diff --git a/.gitea/workflows/build-kernel.yml b/.gitea/workflows/build-kernel.yml
index b57019a..e53cdbd 100644
--- a/.gitea/workflows/build-kernel.yml
+++ b/.gitea/workflows/build-kernel.yml
@@ -38,7 +38,28 @@ jobs:
         env:
           HEADERS_PKG: ${{ env.HEADERS_PKG }}
           KERNEL_VERSION: ${{ matrix.kernel_version }}
-        run: ./build-in-docker.sh
+        run: |
+          set -eux
+          # arm64 emulation for the builder image (no-op if already registered).
+          if [ ! -e /proc/sys/fs/binfmt_misc/qemu-aarch64 ]; then
+            docker run --privileged --rm tonistiigi/binfmt --install arm64
+          fi
+          # Builder image: toolchain + matching raspberrypi kernel headers.
+          docker build --platform linux/arm64 \
+            --build-arg HEADERS_PKG="$HEADERS_PKG" \
+            --build-arg KERNEL_VERSION="$KERNEL_VERSION" \
+            -t iec-kbuild .
+          # Compile inside the container. We use `docker cp` instead of the bind
+          # mount that build-in-docker.sh uses for local builds: under the runner's
+          # docker-in-docker, /workspace is a volume the host daemon can't see, so
+          # `-v "$PWD:/build"` mounts an empty dir and make finds no Makefile.
+          cid=$(docker create --platform linux/arm64 --entrypoint sleep iec-kbuild infinity)
+          docker start "$cid"
+          docker cp ./. "$cid:/build"
+          docker exec "$cid" /usr/local/bin/docker-entrypoint.sh clean
+          docker exec "$cid" /usr/local/bin/docker-entrypoint.sh
+          docker cp "$cid:/build/iec_listener.ko" ./iec_listener.ko
+          docker rm -f "$cid"
 
       - name: Stage build output (modules/iec_listener_<kernel_version>.ko)
         working-directory: kernel