diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml
index 0ce6406657..c7df066d41 100644
--- a/.github/workflows/containers.yml
+++ b/.github/workflows/containers.yml
@@ -7,6 +7,7 @@ on:
     paths:
       - packages/containers/**
       - .github/workflows/containers.yml
+      - package.json
   workflow_dispatch:
 
 permissions:
@@ -24,6 +25,12 @@ jobs:
 
       - uses: ./.github/actions/setup-bun
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Login to GHCR
         uses: docker/login-action@v3
         with:
diff --git a/packages/containers/README.md b/packages/containers/README.md
index 42190f0ba6..a1cfe60db3 100644
--- a/packages/containers/README.md
+++ b/packages/containers/README.md
@@ -16,6 +16,7 @@ Build
 
 ```
 REGISTRY=ghcr.io/anomalyco TAG=24.04 bun ./packages/containers/script/build.ts
+REGISTRY=ghcr.io/anomalyco TAG=24.04 bun ./packages/containers/script/build.ts --push
 ```
 
 Workflow usage
@@ -32,5 +33,6 @@ Notes
 
 - These images only help Linux jobs. macOS and Windows jobs cannot run
   inside Linux containers.
+- `--push` publishes multi-arch (amd64 + arm64) images using Buildx.
 - If a job uses Docker Buildx, the container needs access to the host
   Docker daemon (or `docker-in-docker` with privileged mode).
diff --git a/packages/containers/bun-node/Dockerfile b/packages/containers/bun-node/Dockerfile
index 31a3bb547a..e6cad9c272 100644
--- a/packages/containers/bun-node/Dockerfile
+++ b/packages/containers/bun-node/Dockerfile
@@ -1,6 +1,8 @@
 ARG REGISTRY=ghcr.io/anomalyco
 FROM ${REGISTRY}/build/base:24.04
 
+SHELL ["/bin/bash", "-lc"]
+
 ARG NODE_VERSION=24.4.0
 ARG BUN_VERSION=1.3.5
 
diff --git a/packages/containers/script/build.ts b/packages/containers/script/build.ts
index ff259f2ab8..6b880e7a5b 100644
--- a/packages/containers/script/build.ts
+++ b/packages/containers/script/build.ts
@@ -19,23 +19,59 @@ if (!bun) throw new Error("packageManager must be bun@<version>")
 
 const images = ["base", "bun-node", "rust", "tauri-linux", "publish"]
 
+const setup = async () => {
+  if (!push) return
+  const list = await $`docker buildx ls`.text()
+  if (list.includes("opencode")) {
+    await $`docker buildx use opencode`
+    return
+  }
+  await $`docker buildx create --name opencode --use`
+}
+
+await setup()
+
+const platform = "linux/amd64,linux/arm64"
+
 for (const name of images) {
   const image = `${reg}/build/${name}:${tag}`
   const file = `packages/containers/${name}/Dockerfile`
   if (name === "base") {
-    console.log(`docker build -f ${file} -t ${image} .`)
-    await $`docker build -f ${file} -t ${image} .`
+    if (push) {
+      console.log(`docker buildx build --platform ${platform} -f ${file} -t ${image} --push .`)
+      await $`docker buildx build --platform ${platform} -f ${file} -t ${image} --push .`
+    }
+    if (!push) {
+      console.log(`docker build -f ${file} -t ${image} .`)
+      await $`docker build -f ${file} -t ${image} .`
+    }
   }
   if (name === "bun-node") {
-    console.log(`docker build -f ${file} -t ${image} --build-arg REGISTRY=${reg} --build-arg BUN_VERSION=${bun} .`)
-    await $`docker build -f ${file} -t ${image} --build-arg REGISTRY=${reg} --build-arg BUN_VERSION=${bun} .`
+    if (push) {
+      console.log(
+        `docker buildx build --platform ${platform} -f ${file} -t ${image} --build-arg REGISTRY=${reg} --build-arg BUN_VERSION=${bun} --push .`,
+      )
+      await $`docker buildx build --platform ${platform} -f ${file} -t ${image} --build-arg REGISTRY=${reg} --build-arg BUN_VERSION=${bun} --push .`
+    }
+    if (!push) {
+      console.log(`docker build -f ${file} -t ${image} --build-arg REGISTRY=${reg} --build-arg BUN_VERSION=${bun} .`)
+      await $`docker build -f ${file} -t ${image} --build-arg REGISTRY=${reg} --build-arg BUN_VERSION=${bun} .`
+    }
   }
   if (name !== "base" && name !== "bun-node") {
-    console.log(`docker build -f ${file} -t ${image} --build-arg REGISTRY=${reg} .`)
-    await $`docker build -f ${file} -t ${image} --build-arg REGISTRY=${reg} .`
+    if (push) {
+      console.log(
+        `docker buildx build --platform ${platform} -f ${file} -t ${image} --build-arg REGISTRY=${reg} --push .`,
+      )
+      await $`docker buildx build --platform ${platform} -f ${file} -t ${image} --build-arg REGISTRY=${reg} --push .`
+    }
+    if (!push) {
+      console.log(`docker build -f ${file} -t ${image} --build-arg REGISTRY=${reg} .`)
+      await $`docker build -f ${file} -t ${image} --build-arg REGISTRY=${reg} .`
+    }
   }
 
   if (push) {
-    await $`docker push ${image}`
+    console.log(`pushed ${image}`)
   }
 }