert "$component_root"' EXIT
+
+build_cmd=(
+    docker buildx build
+    --platform "${platform}"
+    --tag "clp-core-dependencies-${arch_prefix}-${os_name}:dev"
+    "$component_root"
+    --file "${script_dir}/Dockerfile"
+    --load
+)
+
+# Optional env vars:
+#   HTTP_PROXY / HTTPS_PROXY / NO_PROXY / ALL_PROXY — Forwarded into the build container
+#   DNF_MIRROR_BASE_URL — Override AlmaLinux mirrors (organization-internal or regional)
+#   DOCKER_NETWORK      — Override Docker network mode (auto: host for localhost proxies)
+#   DOCKER_PULL=true    — Force pull the latest base image from the registry
+finalize_build build_cmd "$script_dir" DNF_MIRROR_BASE_URL
diff --git a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/build.sh b/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/build.sh
deleted file mode 100755
index 79afa5962c..0000000000
--- a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/build.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-component_root="${script_dir}/../../../"
-
-# Corporate proxy support — see corporate-proxy-host.sh for details.
-source "${script_dir}/../../scripts/corporate-proxy-host.sh"
-prepare_ca_cert_for_build "$component_root"
-trap 'cleanup_ca_cert "$component_root"' EXIT
-
-build_cmd=(
-    docker buildx build
-    --platform linux/arm64
-    --tag clp-core-dependencies-aarch64-musllinux_1_2:dev
-    "$component_root"
-    --file "${script_dir}/Dockerfile"
-    --load
-)
-
-# Optional env vars:
-#   HTTP_PROXY / HTTPS_PROXY / NO_PROXY / ALL_PROXY — Forwarded into the build container
-#   APK_MIRROR_URL  — Override Alpine mirrors (organization-internal or regional)
-#   DOCKER_NETWORK  — Override Docker network mode (auto: host for localhost proxies)
-#   DOCKER_PULL=true — Force pull the latest base image from the registry
-finalize_build build_cmd "$script_dir" APK_MIRROR_URL
diff --git a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/Dockerfile b/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/Dockerfile
deleted file mode 100644
index 33b591e598..0000000000
--- a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/Dockerfile
+++ /dev/null
@@ -1,52 +0,0 @@
-# syntax=docker/dockerfile:1
-
-FROM quay.io/pypa/musllinux_1_2_x86_64 AS base
-
-WORKDIR /root
-
-RUN mkdir -p ./tools/scripts/lib_install
-COPY --link ./tools/scripts/lib_install ./tools/scripts/lib_install
-COPY --link ./tools/scripts/corporate-proxy-container.sh ./tools/scripts/corporate-proxy-container.sh
-COPY --link ./tools/scripts/ca-certificates.crt ./tools/scripts/ca-certificates.crt
-# Corporate proxy support: install host CA certificates into the container's
-# trust store so tools like curl and apk can verify TLS through intercepting
-# proxies (e.g., Zscaler, Fortinet, Palo Alto). See corporate-proxy-host.sh
-# for details.
-RUN ./tools/scripts/corporate-proxy-container.sh
-
-# Point pip/pipx and curl at the CA bundle installed by corporate-proxy-container.sh.
-# This path is outside the system package manager's control, so it survives reinstalls of
-# ca-certificates (which regenerates the system bundle).
-ENV CURL_CA_BUNDLE=/opt/corp-ca/ca-bundle.crt \
