diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 01b989474df..5746763e8d6 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -14,15 +14,12 @@ jobs:
       # its own shellcheck. This will also make sure that this pipeline runs using
       # the same shellcheck as the ones in Nix shells of developers.
       - name: Install Nix with good defaults
-        uses: input-output-hk/install-nix-action@v20
+        uses: cachix/install-nix-action@v31
         with:
           extra_nix_config: |
             trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
             substituters = https://cache.nixos.org/ https://cache.iog.io/
           nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/install-nix-action@v18
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
       # Make the Nix environment available to next steps
       - uses: rrbutani/use-nix-shell-action@v1
 
diff --git a/.github/workflows/haskell.yml b/.github/workflows/haskell.yml
index adb6ca5f00e..89ef0d1c449 100644
--- a/.github/workflows/haskell.yml
+++ b/.github/workflows/haskell.yml
@@ -49,7 +49,7 @@ jobs:
           - cabal: "3.12"
             ghc: "9.6"
             sys:
-              os: macos-13
+              os: macos-latest
               shell: bash
     defaults:
       run:
diff --git a/.github/workflows/release-ghcr.yaml b/.github/workflows/release-ghcr.yaml
index 1ddd4690344..93e11c8a378 100644
--- a/.github/workflows/release-ghcr.yaml
+++ b/.github/workflows/release-ghcr.yaml
@@ -13,114 +13,200 @@ on:
   # GITHUB_REF: Branch or tag that received dispatch
   workflow_dispatch: {}
 
+permissions:
+  contents: read
+  packages: write
+
 env:
   # Only to avoid some repetition
   FLAKE_REF: github:${{ github.repository }}/${{ github.ref_name }}
   GH_TOKEN: ${{ github.token }}
-  # We need to tell skopeo where to write the authentication token
-  REGISTRY_AUTH_FILE: ./skopeo-registry-auth-file.json
 
 jobs:
   wait-for-hydra:
     name: "Wait for hydra check-runs"
     runs-on: ubuntu-latest
+
     steps:
-    - name: Waiting for ci/hydra-build:required to complete
-      run: |
-        while [[ true ]]; do
-          check_name='ci/hydra-build:required'
-          conclusion=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/check-runs?check_name=$check_name" --paginate --jq '.check_runs[].conclusion')
-          case "$conclusion" in
-            success)
-              echo "$check_name succeeded"
-              exit 0;;
-            '')
-              echo "$check_name pending. Waiting 30s..."
-              sleep 30;;
-            *)
-              echo "$check_name terminated unsuccessfully"
-              exit 1;;
-          esac
-        done
+      - name: Waiting for ci/hydra-build:required to complete
+        run: |
+          while [[ true ]]; do
+            check_name='ci/hydra-build:required'
+            conclusion=$(gh api "repos/$GITHUB_REPOSITORY/commits/$GITHUB_SHA/check-runs?check_name=$check_name" --paginate --jq '.check_runs[].conclusion')
+            case "$conclusion" in
+              success)
+                echo "$check_name succeeded"
+                exit 0;;
+              '')
+                echo "$check_name pending. Waiting 30s..."
+                sleep 30;;
+              *)
+                echo "$check_name terminated unsuccessfully"
+                exit 1;;
+            esac
+          done
+
+
+  prepare:
+    needs: [wait-for-hydra]
+    name: "Prepare metadata"
+    runs-on: ubuntu-latest
+    outputs:
+      LATEST_TAG: ${{ steps.latest-tag.outputs.LATEST_TAG }}
+      LOCKED_URL: ${{ steps.flake-metadata.outputs.LOCKED_URL }}
+
+    steps:
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+
+      - name: Display flake metadata
+        id: flake-metadata
+        run: |
+          nix flake metadata ${{ env.FLAKE_REF }}
+          nix flake metadata ${{ env.FLAKE_REF }} --json | jq -r '"LOCKED_URL=\(.url)"' >> "$GITHUB_OUTPUT"
+
+      - name: Obtaining latest release tag
+        id: latest-tag
+        run: |
+          LATEST_TAG=$(gh api repos/$GITHUB_REPOSITORY/releases/latest --paginate --jq '.tag_name')
+          echo "LATEST_TAG=$LATEST_TAG" >> "$GITHUB_OUTPUT"
+          echo "Latest release tag is: $LATEST_TAG"
+
 
   build:
-    needs: [wait-for-hydra]
+    needs: [prepare]
     name: "Upload to ghcr.io"
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        arch:
+          - name: amd64
+            system: x86_64-linux
+          - name: arm64
+            system: aarch64-linux
+        image:
+          - name: cardano-node
+            nix_key: dockerImage/node
+          - name: cardano-submit-api
+            nix_key: dockerImage/submit-api
+          - name: cardano-tracer
+            nix_key: dockerImage/tracer
+
+    steps:
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # NOTE We assume that hydra has already built the image, this is
+      # reasonable since, before applying the tag, we must have already
+      # pushed the tagged commit somewhere, and Hydra will have had the
+      # change to build the image.
