diff --git a/ipabusedb-docker-reporter/Makefile b/ipabusedb-docker-reporter/Makefile
index 5a5a1c8..102771f 100644
--- a/ipabusedb-docker-reporter/Makefile
+++ b/ipabusedb-docker-reporter/Makefile
@@ -2,17 +2,39 @@ BIN := ipabusedb-docker-reporter
 IMAGE := git.eeqj.de/sneak/$(BIN)
 TAG := $(shell date -u +%Y-%m-%d)
 
-.PHONY: build test lint fmt fmt-check check clean image push
+# Each arch is built natively on a daemon of that arch: arm64 on the local
+# daemon, amd64 on fsn1app1. Override on the command line if needed.
+ARCHES := amd64 arm64
+DOCKER_HOST_amd64 ?= ssh://root@fsn1app1
+DOCKER_HOST_arm64 ?=
+docker_for = $(if $(DOCKER_HOST_$(1)),DOCKER_HOST=$(DOCKER_HOST_$(1))) docker
+
+.PHONY: build test lint fmt fmt-check check clean image push manifest \
+	$(ARCHES:%=image-%) $(ARCHES:%=push-%)
 
 build:
 	go build -o $(BIN) .
 
+# Local image for this machine's arch, for testing.
 image:
-	docker build -t $(BIN) -t $(IMAGE):$(TAG) -t $(IMAGE):latest .
+	docker build -t $(BIN) .
 
-push: image
-	docker push $(IMAGE):$(TAG)
-	docker push $(IMAGE):latest
+# image-ARCH builds on that arch's daemon; push-ARCH pushes the arch tag.
+define arch_rules
+image-$(1):
+	$$(call docker_for,$(1)) build --platform linux/$(1) -t $$(IMAGE):$(1) .
+
+push-$(1): image-$(1)
+	$$(call docker_for,$(1)) push $$(IMAGE):$(1)
+endef
+$(foreach a,$(ARCHES),$(eval $(call arch_rules,$(a))))
+
+# Join the per-arch tags into the dated and latest multi-arch manifests.
+manifest:
+	docker buildx imagetools create -t $(IMAGE):$(TAG) -t $(IMAGE):latest \
+		$(ARCHES:%=$(IMAGE):%)
+
+push: $(ARCHES:%=push-%) manifest
 
 test:
 	go test ./...
diff --git a/ipabusedb-docker-reporter/README.md b/ipabusedb-docker-reporter/README.md
index 66c4ae4..0d4e5b4 100644
--- a/ipabusedb-docker-reporter/README.md
+++ b/ipabusedb-docker-reporter/README.md
@@ -78,11 +78,15 @@ socket.
 | `IPABUSEDB_API_KEY`     | AbuseIPDB API key (required)                       |
 | `INTERVAL`              | seconds between runs, and the report window (1200) |
 
-`make image` builds the image, tagged locally as
-`ipabusedb-docker-reporter` and as
-`git.eeqj.de/sneak/ipabusedb-docker-reporter` with today's date and
-`latest`. `make push` builds and pushes both registry tags (log in once
-with `docker login git.eeqj.de`).
+`make image` builds a local image tagged `ipabusedb-docker-reporter` for
+this machine's architecture. `make push` builds `linux/amd64` and
+`linux/arm64` natively, each on a daemon of that architecture (arm64 on
+the local daemon, amd64 on `fsn1app1` via `DOCKER_HOST`; override
+`DOCKER_HOST_amd64` and `DOCKER_HOST_arm64` on the command line), pushes
+the per-arch tags, and joins them into
+`git.eeqj.de/sneak/ipabusedb-docker-reporter` tagged with today's UTC date
+and `latest`. Log in once with `docker login git.eeqj.de`; the client
+forwards the credentials to the remote daemon.
 
 ```
 $ make push