diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml
index 49366a5..d20890f 100644
--- a/.github/workflows/nix.yml
+++ b/.github/workflows/nix.yml
@@ -18,11 +18,23 @@ jobs:
           - nixos-unstable
           - nixos-23.05
           - nixos-23.11
+        system:
+          - x86_64-linux
+          - aarch64-linux
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v25
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+        with:
+          platforms: arm64
+      - uses: DeterminateSystems/nix-installer-action@main
+        with:
+          extra-conf: |
+            extra-platforms = aarch64-linux
+
       - run: nix-shell --run ./ci.sh
         env:
           CI_REGISTRY_AUTH: '${{ secrets.REGISTRY_AUTH }}'
           NIXPKGS_CHANNEL: '${{ matrix.channel }}'
+          NIX_SYSTEM_NAME: '${{ matrix.system }}'
diff --git a/ci.sh b/ci.sh
index 3740aca..d93bbef 100755
--- a/ci.sh
+++ b/ci.sh
@@ -8,6 +8,7 @@ channel=${NIXPKGS_CHANNEL:-nixos-unstable}
 registry=${CI_REGISTRY:-docker.io}
 registry_auth=${CI_REGISTRY_AUTH:-}
 image_prefix=${CI_PROJECT_PATH:-nixpkgs}
+system_name=${NIX_SYSTEM_NAME:-x86_64-linux}
 
 if [[ $channel == nixos-unstable ]]; then
   image_tag=latest
@@ -30,6 +31,7 @@ banner "Building images"
 nix-build \
   --no-out-link \
   --option sandbox true \
+  --argstr system "$system_name"
 
 if [[ $(git rev-parse --abbrev-ref HEAD) != master ]]; then
   banner "Skipping push on non-master branch"
diff --git a/default.nix b/default.nix
index fa9be31..55ea7b5 100644
--- a/default.nix
+++ b/default.nix
@@ -1,4 +1,6 @@
-let
-  pkgs = import ./pkgs.nix;
+{
+  system ? builtins.currentSystem
+}: let
+  pkgs = import ./pkgs.nix system;
 in
 pkgs.docker-nixpkgs
diff --git a/dockerhub-metadata b/dockerhub-metadata
index efe6534..3e8a973 100755
--- a/dockerhub-metadata
+++ b/dockerhub-metadata
@@ -8,9 +8,10 @@ set -euo pipefail
 
 user=$1
 org=${2:-nixpkgs}
+system_name=${NIX_SYSTEM_NAME:-x86_64-linux}
 
 nix_eval() {
-  nix-instantiate --strict --eval --json "$@"
+  nix-instantiate --strict --eval --argstr system "$system_name" --json "$@"
 }
 
 releases_json=$(nix_eval)
diff --git a/pkgs.nix b/pkgs.nix
index 62e5716..be34247 100644
--- a/pkgs.nix
+++ b/pkgs.nix
@@ -1,7 +1,9 @@
+system:
+# docker images run on Linux
+assert builtins.elem system ["x86_64-linux" "aarch64-linux"];
 import <nixpkgs> {
-  # docker images run on Linux
-  system = "x86_64-linux";
   config = { };
+  inherit system;
   overlays = [
     (import ./overlay.nix)
   ];
diff --git a/push-all b/push-all
index 8f9e232..420b0c4 100755
--- a/push-all
+++ b/push-all
@@ -6,8 +6,9 @@ set -euo pipefail
 registry=${1:-docker.io}
 image_prefix=${2:-nixpkgs}
 image_tag=${3:-latest}
+system_name=${NIX_SYSTEM_NAME:-x86_64-linux}
 
-releases_json=$(nix-instantiate --strict --eval --json)
+releases_json=$(nix-instantiate --strict --argstr system "$system_name" --eval --json)
 
 echo "=== Pushing images to $registry"
 
diff --git a/readme-image-matrix b/readme-image-matrix
index 6ed9d55..1789e06 100755
--- a/readme-image-matrix
+++ b/readme-image-matrix
@@ -3,9 +3,11 @@
 # Usage: ./dockerhub-image-matrix
 set -euo pipefail
 
+system_name=${NIX_SYSTEM_NAME:-x86_64-linux}
+
 ## Main ##
 
-releases_json=$(nix-instantiate --strict --eval --json)
+releases_json=$(nix-instantiate --strict --argstr system "$system_name" --eval --json)
 
 echo "| Image / Tag | Pull |"
 echo "| ---         | ---  |"