diff --git a/.gitea/workflows/release.yaml b/.gitea/workflows/release.yaml
index f16ac06..cc80fd3 100644
--- a/.gitea/workflows/release.yaml
+++ b/.gitea/workflows/release.yaml
@@ -72,10 +72,22 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install SDK build dependencies
+        shell: bash
         run: |
           sudo apt-get update
-          sudo apt-get install --yes build-essential clang flex bison g++ gawk gettext git libncurses-dev libssl-dev python3 rsync unzip zlib1g-dev file wget patch time curl jq zstd
+          packages=(build-essential clang flex bison g++ gawk gettext git libncurses-dev libssl-dev python3 rsync unzip zlib1g-dev file wget patch time curl jq zstd)
+          case "$(uname -m)" in
+            aarch64|arm64|armv7l|armv8l)
+              packages+=(qemu-user-static)
+              ;;
+          esac
+          sudo apt-get install --yes "${packages[@]}"
       - name: Build and upload configured packages
+        env:
+          ARCHITECTURE: ${{ matrix.architecture }}
+          VERSION: ${{ needs.metadata.outputs.version }}
+        run: scripts/ci/build-release.sh .gitea/release-targets.json "$ARCHITECTURE" "$VERSION" dist
+      - name: Upload package to draft release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           RELEASE_ID: ${{ needs.create-release.outputs.release-id }}
diff --git a/README.md b/README.md
index 5b25001..4c45b1a 100644
--- a/README.md
+++ b/README.md
@@ -61,6 +61,12 @@ Add an object with a unique `architecture` label and a valid OpenWrt
 required. The generic ARM entries select ARMv7 and ARMv8 ABIs; use a
 device-specific OpenWrt target when necessary.
 
+OpenWrt publishes its release SDKs with x86-64 host tools, even when the target
+is ARM or PowerPC. On an ARM build agent, the workflow installs
+`qemu-user-static` and the build script runs the SDK host tools explicitly
+through `qemu-x86_64-static`; privileged `binfmt_misc` registration is not
+required. Native x86-64 agents skip emulation and remain faster.
+
 Releases use the next available `MAJOR.MINOR.PATCH` tag. `MAJOR` and `MINOR`
 live in the release config; the workflow finds the highest existing
 `vMAJOR.MINOR.PATCH` tag and increments its patch, starting at `0` when a new
diff --git a/scripts/ci/build-release.sh b/scripts/ci/build-release.sh
index 2148049..69a6660 100755
--- a/scripts/ci/build-release.sh
+++ b/scripts/ci/build-release.sh
@@ -38,6 +38,35 @@ sdk_dir=$(find "$work_dir" -mindepth 1 -maxdepth 1 -type d -name 'openwrt-sdk-*'
 [[ -n $sdk_dir ]] || { echo "SDK directory was not extracted" >&2; exit 1; }
 
 cd "$sdk_dir"
+
+# OpenWrt publishes relocatable SDKs whose host tools are x86-64 binaries.
+# On ARM runners, invoke the SDK's bundled x86-64 loader explicitly through
+# QEMU. This works without privileged binfmt_misc registration on the host.
+case $(uname -m) in
+  x86_64|amd64)
+    ;;
+  aarch64|arm64|armv7l|armv8l)
+    qemu_x86_64=$(command -v qemu-x86_64-static || command -v qemu-x86_64 || true)
+    [[ -n $qemu_x86_64 ]] || {
+      echo "ARM build host requires qemu-x86_64-static (install qemu-user-static)" >&2
+      exit 1
+    }
+    mapfile -d '' sdk_wrappers < <(
+      find staging_dir -type f -exec grep -IlZ 'ld-linux-x86-64\.so\.2' {} +
+    )
+    [[ ${#sdk_wrappers[@]} -gt 0 ]] || {
+      echo "no relocatable x86-64 SDK wrappers found" >&2
+      exit 1
+    }
+    sed -i -E "s|^exec (\"\\\$dir/.*ld-linux-x86-64\\.so\\.2\")|exec ${qemu_x86_64} \\1|" "${sdk_wrappers[@]}"
+    staging_dir/host/bin/sed --version >/dev/null
+    ;;
+  *)
+    echo "unsupported build host architecture: $(uname -m)" >&2
+    exit 1
+    ;;
+esac
+
 ./scripts/feeds update base packages
 ./scripts/feeds install mbedtls uci usteer
 mkdir -p package/openuf