+
+      - name: Uploading ${{ matrix.image.name }} (${{ matrix.arch.name }})
+        run: |
+          echo "::group::Downloading from cache"
+          nix build \
+            --accept-flake-config \
+            --print-out-paths \
+            --builders "" \
+            --max-jobs 0 \
+            --out-link ./result-${{ matrix.image.name }}-${{ matrix.arch.name }} \
+            ${{ needs.prepare.outputs.LOCKED_URL }}#packages.${{ matrix.arch.system }}.${{ matrix.image.nix_key }}
+          echo "::endgroup::"
+
+          echo "::group::Uploading to registry"
+          skopeo copy \
+            docker-archive:./result-${{ matrix.image.name }}-${{ matrix.arch.name }} \
+            docker://ghcr.io/intersectmbo/${{ matrix.image.name }}:$GITHUB_REF_NAME-${{ matrix.arch.name }}
+          echo "::endgroup::"
+
+
+  create-manifest:
+    needs: [prepare, build]
+    name: "Create Multi-Arch Manifest"
+    runs-on: ubuntu-latest
+
     steps:
-    - name: Install Nix
-      uses: input-output-hk/install-nix-action@v20
-
-    - name: Display flake metadata
-      id: flake-metadata
-      run: |
-        nix flake metadata ${{ env.FLAKE_REF }}
-        nix flake metadata ${{ env.FLAKE_REF }} --json | jq -r '"LOCKED_URL=\(.url)"' >> "$GITHUB_OUTPUT"
-
-    - name: Login to GitHub Container Registry
-      run: skopeo login --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} ghcr.io
-
-    # NOTE We assume that hydra has already built the image, this is
-    # reasonable since, before applying the tag, we must have already
-    # pushed the tagged commit somewhere, and Hydra will have had the
-    # change to build the image.
-
-    - name: Uploading intersectmbo/cardano-node
-      run: |
-        echo "::group::Downloading from cache"
-        nix build --accept-flake-config --print-out-paths --builders "" --max-jobs 0 --out-link ./result-node ${{ steps.flake-metadata.outputs.LOCKED_URL }}#dockerImage/node
-        echo "::endgroup::"
-
-        echo "::group::Uploading to registry"
-        skopeo copy docker-archive:./result-node docker://ghcr.io/intersectmbo/cardano-node:$GITHUB_REF_NAME
-        echo "::endgroup::"
-
-    - name: Uploading intersectmbo/cardano-submit-api
-      run: |
-        echo "::group::Downloading from cache"
-        nix build --accept-flake-config --print-out-paths --builders "" --max-jobs 0 --out-link ./result-api ${{ steps.flake-metadata.outputs.LOCKED_URL }}#dockerImage/submit-api
-        echo "::endgroup::"
-
-        echo "::group::Uploading to registry"
-        skopeo copy docker-archive:./result-api docker://ghcr.io/intersectmbo/cardano-submit-api:$GITHUB_REF_NAME
-        echo "::endgroup::"
-
-    - name: Uploading intersectmbo/cardano-tracer
-      run: |
-        echo "::group::Downloading from cache"
-        nix build --accept-flake-config --print-out-paths --builders "" --max-jobs 0 --out-link ./result-tracer ${{ steps.flake-metadata.outputs.LOCKED_URL }}#dockerImage/tracer
-        echo "::endgroup::"
-
-        echo "::group::Uploading to registry"
-        skopeo copy docker-archive:./result-tracer docker://ghcr.io/intersectmbo/cardano-tracer:$GITHUB_REF_NAME
-        echo "::endgroup::"
-
-    - name: Obtaining latest release tag
-      id: latest-tag
-      run: |
-        LATEST_TAG=$(gh api repos/$GITHUB_REPOSITORY/releases/latest --paginate --jq '.tag_name')
-        echo "LATEST_TAG=$LATEST_TAG" >> "$GITHUB_OUTPUT"
-        echo "Latest release tag is: $LATEST_TAG"
-
-    - name: Tagging intersectmbo container latest
-      # Github releases are checked for latest tag in the first `or` operand of
-      # the if statement. However, promoted pre-releases or changed full
-      # releases do not count as a `published` event and so won't trigger
-      # this workflow.  For those use cases a manual workflow must be run
-      # from the matching release tag which the second `or` operand checks
-      # for.
