diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 57b9f71..625d983 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -169,12 +169,18 @@ jobs:
           chmod +x deploy/pi-gen/stage-betterframe-client/01-install-kiosk/00-run-chroot.sh
 
       # x86 runner can't natively execute the arm64 binaries pi-gen drops
-      # into the chroot. Register QEMU binfmt_misc handlers so the chroot's
-      # arm64 dpkg / apt-get / etc work transparently.
+      # into the chroot. Install qemu-user-static + binfmt-support so the
+      # kernel routes arm64 ELFs through QEMU. docker/setup-qemu-action
+      # registers via a privileged container which pi-gen's own nested
+      # container doesn't pick up — apt path is what pi-gen documents.
       - name: Register QEMU binfmt for arm64
-        uses: docker/setup-qemu-action@v4
-        with:
-          platforms: arm64
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            qemu-user-static binfmt-support
+          sudo update-binfmts --enable qemu-aarch64
+          # Sanity check — pi-gen looks for this exact file.
+          ls -la /proc/sys/fs/binfmt_misc/qemu-aarch64
 
       - name: Build Pi image (pi-gen)
         uses: usimd/pi-gen-action@v1