diff --git a/packaging/flatpak/README.md b/packaging/flatpak/README.md
index 95c9957b..ed309dd3 100644
--- a/packaging/flatpak/README.md
+++ b/packaging/flatpak/README.md
@@ -125,6 +125,32 @@ curl -fsS --user "enricobuehler:$REGISTRY_TOKEN" \
 > home-worker-2 has no flatpak and no passwordless sudo to install it — so the Deck or the
 > privileged CI container are the only two viable build sites.
 
+### aarch64
+
+The manifest builds for aarch64 as well as x86_64. Two things are architecture-specific, and both
+are now expressed properly rather than hardcoded:
+
+* **`PKG_CONFIG_PATH`** contains the runtime's multiarch directory. flatpak-builder does *not*
+  shell-expand `env` values, so `${FLATPAK_ARCH}` would be taken literally — a `build-options.arch`
+  override supplies the aarch64 string instead, inheriting everything else.
+* **The prebuilt Skia archive** is per-target and pinned by sha256. There are now two `type: file`
+  sources discriminated by `only-arches`, both landing on the same `dest-filename`, so
+  `SKIA_BINARIES_URL` stays one literal path. Upstream publishes the aarch64 archive under the
+  same skia commit hash and the same resolved-feature key (`pdf-textlayout-vulkan`), so on a
+  skia-safe bump update both URLs and both hashes together.
+
+```sh
+ARCH=aarch64 bash packaging/flatpak/build-flatpak.sh
+# -> dist/punktfunk-client-<version>-aarch64.flatpak
+```
+
+`ARCH` defaults to this machine's, and the bundle name now carries the architecture so an x86_64
+and an aarch64 build can coexist in `dist/`. This is **not** a cross-compile: flatpak-builder runs
+the build in a sandbox for the target arch, so building aarch64 anywhere but an arm64 machine
+needs qemu binfmt and is very slow. Not yet verified end to end — the manifest is correct by
+construction and the Skia hash was checked against the published archive, but no aarch64 flatpak
+has been built.
+
 ## Manifest
 
 [`io.unom.Punktfunk.yml`](io.unom.Punktfunk.yml). Runtime `org.gnome.Platform//50`
diff --git a/packaging/flatpak/build-flatpak.sh b/packaging/flatpak/build-flatpak.sh
index fb9dcefe..4ce5d2fc 100755
--- a/packaging/flatpak/build-flatpak.sh
+++ b/packaging/flatpak/build-flatpak.sh
@@ -16,6 +16,12 @@
 #                      iteration, non-reproducible). Default: offline (regenerates cargo-sources).
 #   BUILDER=...        override the flatpak-builder invocation (default: auto-detect host
 #                      flatpak-builder, else `flatpak run org.flatpak.Builder`).
+#   ARCH=...           target architecture (default: this machine's). `aarch64` builds the arm64
+#                      client — the manifest carries the per-arch PKG_CONFIG_PATH and the matching
+#                      prebuilt Skia archive. NOTE this is not a cross-compile: flatpak-builder
+#                      runs the build inside a sandbox for that arch, so building aarch64 on an
+#                      x86_64 box needs qemu binfmt registered and is very slow. Run it on an
+#                      arm64 machine.
 set -euo pipefail
 
 ROOTDIR="$(cd "$(dirname "$0")/../.." && pwd)"
@@ -25,7 +31,11 @@ APP_ID="io.unom.Punktfunk"
 MANIFEST="packaging/flatpak/io.unom.Punktfunk.yml"
 VERSION="${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo 0.0.1-dev)}"
 VERSION="${VERSION#v}"
-BUNDLE="dist/punktfunk-client-${VERSION}.flatpak"
+# `flatpak --default-arch` reports flatpak's own name for this machine (x86_64 / aarch64).
+ARCH="${ARCH:-$(flatpak --default-arch 2>/dev/null || uname -m)}"
+# Arch-suffixed so an x86_64 and an aarch64 bundle can sit in dist/ together instead of the
+# second silently overwriting the first. (CI composes its own published filename.)
+BUNDLE="dist/punktfunk-client-${VERSION}-${ARCH}.flatpak"
 