-      if: |
-        (github.event_name == 'release' && github.event.release.tag_name == steps.latest-tag.outputs.LATEST_TAG) ||
-        (github.event_name == 'workflow_dispatch' && github.ref == format('refs/tags/{0}', steps.latest-tag.outputs.LATEST_TAG))
-      run: |
-        echo "::group::Tagging latest for intersectmbo/cardano-node"
-        skopeo copy docker-archive:./result-node docker://ghcr.io/intersectmbo/cardano-node:latest
-        echo "::endgroup::"
-
-        echo "::group::Tagging latest for intersectmbo/cardano-submit-api"
-        skopeo copy docker-archive:./result-api docker://ghcr.io/intersectmbo/cardano-submit-api:latest
-        echo "::endgroup::"
-
-        echo "::group::Tagging latest for intersectmbo/cardano-tracer"
-        skopeo copy docker-archive:./result-tracer docker://ghcr.io/intersectmbo/cardano-tracer:latest
-        echo "::endgroup::"
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+
+      # Regctl simplifies obtaining multi-arch digests
+      - name: Install Nix Profile Commands
+        run: nix profile install nixpkgs#regctl
+
+      # The docker buildx action has a tight coupling with GH runners
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Show buildx configuration
+        run: docker buildx ls
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Create Manifests
+        run: |
+          REPOS=(cardano-node cardano-submit-api cardano-tracer)
+          ARCHES=(amd64 arm64)
+
+          for REPO in "${REPOS[@]}"; do
+            IMAGE_REPO="ghcr.io/intersectmbo/$REPO"
+            DIGESTS=()
+
+            echo "::group::Fetching digests for $REPO"
+            for ARCH in "${ARCHES[@]}"; do
+              DIGEST=$(skopeo inspect --no-tags "docker://$IMAGE_REPO:$GITHUB_REF_NAME-$ARCH" | jq -r .Digest)
+              echo "$REPO $ARCH digest: $DIGEST"
+              DIGESTS+=("$IMAGE_REPO@$DIGEST")
+            done
+            echo "::endgroup::"
+
+            echo "::group::Creating manifest for $REPO:$GITHUB_REF_NAME"
+            docker buildx imagetools create --tag "$IMAGE_REPO:$GITHUB_REF_NAME" "${DIGESTS[@]}"
+            echo "::endgroup::"
+          done
+
+      - name: Verify multi-arch manifests
+        run: |
+          for REPO in cardano-node cardano-submit-api cardano-tracer; do
+            IMAGE_REPO="ghcr.io/intersectmbo/$REPO"
+            echo "::group::Inspecting $REPO:$GITHUB_REF_NAME"
+
+            DIGEST=$(regctl manifest head "$IMAGE_REPO:$GITHUB_REF_NAME")
+            echo "$REPO multi-arch manifest digest: $DIGEST"
+            skopeo inspect --raw "docker://$IMAGE_REPO:$GITHUB_REF_NAME" | jq
+
+            echo "::endgroup::"
+          done
+
+      - name: Tag Containers as :latest
+        # Github releases are checked for latest tag in the first `or` operand of
+        # the if statement. However, promoted pre-releases or changed full
+        # releases do not count as a `published` event and so won't trigger
+        # this workflow.  For those use cases a manual workflow must be run
+        # from the matching release tag which the second `or` operand checks
+        # for.