-    PIP_CERT=/opt/corp-ca/ca-bundle.crt \
-    REQUESTS_CA_BUNDLE=/opt/corp-ca/ca-bundle.crt \
-    SSL_CERT_FILE=/opt/corp-ca/ca-bundle.crt
-
-# Optional: override Alpine mirrors (e.g., organization-internal or regional).
-# Usage: APK_MIRROR_URL=<url> ./build.sh
-ARG APK_MIRROR_URL
-RUN if [ -n "${APK_MIRROR_URL:-}" ]; then \
-        sed -i "s|https://dl-cdn.alpinelinux.org/alpine|${APK_MIRROR_URL}|g" /etc/apk/repositories && \
-        apk update; \
-    fi
-
-RUN pipx uninstall cmake
-RUN pipx uninstall uv
-
-RUN ./tools/scripts/lib_install/musllinux_1_2/install-all.sh || { \
-        echo ""; \
-        echo "==============================================================="; \
-        echo "ERROR: Package installation failed."; \
-        echo ""; \
-        echo "If the error above mentions download failures, timeouts, or"; \
-        echo "unreachable mirrors, try overriding with a different mirror:"; \
-        echo "  APK_MIRROR_URL=<url> ./build.sh"; \
-        echo ""; \
-        echo "Use your organization's internal mirror or pick one from:"; \
-        echo "  https://mirrors.alpinelinux.org/"; \
-        echo "==============================================================="; \
-        exit 1; \
-    }
-
-# Remove cached files
-RUN apk cache clean --all && rm -rf /var/cache/apk/* /tmp/* /var/tmp/*
diff --git a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/build.sh b/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/build.sh
deleted file mode 100755
index efbbb96de3..0000000000
--- a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64/build.sh
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
-component_root="${script_dir}/../../../"
-
-# Corporate proxy support — see corporate-proxy-host.sh for details.
-source "${script_dir}/../../scripts/corporate-proxy-host.sh"
-prepare_ca_cert_for_build "$component_root"
-trap 'cleanup_ca_cert "$component_root"' EXIT
-
-build_cmd=(
-    docker buildx build
-    --platform linux/amd64
-    --tag clp-core-dependencies-x86-musllinux_1_2:dev
-    "$component_root"
-    --file "${script_dir}/Dockerfile"
-    --load
-)
-
-# Optional env vars:
-#   HTTP_PROXY / HTTPS_PROXY / NO_PROXY / ALL_PROXY — Forwarded into the build container
-#   APK_MIRROR_URL  — Override Alpine mirrors (organization-internal or regional)
-#   DOCKER_NETWORK  — Override Docker network mode (auto: host for localhost proxies)
-#   DOCKER_PULL=true — Force pull the latest base image from the registry
-finalize_build build_cmd "$script_dir" APK_MIRROR_URL
diff --git a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/Dockerfile b/components/core/tools/docker-images/clp-env-base-musllinux_1_2/Dockerfile
similarity index 91%
rename from components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/Dockerfile
rename to components/core/tools/docker-images/clp-env-base-musllinux_1_2/Dockerfile
index ad020fdb76..010b7d6608 100644
--- a/components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64/Dockerfile
+++ b/components/core/tools/docker-images/clp-env-base-musllinux_1_2/Dockerfile
@@ -1,6 +1,8 @@
 # syntax=docker/dockerfile:1
 