 # --- pick a flatpak-builder (host binary, or the org.flatpak.Builder flatpak on the Deck) ---
 if [ -n "${BUILDER:-}" ]; then
@@ -72,18 +82,19 @@ else
 fi
 
 # --- build into a local ostree repo, then export a single-file bundle --------------------
-echo "==> flatpak-builder ($APP_ID, version $VERSION)"
+echo "==> flatpak-builder ($APP_ID, version $VERSION, arch $ARCH)"
 # --default-branch=stable matches CI / the hosted repo ref, so a locally-built install can also
 # track flatpak.unom.io. build-bundle must then be told the branch (else it defaults to `master`).
 "${FPB[@]}" --user --force-clean --disable-rofiles-fuse \
   --default-branch=stable \
+  --arch="$ARCH" \
   --install-deps-from=flathub \
   "${EXTRA_ARGS[@]}" \
   --repo="$ROOTDIR/.flatpak-repo" \
   "$ROOTDIR/.flatpak-build" "$MANIFEST"
 
 mkdir -p dist
-flatpak build-bundle "$ROOTDIR/.flatpak-repo" "$BUNDLE" "$APP_ID" stable
+flatpak build-bundle --arch="$ARCH" "$ROOTDIR/.flatpak-repo" "$BUNDLE" "$APP_ID" stable
 echo "built $BUNDLE"
 ls -lh "$BUNDLE"
 echo
diff --git a/packaging/flatpak/io.unom.Punktfunk.yml b/packaging/flatpak/io.unom.Punktfunk.yml
index 58545074..2850bf9e 100644
--- a/packaging/flatpak/io.unom.Punktfunk.yml
+++ b/packaging/flatpak/io.unom.Punktfunk.yml
@@ -121,6 +121,14 @@ build-options:
     LIBCLANG_PATH: /usr/lib/sdk/llvm20/lib
     # mold (shipped in rust-stable) speeds the ~450-crate link on the Deck APU.
     RUSTFLAGS: -C link-arg=-fuse-ld=mold
+  # The multiarch directory in PKG_CONFIG_PATH is per-architecture, and flatpak-builder does NOT
+  # shell-expand `env` values — so ${FLATPAK_ARCH} would be taken literally. An `arch` override is
+  # the supported way to vary it; everything else above is inherited. Only the runtime's own
+  # /usr/lib/<triple> changes, so aarch64 differs from x86_64 in exactly this one string.
+  arch:
+    aarch64:
+      env:
+        PKG_CONFIG_PATH: /app/lib/pkgconfig:/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/lib/pkgconfig
 
 modules:
   # ---------------------------------------------------------------------------------------
@@ -240,7 +248,18 @@ modules:
       # crate's pinned skia commit + target + resolved features — when bumping skia-safe, build
       # the workspace once locally and take the new name from
       # target/release/build/skia-bindings-*/out/.cache/, then update url + sha256 together.
+      # One entry per architecture, selected by `only-arches`; both land on the SAME
+      # dest-filename, so SKIA_BINARIES_URL above stays a single literal path. The upstream
+      # release publishes the aarch64 archive under the same skia commit hash and the same
+      # resolved-feature key, so the two stay in lockstep on a skia-safe bump — take both new
+      # names and sha256s together.
       - type: file
+        only-arches: [x86_64]
         url: https://github.com/rust-skia/skia-binaries/releases/download/0.87.0/skia-binaries-e551f334ad5cbdf43abf-x86_64-unknown-linux-gnu-pdf-textlayout-vulkan.tar.gz
         sha256: b46e7061e6b9df792025acaf9b8b90180224c7cec63f4c3ce09af7ddddb8abfa
         dest-filename: skia-binaries.tar.gz
+      - type: file
+        only-arches: [aarch64]
+        url: https://github.com/rust-skia/skia-binaries/releases/download/0.87.0/skia-binaries-e551f334ad5cbdf43abf-aarch64-unknown-linux-gnu-pdf-textlayout-vulkan.tar.gz
+        sha256: 6994fb993064d7d4fff00bf7c79544ffc881bb5441b6768b31cc088540f4bef7
+        dest-filename: skia-binaries.tar.gz