+        if: |
+          (github.event_name == 'release' && github.event.release.tag_name == needs.prepare.outputs.LATEST_TAG) ||
+          (github.event_name == 'workflow_dispatch' && github.ref == format('refs/tags/{0}', needs.prepare.outputs.LATEST_TAG))
+        run: |
+          REPOS=(cardano-node cardano-submit-api cardano-tracer)
+
+          for REPO in "${REPOS[@]}"; do
+            IMAGE_REPO="ghcr.io/intersectmbo/$REPO"
+            DIGEST=$(regctl manifest head "$IMAGE_REPO:$GITHUB_REF_NAME")
+
+            echo "::group::Creating manifest for $IMAGE_REPO:latest"
+            docker buildx imagetools create --tag "$IMAGE_REPO:latest" "$IMAGE_REPO@$DIGEST"
+            echo "::endgroup::"
+          done
diff --git a/.github/workflows/release-upload.yaml b/.github/workflows/release-upload.yaml
index acd5dee7366..be4d0c28791 100644
--- a/.github/workflows/release-upload.yaml
+++ b/.github/workflows/release-upload.yaml
@@ -2,7 +2,7 @@ name: Post Release Upload
 # This makes it easy to get download release binaries built using
 # a github action for any tagged commit.
 #
-# This workflow builds and uploads the macOS, win64 and linux
+# This workflow builds and uploads the macOS, win and linux
 # binary packages as github assets.
 #
 # It uses `--builders "" --max-jobs 0` to ensure the assets are
@@ -47,12 +47,19 @@ jobs:
     needs: [wait-for-hydra]
     strategy:
       matrix:
-        arch: [linux, macos, win64]
+        arch:
+          - linux-amd64
+          - linux-arm64
+          - macos-amd64
+          - macos-arm64
+          - win-amd64
     name: "Download Asset from the Cache"
     runs-on: ubuntu-latest
+    outputs:
+      node_version: ${{ steps.cardano-node-version.outputs.VERSION }}
     steps:
       - name: Install Nix with good defaults
-        uses: input-output-hk/install-nix-action@v20
+        uses: cachix/install-nix-action@v31
         with:
           extra_nix_config: |
             trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
@@ -63,26 +70,40 @@ jobs:
         run: |
           nix flake metadata ${{ env.FLAKE_REF }}
           nix flake metadata ${{ env.FLAKE_REF }} --json | jq -r '"LOCKED_URL=\(.url)"' >> "$GITHUB_OUTPUT"
+      - name: Display cardano-node version
+        id: cardano-node-version
+        run: |
+          VERSION=$(nix eval --raw ${{ steps.flake-metadata.outputs.LOCKED_URL }}#legacyPackages.x86_64-linux.cardanoNodePackages.cardano-node.identifier.version)
+          echo "$VERSION"
+          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
       - name: Build
         run: |
           case ${{ matrix.arch }} in
-            linux)
+            linux-amd64)
               nix build --builders "" --max-jobs 0 ${{ steps.flake-metadata.outputs.LOCKED_URL }}#hydraJobs.x86_64-linux.musl.cardano-node-linux
-              cp result/cardano-node-*-*.tar.gz .
+              cp result/cardano-node-*-*.tar.gz cardano-node-${{ steps.cardano-node-version.outputs.VERSION }}-linux-amd64.tar.gz
+              ;;
+            linux-arm64)
+              nix build --builders "" --max-jobs 0 ${{ steps.flake-metadata.outputs.LOCKED_URL }}#hydraJobs.aarch64-linux.musl.cardano-node-linux
+              cp result/cardano-node-*-*.tar.gz cardano-node-${{ steps.cardano-node-version.outputs.VERSION }}-linux-arm64.tar.gz
               ;;
-            macos)
+            macos-amd64)
               nix build --builders "" --max-jobs 0 ${{ steps.flake-metadata.outputs.LOCKED_URL }}#hydraJobs.x86_64-darwin.native.cardano-node-macos
-              cp result/cardano-node-*-*.tar.gz .
+              cp result/cardano-node-*-*.tar.gz cardano-node-${{ steps.cardano-node-version.outputs.VERSION }}-macos-amd64.tar.gz
+              ;;
+            macos-arm64)
+              nix build --builders "" --max-jobs 0 ${{ steps.flake-metadata.outputs.LOCKED_URL }}#hydraJobs.aarch64-darwin.native.cardano-node-macos
+              cp result/cardano-node-*-*.tar.gz cardano-node-${{ steps.cardano-node-version.outputs.VERSION }}-macos-arm64.tar.gz
               ;;
-            win64)
-              nix build --builders "" --max-jobs 0 ${{ steps.flake-metadata.outputs.LOCKED_URL }}#hydraJobs.x86_64-linux.windows.cardano-node-win64
-              cp result/cardano-node-*-*.zip .