-FROM quay.io/pypa/musllinux_1_2_aarch64
+# Multi-arch base image (amd64, arm64, ...). Build with `--platform` to select the
+# target architecture; see build.sh (PLATFORM env var for local cross-builds).
+FROM quay.io/pypa/musllinux_1_2
 
 WORKDIR /root
 
diff --git a/components/core/tools/docker-images/clp-env-base-musllinux_1_2/build.sh b/components/core/tools/docker-images/clp-env-base-musllinux_1_2/build.sh
new file mode 100755
index 0000000000..1a50f85c87
--- /dev/null
+++ b/components/core/tools/docker-images/clp-env-base-musllinux_1_2/build.sh
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# Builds the CLP-core dependencies image for musllinux_1_2.
+#
+# By default the image is built for the host's native architecture. To cross-build
+# for a different architecture (using QEMU emulation), set the PLATFORM env var,
+# e.g.:
+#   PLATFORM=linux/arm64 ./build.sh
+# This requires binfmt/QEMU support on the host, e.g.:
+#   docker run --privileged --rm tonistiigi/binfmt --install all
+
+script_dir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+component_root="${script_dir}/../../../"
+os_name="musllinux_1_2"
+
+# Determine the target platform and the arch-specific image tag prefix.
+if [[ -n "${PLATFORM:-}" ]]; then
+    platform="${PLATFORM}"
+else
+    case "$(uname -m)" in
+        x86_64|amd64) platform="linux/amd64" ;;
+        aarch64|arm64) platform="linux/arm64" ;;
+        *)
+            echo >&2 "ERROR: Unsupported native architecture '$(uname -m)'; set PLATFORM explicitly."
+            exit 1
+            ;;
+    esac
+fi
+case "${platform}" in
+    linux/amd64|linux/x86_64) arch_prefix="x86" ;;
+    linux/arm64|linux/aarch64) arch_prefix="aarch64" ;;
+    *)
+        echo >&2 "ERROR: Unsupported platform '${platform}' (expected linux/amd64 or linux/arm64)."
+        exit 1
+        ;;
+esac
+
+# Corporate proxy support — see corporate-proxy-host.sh for details.
+source "${script_dir}/../../scripts/corporate-proxy-host.sh"
+prepare_ca_cert_for_build "$component_root"
+trap 'cleanup_ca_cert "$component_root"' EXIT
+
+build_cmd=(
+    docker buildx build
+    --platform "${platform}"
+    --tag "clp-core-dependencies-${arch_prefix}-${os_name}:dev"
+    "$component_root"
+    --file "${script_dir}/Dockerfile"
+    --load
+)
+
+# Optional env vars:
+#   HTTP_PROXY / HTTPS_PROXY / NO_PROXY / ALL_PROXY — Forwarded into the build container
+#   APK_MIRROR_URL  — Override Alpine mirrors (organization-internal or regional)
+#   DOCKER_NETWORK  — Override Docker network mode (auto: host for localhost proxies)
+#   DOCKER_PULL=true — Force pull the latest base image from the registry
+finalize_build build_cmd "$script_dir" APK_MIRROR_URL
diff --git a/components/core/tools/packaging/build.sh b/components/core/tools/packaging/build.sh
index 9e0085097d..20c52ac483 100755
--- a/components/core/tools/packaging/build.sh
+++ b/components/core/tools/packaging/build.sh
@@ -263,10 +263,13 @@ for cur_format in "${format_list[@]}"; do
         echo "Building ${cur_format} for ${target_arch}"
         echo "========================================"
 
-        # Build the base image if not present
+        # Build the base image if not present. The consolidated (multi-arch)
+        # clp-env-base-<family>/build.sh selects the target architecture via the
+        # PLATFORM env var, so cross-arch packaging builds get the correct base.
         if ! docker image inspect "${base_image_tag}" &>/dev/null; then
             echo "==> Building base image ${base_image_tag}..."
-            bash "${repo_root}/components/core/tools/docker-images/clp-env-base-${base_image_family}-${docker_suffix}/build.sh"
+            PLATFORM="${docker_platform}" \
+                bash "${repo_root}/components/core/tools/docker-images/clp-env-base-${base_image_family}/build.sh"
         fi
 
         # Build the builder image (base + packaging tools)
diff --git a/components/core/tools/packaging/universal-deb/Dockerfile b/components/core/tools/packaging/universal-deb/Dockerfile
index 9d45a38137..c297fd7748 100644
--- a/components/core/tools/packaging/universal-deb/Dockerfile
+++ b/components/core/tools/packaging/universal-deb/Dockerfile
@@ -13,4 +13,10 @@ FROM ${BASE_IMAGE}
 
