diff --git a/.github/workflows/build-oci.yaml b/.github/workflows/build-oci.yaml
index 99c9aa5..5c0f7f6 100644
--- a/.github/workflows/build-oci.yaml
+++ b/.github/workflows/build-oci.yaml
@@ -60,15 +60,18 @@ jobs:
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: images-out/
-          key: images-${{ matrix.arch }}-${{ hashFiles('images/Dockerfile.*', 'hack/bread-warning.sh', 'hack/banner.txt', 'hack/lazy-apt.sh', 'hack/apt-mirror.sh', 'hack/build_image.sh', format('.stamp/binaries-{0}', matrix.arch)) }}
+          key: images-${{ matrix.arch }}-${{ hashFiles('images/Dockerfile.*', 'hack/bread-warning.sh', 'hack/banner.txt', 'hack/tar-shim.sh', 'hack/lazy-apt.sh', 'hack/apt-mirror.sh', 'hack/build_image.sh', format('.stamp/binaries-{0}', matrix.arch)) }}
 
       - name: Set up qemu (emulated arches only)
         if: matrix.qemu && steps.images-cache.outputs.cache-hit != 'true'
         uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
 
+      # Emulated builds are ~single-core and the per-version chains are
+      # independent, so run them in parallel. Past 2 they only contend for
+      # the runner's cores. -O keeps each image's log whole.
       - name: Bake bread + bread-chisel-releases images for ${{ matrix.arch }}
         if: steps.images-cache.outputs.cache-hit != 'true'
-        run: make build-bread build-bread-chisel-releases ARCH=${{ matrix.arch }}
+        run: make -j2 -O build-bread build-bread-chisel-releases ARCH=${{ matrix.arch }}
 
       - name: Save images as docker-archive tarballs
         if: steps.images-cache.outputs.cache-hit != 'true'
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3ba2964..11e2b50 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -24,12 +24,26 @@ jobs:
     needs: binaries
     uses: ./.github/workflows/build-and-test.yaml
 
-  build-oci:
+  build-oci-native:
     needs: [binaries, build-and-test]
     uses: ./.github/workflows/build-oci.yaml
+    with:
+      matrix: >-
+        [{"runner": "ubuntu-24.04",     "arch": "amd64"},
+         {"runner": "ubuntu-24.04-arm", "arch": "arm64"}]
+
+  # qemu lanes publish untested, so they skip the build-and-test gate and
+  # overlap with it. Publishing still waits on the gated native lanes.
+  build-oci-qemu:
+    needs: binaries
+    uses: ./.github/workflows/build-oci.yaml
+    with:
+      matrix: >-
+        [{"runner": "ubuntu-24.04", "arch": "s390x",   "qemu": true},
+         {"runner": "ubuntu-24.04", "arch": "ppc64le", "qemu": true}]
 
   push-ghcr:
-    needs: build-oci
+    needs: [build-oci-native, build-oci-qemu]
     uses: ./.github/workflows/push-ghcr.yaml
     permissions:
       contents: read
@@ -37,7 +51,7 @@ jobs:
       id-token: write
 
   publish-release:
-    needs: [binaries, build-oci]
+    needs: [binaries, build-oci-native, build-oci-qemu]
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions: