diff --git a/.gitea/workflows/publish-container.yml b/.gitea/workflows/publish-container.yml
index b56f462..395d4e7 100644
--- a/.gitea/workflows/publish-container.yml
+++ b/.gitea/workflows/publish-container.yml
@@ -27,32 +27,36 @@ jobs:
 
       - name: Build and push image
         run: |
-          push_image() {
-            local image="$1"
+          docker run --privileged --rm tonistiigi/binfmt --install arm64
+          BUILDER="stun-nat-${GITHUB_RUN_ID}"
+          docker buildx create --driver docker-container --name "$BUILDER" --use
+          trap 'docker buildx rm "$BUILDER"' EXIT
+          docker buildx inspect --bootstrap
+
+          build_and_push() {
             local attempt=1
-            until docker push "$image"; do
+            until docker buildx build --platform linux/amd64,linux/arm64 --pull --push "${TAGS[@]}" .; do
               if [ "$attempt" -ge 3 ]; then
-                echo "Failed to push ${image} after ${attempt} attempts"
+                echo "Failed to build and publish multi-architecture image after ${attempt} attempts"
                 return 1
               fi
               attempt=$((attempt + 1))
-              echo "Push failed; retrying ${image} (${attempt}/3) in 10 seconds"
+              echo "Build or push failed; retrying (${attempt}/3) in 10 seconds"
               sleep 10
             done
           }
 
           SHA_TAG="sha-${GITHUB_SHA}"
-          docker build --pull --tag "${IMAGE}:${SHA_TAG}" .
-          push_image "${IMAGE}:${SHA_TAG}"
+          TAGS=(--tag "${IMAGE}:${SHA_TAG}")
 
           if [ "$GITHUB_REF" = "refs/heads/main" ]; then
-            docker tag "${IMAGE}:${SHA_TAG}" "${IMAGE}:latest"
-            push_image "${IMAGE}:latest"
+            TAGS+=(--tag "${IMAGE}:latest")
           fi
 
           case "$GITHUB_REF" in
             refs/tags/v*)
-              docker tag "${IMAGE}:${SHA_TAG}" "${IMAGE}:${GITHUB_REF_NAME}"
-              push_image "${IMAGE}:${GITHUB_REF_NAME}"
+              TAGS+=(--tag "${IMAGE}:${GITHUB_REF_NAME}")
               ;;
           esac
+
+          build_and_push
diff --git a/README.md b/README.md
index d022690..aa6c4ab 100644
--- a/README.md
+++ b/README.md
@@ -51,10 +51,19 @@ docker compose up -d --build
 
 ## Gitea 镜像构建
 
-`.gitea/workflows/publish-container.yml` 会在推送 `main` 或 `v*` 标签时构建并发布镜像到 `gitea.dddbg.com/youbin/stun-nat`。需要让带有 `ubuntu-latest` 标签、且可执行 Docker 的 Gitea Actions Runner 保持在线。
+`.gitea/workflows/publish-container.yml` 会在推送 `main` 或 `v*` 标签时构建并发布 `linux/amd64` 与 `linux/arm64` 多架构镜像到 `gitea.dddbg.com/youbin/stun-nat`。需要让带有 `ubuntu-latest` 标签、可执行 Docker、且允许特权容器的 Gitea Actions Runner 保持在线。
 
 在仓库的 Actions Secrets 中创建 `REGISTRY_TOKEN`，其值为拥有 Gitea Package 写入权限的个人访问令牌。`main` 构建会发布 `latest` 与 `sha-<commit>` 标签；版本标签还会发布对应的 `v*` 标签。
 
+发布版本时在 `main` 分支创建并推送 Git 标签，例如：
+
+```sh
+git tag -a v1.0 -m "Release v1.0"
+git push origin v1.0
+```
+
+下一次发布使用 `v1.1`。Runner 会使用该标签构建并发布 `gitea.dddbg.com/youbin/stun-nat:v1.0` 或 `:v1.1`，并将 AMD64 与 ARM64 镜像合并为同一个多架构标签。
+
 ## 公网可达性探针
 
 STUN 成功证明映射已建立，但不能单独证明外部入站数据包当前仍可到达。需要严格验证时，将探针部署在与家庭网络不同的公网 VPS：