 RUN dnf install -y epel-release \
     && dnf install -y dpkg patchelf rpm-build \
+    # `dnf install dpkg` pulls in AlmaLinux's python3-3.6, which registers /usr/bin/python3
+    # via alternatives at priority 1000000 and so wins over the manylinux Python, leaving
+    # `python3` resolving to 3.6. That's too old for build-and-run-unit-tests.py (uses
+    # `from __future__ import annotations`, 3.7+). Re-register the manylinux
+    # /usr/local/bin/python3.12 at a higher priority to restore it as the default `python3`.
+    && update-alternatives --install /usr/bin/python3 python3 /usr/local/bin/python3.12 2000000 \
     && dnf clean all
diff --git a/docs/src/dev-docs/tooling-containers.md b/docs/src/dev-docs/tooling-containers.md
index 35000142aa..209bdcfa54 100644
--- a/docs/src/dev-docs/tooling-containers.md
+++ b/docs/src/dev-docs/tooling-containers.md
@@ -6,10 +6,11 @@ can be built and used locally, but some are available to download from
 
 To build an image locally, run the `build.sh` script in the image's directory.
 
-## clp-core-dependencies-&lt;arch&gt;-manylinux_2_28
+## clp-core-dependencies-manylinux_2_28
 
-Images containing the dependencies necessary to build CLP core in a [manylinux_2_28][manylinux_2_28]
-environment (aarch64 or x86).
+Image containing the dependencies necessary to build CLP core in a [manylinux_2_28][manylinux_2_28]
+environment. It is published as a multi-arch image (amd64 and arm64); Docker auto-selects the
+architecture matching the host on pull.
 
 Binaries built on manylinux_2_28 (based on AlmaLinux 8) are expected to be compatible with other
 distros using glibc 2.28+, including:
@@ -19,75 +20,58 @@ distros using glibc 2.28+, including:
 * Fedora 29+
 * Ubuntu 18.10+
 
-### clp-core-dependencies-aarch64-manylinux_2_28
-
-* [GitHub Packages page][core-deps-manylinux_2_28-aarch64]
+* [GitHub Packages page][core-deps-manylinux_2_28]
 * Pull command:
 
   ```bash
-  docker pull ghcr.io/y-scope/clp/clp-core-dependencies-aarch64-manylinux_2_28:main
+  docker pull ghcr.io/y-scope/clp/clp-core-dependencies-manylinux_2_28:main
   ```
 
 * Path:
 
   ```text
-  components/core/tools/docker-images/clp-env-base-manylinux_2_28-aarch64
-  ```
-
-### clp-core-dependencies-x86-manylinux_2_28
-
-* [GitHub Packages page][core-deps-manylinux_2_28-x86_64]
-* Pull command:
-
-  ```bash
-  docker pull ghcr.io/y-scope/clp/clp-core-dependencies-x86-manylinux_2_28:main
+  components/core/tools/docker-images/clp-env-base-manylinux_2_28
   ```
 
-* Path:
+  To cross-build for a non-native architecture locally (using QEMU emulation), set the `PLATFORM`
+  env var when running `build.sh`, e.g. `PLATFORM=linux/arm64 ./build.sh`
+  (requires binfmt/QEMU support on the host).
 
-  ```text
-  components/core/tools/docker-images/clp-env-base-manylinux_2_28-x86_64
-  ```
+  Local builds keep the architecture-specific `:dev` tags used by the packaging scripts:
+  `clp-core-dependencies-x86-manylinux_2_28:dev` for amd64 and
+  `clp-core-dependencies-aarch64-manylinux_2_28:dev` for arm64.
 
-## clp-core-dependencies-&lt;arch&gt;-musllinux_1_2
+## clp-core-dependencies-musllinux_1_2
 
-Images containing the dependencies necessary to build CLP core in a [musllinux_1_2][musllinux_1_2]
-environment (aarch64 or x86).
+Image containing the dependencies necessary to build CLP core in a [musllinux_1_2][musllinux_1_2]
+environment. It is published as a multi-arch image (amd64 and arm64); Docker auto-selects the
+architecture matching the host on pull.
 
