diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 625dc464..02eb4391 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,6 +23,14 @@ jobs:
           - platform: arm64
             runner: ubuntu-24.04-arm
     runs-on: ${{ matrix.runner }}
+    # expose values produced by steps so downstream (manifest) job can use them
+    outputs:
+      repo_owner: ${{ steps.meta.outputs.repo_owner }}
+      repo_name: ${{ steps.meta.outputs.repo_name }}
+      branch_tag: ${{ steps.meta.outputs.branch_tag }}
+      version: ${{ steps.version.outputs.version }}
+      timestamp: ${{ steps.timestamp.outputs.timestamp }}
+      sha_short: ${{ steps.version.outputs.sha_short }}
     steps:
       - uses: actions/checkout@v3
         with:
@@ -102,10 +110,12 @@ jobs:
           # stages under qemu on an arm64 runner (and vice-versa). This makes
           # the matrix runner's platform the one built by buildx.
           platforms: linux/${{ matrix.platform }}
+          # push arch-specific tags from each matrix job (they will be combined
+          # into a multi-arch manifest in a follow-up job)
           tags: |
-            ghcr.io/${{ steps.meta.outputs.repo_owner }}/${{ steps.meta.outputs.repo_name }}:${{ steps.meta.outputs.branch_tag }}
-            ghcr.io/${{ steps.meta.outputs.repo_owner }}/${{ steps.meta.outputs.repo_name }}:${{ steps.version.outputs.version }}-${{ steps.timestamp.outputs.timestamp }}
-            ghcr.io/${{ steps.meta.outputs.repo_owner }}/${{ steps.meta.outputs.repo_name }}:${{ steps.version.outputs.sha_short }}
+            ghcr.io/${{ steps.meta.outputs.repo_owner }}/${{ steps.meta.outputs.repo_name }}:${{ steps.meta.outputs.branch_tag }}-${{ matrix.platform }}
+            ghcr.io/${{ steps.meta.outputs.repo_owner }}/${{ steps.meta.outputs.repo_name }}:${{ steps.version.outputs.version }}-${{ steps.timestamp.outputs.timestamp }}-${{ matrix.platform }}
+            ghcr.io/${{ steps.meta.outputs.repo_owner }}/${{ steps.meta.outputs.repo_name }}:${{ steps.version.outputs.sha_short }}-${{ matrix.platform }}
           build-args: |
             REPO_OWNER=${{ steps.meta.outputs.repo_owner }}
             REPO_NAME=${{ steps.meta.outputs.repo_name }}
@@ -114,3 +124,43 @@ jobs:
             REPO_URL=https://github.com/${{ github.repository }}
             TIMESTAMP=${{ steps.timestamp.outputs.timestamp }}
           file: ./docker/Dockerfile
+
+  create-manifest:
+    # wait for all matrix builds to finish
+    needs: [docker]
+    runs-on: ubuntu-24.04
+    if: ${{ github.event_name != 'pull_request' }}
+    steps:
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create multi-arch manifest tags
+        run: |
+          set -euo pipefail
+          OWNER=${{ needs.docker.outputs.repo_owner }}
+          REPO=${{ needs.docker.outputs.repo_name }}
+          BRANCH_TAG=${{ needs.docker.outputs.branch_tag }}
+          VERSION=${{ needs.docker.outputs.version }}
+          TIMESTAMP=${{ needs.docker.outputs.timestamp }}
+          SHA=${{ needs.docker.outputs.sha_short }}
+
+          echo "Creating multi-arch manifest for ${OWNER}/${REPO}"
+
+          # branch tag (e.g. latest or dev)
+          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG} \
+            ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-amd64 ghcr.io/${OWNER}/${REPO}:${BRANCH_TAG}-arm64
+
+          # version + timestamp tag
+          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:${VERSION}-${TIMESTAMP} \
+            ghcr.io/${OWNER}/${REPO}:${VERSION}-${TIMESTAMP}-amd64 ghcr.io/${OWNER}/${REPO}:${VERSION}-${TIMESTAMP}-arm64
+
+          # short sha tag
+          docker buildx imagetools create --tag ghcr.io/${OWNER}/${REPO}:${SHA} \
+            ghcr.io/${OWNER}/${REPO}:${SHA}-amd64 ghcr.io/${OWNER}/${REPO}:${SHA}-arm64