+            win-amd64)
+              nix build --builders "" --max-jobs 0 ${{ steps.flake-metadata.outputs.LOCKED_URL }}#hydraJobs.x86_64-linux.windows.cardano-node-win
+              cp result/cardano-node-*-*.zip cardano-node-${{ steps.cardano-node-version.outputs.VERSION }}-win-amd64.zip
               ;;
           esac
       - uses: actions/upload-artifact@v4
         with:
           name: ${{ github.sha }}-${{ matrix.arch }}
-          path: cardano-node-*-*.*
+          path: cardano-node-*-*-*.*
           retention-days: 1
 
   upload-assets:
@@ -90,24 +111,21 @@ jobs:
     name: "Upload Assets"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v5
         with:
           merge-multiple: true
       - name: Checksums
         run: |
-          # find returns something like this:
-          # "cardano-node-8.11.0-linux.tar.gz cardano-node-8.11.0-macos.tar.gz ..."
-          # We use the first member of this list to compute the prefix "cardano-node-8.11.0"
-          first_archive=$(find . -maxdepth 1 -name "cardano-node-*" -printf '%P\n' | head -n 1)
-          # Then we trim the architecture-specific suffix (last "-" and after)
-          sha256sums_filename=$(echo "${first_archive%-*}-sha256sums.txt")
-          sha256sum cardano-node-* >> "$sha256sums_filename"
+          sha256sums_filename="cardano-node-${{ needs.pull.outputs.node_version }}-sha256sums.txt"
+          sha256sum cardano-node-*-*-* > "$sha256sums_filename"
       - name: Release
         uses: input-output-hk/action-gh-release@v1
         with:
           draft: true
           files: |
-            cardano-node-*-win64.zip
-            cardano-node-*-macos.tar.gz
-            cardano-node-*-linux.tar.gz
+            cardano-node-*-linux-amd64.tar.gz
+            cardano-node-*-linux-arm64.tar.gz
+            cardano-node-*-macos-amd64.tar.gz
+            cardano-node-*-macos-arm64.tar.gz
             cardano-node-*-sha256sums.txt
+            cardano-node-*-win-amd64.zip
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index a77d2d54bc5..833c2058d5a 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -16,15 +16,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install Nix with good defaults
-        uses: input-output-hk/install-nix-action@v20
+        uses: cachix/install-nix-action@v31
         with:
           extra_nix_config: |
             trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
             substituters = https://cache.nixos.org/ https://cache.iog.io/
           nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/install-nix-action@v18
-        with:
-          nix_path: nixpkgs=channel:nixos-unstable
       # Make the Nix environment available to next steps
       - uses: rrbutani/use-nix-shell-action@v1
       - name: shellcheck
diff --git a/flake.lock b/flake.lock
index a7221e03239..4011f7d96a8 100644
--- a/flake.lock
+++ b/flake.lock
@@ -104,6 +104,7 @@
     "cardano-automation": {
       "inputs": {
         "flake-utils": "flake-utils",
+        "hackageNix": "hackageNix",
         "haskellNix": [
           "haskellNix"
         ],
@@ -112,11 +113,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750923974,
-        "narHash": "sha256-PXB1aro2KalRw6OZkcbICl6Ge7HB4yEl5O3epm9VZl8=",
+        "lastModified": 1764682512,
+        "narHash": "sha256-yY3yIBmiCKsZ7YN++ttEKZiVMIHjjlAngFWaTGvBBvg=",
         "owner": "input-output-hk",
         "repo": "cardano-automation",
-        "rev": "64bf80a78102787790bac96075ef4109ff7de36e",
+        "rev": "9a91636c94317bff98ebf6b913f8c38beef0b374",
         "type": "github"
       },
       "original": {
@@ -287,6 +288,22 @@
       }
     },
     "hackageNix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1759154585,
+        "narHash": "sha256-OC5Y3E20bwkfMVlB2uhf7eF/FcuC1JD/BXkxR8rMjR4=",
+        "owner": "input-output-hk",
+        "repo": "hackage.nix",
+        "rev": "7e61ac3eb4cc042b37c6511b65984f59fe6d40de",
+        "type": "github"
+      },
+      "original": {
+        "owner": "input-output-hk",
+        "repo": "hackage.nix",
+        "type": "github"
+      }
+    },
+    "hackageNix_2": {
       "flake": false,
       "locked": {
         "lastModified": 1761265459,
@@ -787,7 +804,7 @@
         "em": "em",
         "empty-flake": "empty-flake",