 Binaries built on musllinux_1_2 (based on Alpine Linux 3.22) are expected to be compatible with
 other distros using musl 1.2, including:
 
 * Alpine Linux 3.13+
 
-### clp-core-dependencies-aarch64-musllinux_1_2
-
-* [GitHub Packages page][core-deps-musllinux_1_2-aarch64]
+* [GitHub Packages page][core-deps-musllinux_1_2]
 * Pull command:
 
   ```bash
-  docker pull ghcr.io/y-scope/clp/clp-core-dependencies-aarch64-musllinux_1_2:main
+  docker pull ghcr.io/y-scope/clp/clp-core-dependencies-musllinux_1_2:main
   ```
 
 * Path:
 
   ```text
-  components/core/tools/docker-images/clp-env-base-musllinux_1_2-aarch64
-  ```
-
-### clp-core-dependencies-x86-musllinux_1_2
-
-* [GitHub Packages page][core-deps-musllinux_1_2-x86_64]
-* Pull command:
-
-  ```bash
-  docker pull ghcr.io/y-scope/clp/clp-core-dependencies-x86-musllinux_1_2:main
+  components/core/tools/docker-images/clp-env-base-musllinux_1_2
   ```
 
-* Path:
+  To cross-build for a non-native architecture locally (using QEMU emulation), set the `PLATFORM`
+  env var when running `build.sh`, e.g. `PLATFORM=linux/arm64 ./build.sh`
+  (requires binfmt/QEMU support on the host).
 
-  ```text
-  components/core/tools/docker-images/clp-env-base-musllinux_1_2-x86_64
-  ```
+  Local builds keep the architecture-specific `:dev` tags used by the packaging scripts:
+  `clp-core-dependencies-x86-musllinux_1_2:dev` for amd64 and
+  `clp-core-dependencies-aarch64-musllinux_1_2:dev` for arm64.
 
 ## clp-core-dependencies-x86-centos-stream-9
 
@@ -247,10 +231,8 @@ Each distro supports an environment variable to override the default package mir
 | `DOCKER_NETWORK` | (auto)  | Override Docker's network mode (e.g., `host`, `bridge`).                       |
 
