diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
new file mode 100644
index 0000000..e1d6074
--- /dev/null
+++ b/.github/workflows/release.yaml
@@ -0,0 +1,94 @@
+name: Build and Release
+
+on:
+  push:
+    branches:
+      - 'main'
+    tags:
+      - '*'
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  build-rootfs:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        platform: [x64, arm64]
+    container:
+      image: ghcr.io/tiny-webui/image-builder:latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          submodules: true
+
+      - name: Build RootFS
+        run: make image TARGET_PLATFORM=${{ matrix.platform }} -j$(nproc)
+
+      - name: Upload RootFS artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: rootfs-${{ matrix.platform }}
+          path: output/${{ matrix.platform }}/
+
+  publish-container:
+    needs: build-rootfs
+    if: startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download x64 artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: rootfs-x64
+          path: output/x64
+
+      - name: Download arm64 artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: rootfs-arm64
+          path: output/arm64
+
+      - name: Prepare build context
+        run: |
+          # Create symlink for amd64 -> x64 so Docker can find the rootfs
+          # Docker buildx uses 'amd64', but your build system uses 'x64'
+          ln -sf x64 output/amd64
+          ls -R output
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ghcr.io/tiny-webui/tiny-webui
+          tags: |
+            type=ref,event=tag
+            type=raw,value=latest
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
diff --git a/Makefile b/Makefile
index 11f7e28..b270e43 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,8 @@
 EXTERNAL_PATH=external
-EXTERNAL_CONFIG_NAME=tiny-webui-x64_defconfig
+TARGET_PLATFORM?=x64
+EXTERNAL_CONFIG_NAME=tiny-webui-$(TARGET_PLATFORM)_defconfig
+OUTPUT_DIR=output
+IMAGE_OUTPUT_DIR=$(OUTPUT_DIR)/$(TARGET_PLATFORM)
 
 all:docker-image
 
@@ -21,16 +24,23 @@ image:config
 	mkdir -p dl_cache
 	cp -r dl_cache buildroot/dl
 	$(MAKE) -C buildroot 
-	rm -rf output
-	mkdir -p output
-	cp buildroot/output/images/rootfs.tar output
+	rm -rf $(IMAGE_OUTPUT_DIR)
+	mkdir -p $(IMAGE_OUTPUT_DIR)
+	cp buildroot/output/images/rootfs.tar $(IMAGE_OUTPUT_DIR)/
 
 .PHONY:docker-image
-docker-image:image
-	- docker rmi tiny-webui:latest
-	docker build -f docker/Dockerfile -t tiny-webui:latest .
-	docker save tiny-webui:latest -o output/tiny-webui.tar
-	docker rmi tiny-webui:latest
+docker-image:
+	$(MAKE) image
+	$(MAKE) image TARGET_PLATFORM=arm64
+	rm -rf $(OUTPUT_DIR)/amd64
+	ln -sf x64 $(OUTPUT_DIR)/amd64
+	docker buildx create || true
+	docker buildx build \
+		--platform linux/amd64,linux/arm64 \
+		-f docker/Dockerfile \
+		-t tiny-webui:latest \
+		--output type=oci,dest=$(OUTPUT_DIR)/tiny-webui.tar \
+		.
 
 .PHONY:dl_cache
 dl_cache:config
@@ -43,4 +53,4 @@ dl_cache:config
 .PHONY:clean
 clean:
 	$(MAKE) -C buildroot distclean
-	rm -rf output
+	rm -rf $(OUTPUT_DIR)
diff --git a/docker/Dockerfile b/docker/Dockerfile
index f7df6d4..6b504b3 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,6 +1,8 @@
 FROM scratch
 
-ADD output/rootfs.tar /
+ARG TARGETARCH
+
+ADD output/${TARGETARCH}/rootfs.tar /
 
 WORKDIR /
 
diff --git a/external/configs/tiny-webui-arm64_defconfig b/external/configs/tiny-webui-arm64_defconfig
new file mode 100644
index 0000000..f229a8f
--- /dev/null
+++ b/external/configs/tiny-webui-arm64_defconfig
@@ -0,0 +1,33 @@
+BR2_aarch64=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_CCACHE=y
+BR2_OPTIMIZE_S=y
+BR2_PER_PACKAGE_DIRECTORIES=y
+BR2_TARGET_GENERIC_HOSTNAME="tiny-webui"
+BR2_TARGET_GENERIC_ISSUE="Welcome to Tiny-WebUI"
+BR2_INIT_NONE=y
+BR2_ROOTFS_MERGED_USR=y
+BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
+BR2_TARGET_TZ_INFO=y
+BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_TINY_WEBUI_PATH)/overlay"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_TINY_WEBUI_PATH)/scripts/post-build.sh"
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_OPENSSL=y
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_RC2 is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_RC4 is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_MD2 is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_MD4 is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_MDC2 is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_IDEA is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_SEED is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_DES is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_RMD160 is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_WEAK_SSL is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_CAST is not set
+# BR2_PACKAGE_LIBOPENSSL_UNSECURE is not set
+# BR2_PACKAGE_LIBOPENSSL_ENABLE_CMP is not set
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_GZIP_STATIC_MODULE=y
+BR2_PACKAGE_URANDOM_SCRIPTS=y
+BR2_PACKAGE_S6=y