         "flake-compat": "flake-compat",
-        "hackageNix": "hackageNix",
+        "hackageNix": "hackageNix_2",
         "haskellNix": "haskellNix",
         "incl": "incl",
         "iohkNix": "iohkNix",
diff --git a/flake.nix b/flake.nix
index 7f824a87a0a..e178ecdb536 100644
--- a/flake.nix
+++ b/flake.nix
@@ -229,7 +229,7 @@
       packages =
         exes
         # Linux only packages:
-        // optionalAttrs (system == "x86_64-linux")
+        // optionalAttrs (elem system ["x86_64-linux" "aarch64-linux"])
         (let
           workbenchTest = {
             profileName,
@@ -323,7 +323,7 @@
           {
             cardano-deployment = pkgs.cardanoLib.mkConfigHtml {inherit (pkgs.cardanoLib.environments) mainnet preview preprod;};
           }
-          // optionalAttrs (system == "x86_64-linux") {
+          // optionalAttrs (elem system ["x86_64-linux" "aarch64-linux"]) {
             native =
               packages
               // {
@@ -343,7 +343,10 @@
                 variants = mapAttrs (_: v: removeAttrs v.native ["variants"]) ciJobsVariants;
               };
             musl = let
-              muslProject = project.projectCross.musl64;
+              muslProject =
+                if system == "x86_64-linux"
+                then project.projectCross.musl64
+                else project.projectCross.aarch64-multiplatform-musl;
               projectExes = collectExes muslProject;
             in
               projectExes
@@ -359,6 +362,11 @@
                 internal.roots.project = muslProject.roots;
                 variants = mapAttrs (_: v: removeAttrs v.musl ["variants"]) ciJobsVariants;
               };
+          }
+          # Compiling windows on aarch64-linux requires aarch64 wine64 for TH code.
+          # Currently github:NixOS/nixpkgs/nixpkgs-unstable#legacyPackages.aarch64-linux.wine64 does not build.
+          # Once building, windowsProject candidate for win-arm64 is project.projectCross.ucrtAarch64.
+          // optionalAttrs (elem system ["x86_64-linux"]) {
             windows = let
               windowsProject = project.projectCross.mingwW64;
               projectExes = collectExes windowsProject;
@@ -366,10 +374,10 @@
               projectExes
               // (removeRecurse {
                 inherit (windowsProject) checks tests benchmarks;
-                cardano-node-win64 = import ./nix/binary-release.nix {
+                cardano-node-win = import ./nix/binary-release.nix {
                   inherit pkgs;
                   inherit (exes.cardano-node.identifier) version;
-                  platform = "win64";
+                  platform = "win";
                   exes = collect isDerivation (
                     filterAttrs (n: _: elem n releaseBins) projectExes
                   );
@@ -378,7 +386,7 @@
                 variants = mapAttrs (_: v: removeAttrs v.windows ["variants"]) ciJobsVariants;
               });
           }
-          // optionalAttrs (system == "x86_64-darwin" || system == "aarch64-darwin") {
+          // optionalAttrs (elem system ["x86_64-darwin" "aarch64-darwin"]) {
             native =
               filterAttrs
               (n: _:
diff --git a/nix/binary-release.nix b/nix/binary-release.nix
index e6309707d42..8a5e68bb5cc 100644
--- a/nix/binary-release.nix
+++ b/nix/binary-release.nix
@@ -119,7 +119,7 @@ in pkgs.runCommand name {
     rewrite-libs bin ${exe}/bin/*
   '') exes)}
 
-  ${if (platform == "win64")
+  ${if (platform == "win")
     then "zip -r $out/${name}.zip ."
     else "tar -czf $out/${name}.tar.gz ."
   }
diff --git a/nix/haskell.nix b/nix/haskell.nix
index 1454f10ac57..15650924eff 100644
--- a/nix/haskell.nix
+++ b/nix/haskell.nix
@@ -21,7 +21,7 @@ let
     {
       src = ../.;
       name = "cardano-node";
-      compiler-nix-name = lib.mkDefault "ghc966";
+      compiler-nix-name = lib.mkDefault "ghc967";
       # Extra-compilers
       # flake.variants = lib.genAttrs ["ghc$VERSION"] (x: {compiler-nix-name = x;});
       cabalProjectLocal = ''
diff --git a/nix/supported-systems.nix b/nix/supported-systems.nix
index d0c8517b84b..db92fb82c99 100644
--- a/nix/supported-systems.nix
+++ b/nix/supported-systems.nix
@@ -1 +1 @@
-[ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ]
+[ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" ]