 [core-deps-centos-stream-9]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-dependencies-x86-centos-stream-9
-[core-deps-manylinux_2_28-aarch64]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-dependencies-aarch64-manylinux_2_28
-[core-deps-manylinux_2_28-x86_64]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-dependencies-x86-manylinux_2_28
-[core-deps-musllinux_1_2-aarch64]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-dependencies-aarch64-musllinux_1_2
-[core-deps-musllinux_1_2-x86_64]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-dependencies-x86-musllinux_1_2
+[core-deps-manylinux_2_28]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-dependencies-manylinux_2_28
+[core-deps-musllinux_1_2]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-dependencies-musllinux_1_2
 [core-deps-ubuntu-jammy]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-dependencies-x86-ubuntu-jammy
 [core-ubuntu-jammy]: https://github.com/y-scope/clp/pkgs/container/clp%2Fclp-core-x86-ubuntu-jammy
 [gh-packages]: https://github.com/orgs/y-scope/packages?repo_name=clp
diff --git a/docs/src/dev-docs/tooling-gh-workflows.md b/docs/src/dev-docs/tooling-gh-workflows.md
index 830beff69b..981da79537 100644
--- a/docs/src/dev-docs/tooling-gh-workflows.md
+++ b/docs/src/dev-docs/tooling-gh-workflows.md
@@ -30,18 +30,20 @@ shown below.
 }%%
 flowchart LR
     filter-relevant-changes --> centos-stream-9-deps-image
-    filter-relevant-changes --> manylinux_2_28-aarch64-deps-image
-    filter-relevant-changes --> manylinux_2_28-x86_64-deps-image
-    filter-relevant-changes --> musllinux_1_2-aarch64-deps-image
-    filter-relevant-changes --> musllinux_1_2-x86_64-deps-image
+    filter-relevant-changes --> manylinux_2_28-deps-image
+    filter-relevant-changes --> musllinux_1_2-deps-image
     filter-relevant-changes --> ubuntu-jammy-deps-image
     filter-relevant-changes --> centos-stream-9-binaries
     filter-relevant-changes --> manylinux_2_28-x86_64-binaries
     filter-relevant-changes --> musllinux_1_2-x86_64-binaries
     filter-relevant-changes --> ubuntu-jammy-binaries
     centos-stream-9-deps-image --> centos-stream-9-binaries
-    manylinux_2_28-x86_64-deps-image --> manylinux_2_28-x86_64-binaries
-    musllinux_1_2-x86_64-deps-image --> musllinux_1_2-x86_64-binaries
+    manylinux_2_28-deps-image --> manylinux_2_28-deps-image-merge
+    manylinux_2_28-deps-image --> manylinux_2_28-x86_64-binaries
+    manylinux_2_28-deps-image-merge --> manylinux_2_28-x86_64-binaries
+    musllinux_1_2-deps-image --> musllinux_1_2-deps-image-merge
+    musllinux_1_2-deps-image --> musllinux_1_2-x86_64-binaries
+    musllinux_1_2-deps-image-merge --> musllinux_1_2-x86_64-binaries
     ubuntu-jammy-deps-image --> ubuntu-jammy-binaries
     ubuntu-jammy-deps-image --> package-image
     ubuntu-jammy-binaries --> ubuntu-jammy-binaries-image
@@ -53,14 +55,18 @@ Arrows between jobs indicate a dependency. The jobs are as follows:
   the following jobs should run.
 * `centos-stream-9-deps-image`: Builds a container image containing the dependencies necessary to
   build CLP-core in a CentOS Stream 9 x86 environment.
-* `manylinux_2_28-aarch64-deps-image`: Builds a container image containing the dependencies
-  necessary to build CLP-core in a manylinux_2_28 arm64 environment.
-* `manylinux_2_28-x86_64-deps-image`: Builds a container image containing the dependencies necessary
-  to build CLP-core in a manylinux_2_28 x86 environment.
-* `musllinux_1_2-aarch64-deps-image`: Builds a container image containing the dependencies necessary
-  to build CLP-core in a musllinux_1_2 arm64 environment.
-* `musllinux_1_2-x86_64-deps-image`: Builds a container image containing the dependencies necessary
-  to build CLP-core in a musllinux_1_2 x86 environment.
+* `manylinux_2_28-deps-image`: A matrix job that builds, for each of amd64 and arm64 natively on
+  its matching runner, a container image containing the dependencies necessary to build CLP-core
+  in a manylinux_2_28 environment. On push to `main`, each arch is published under an
+  arch-suffixed tag (e.g. `:main-amd64`).
+* `manylinux_2_28-deps-image-merge`: On push to `main`, merges the per-arch tags produced by
+  `manylinux_2_28-deps-image` into a single multi-arch `:main` manifest.
+* `musllinux_1_2-deps-image`: A matrix job that builds, for each of amd64 and arm64 natively on
+  its matching runner, a container image containing the dependencies necessary to build CLP-core
+  in a musllinux_1_2 environment. On push to `main`, each arch is published under an
+  arch-suffixed tag (e.g. `:main-amd64`).
+* `musllinux_1_2-deps-image-merge`: On push to `main`, merges the per-arch tags produced by
+  `musllinux_1_2-deps-image` into a single multi-arch `:main` manifest.
 * `ubuntu-jammy-deps-image`: Builds a container image containing the dependencies necessary to build
   CLP-core in an Ubuntu Jammy x86 environment.
 * `centos-stream-9-binaries`: Builds the CLP-core binaries in the built CentOS Stream 9 container