diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e5404d9b..674a4f7b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,9 +8,6 @@ on:
 jobs:
   release:
     runs-on: ubuntu-latest
-    env:
-      # https://goreleaser.com/customization/docker_manifest/
-      DOCKER_CLI_EXPERIMENTAL: "enabled"
     steps:
       - name: Code checkout
         uses: actions/checkout@v5
@@ -40,9 +37,12 @@ jobs:
         with:
           go-version: 1.26.5
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v4
+        uses: goreleaser/goreleaser-action@v6
         with:
-          version: latest
+          # Pinned deliberately: an unpinned "latest" means every tag push builds
+          # with whatever GoReleaser shipped that morning, and a breaking change
+          # surfaces mid-release, after the tag exists.
+          version: "v2.17.1"
           args: release -f build/.goreleaser.yaml --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/build/.goreleaser.yaml b/build/.goreleaser.yaml
index 82ac9cdc..ff4ecc9e 100644
--- a/build/.goreleaser.yaml
+++ b/build/.goreleaser.yaml
@@ -70,7 +70,7 @@ builds:
       - arm64
 
 archives:
-  - format: tar.gz
+  - formats: [tar.gz]
     # this name template makes the OS and Arch compatible with the results of `uname`.
     name_template: >-
       {{ .ProjectName }}_
@@ -79,10 +79,6 @@ archives:
       {{- else if eq .Arch "386" }}i386
       {{- else }}{{ .Arch }}{{ end }}
       {{- if .Arm }}v{{ .Arm }}{{ end }}
-    # use zip for windows archives
-    format_overrides:
-      - goos: windows
-        format: zip
 
 changelog:
   sort: asc
@@ -91,53 +87,33 @@ changelog:
       - "^docs:"
       - "^test:"
 
-dockers:
-  - goos: linux
-    goarch: amd64
+dockers_v2:
+  - images:
+      - "hookdeck/outpost"
+    tags:
+      - "{{ .Tag }}"
+      - "latest"
     dockerfile: ./build/Dockerfile.goreleaser
     ids:
       - outpost
-      - outpost-server
-    extra_files:
-      - build/entrypoint.sh
-    image_templates:
-      - "hookdeck/outpost:latest-amd64"
-      - "hookdeck/outpost:{{ .Tag }}-amd64"
-    build_flag_templates:
-      - "--pull"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.name={{.ProjectName}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=repository=https://github.com/hookdeck/outpost"
-      - "--label=homepage=https://hookdeck.com"
-      - "--platform=linux/amd64"
-  - goos: linux
-    goarch: arm64
-    dockerfile: ./build/Dockerfile.goreleaser
-    ids:
       - outpost-arm64
+      - outpost-server
       - outpost-server-arm64
     extra_files:
       - build/entrypoint.sh
-    image_templates:
-      - "hookdeck/outpost:latest-arm64"
-      - "hookdeck/outpost:{{ .Tag }}-arm64"
-    build_flag_templates:
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    # No attestations, so the manifest keeps the same two platform entries as
+    # today. Takes both switches — buildx adds provenance on its own.
+    sbom: false
+    flags:
       - "--pull"
-      - "--label=org.opencontainers.image.created={{.Date}}"
-      - "--label=org.opencontainers.image.name={{.ProjectName}}"
-      - "--label=org.opencontainers.image.revision={{.FullCommit}}"
-      - "--label=org.opencontainers.image.version={{.Version}}"
-      - "--label=repository=https://github.com/hookdeck/outpost"
-      - "--label=homepage=https://hookdeck.com"
-      - "--platform=linux/arm64/v8"
-docker_manifests:
-  - name_template: "hookdeck/outpost:latest"
-    image_templates:
-      - "hookdeck/outpost:latest-amd64"
-      - "hookdeck/outpost:latest-arm64"
-  - name_template: "hookdeck/outpost:{{ .Tag }}"
-    image_templates:
-      - "hookdeck/outpost:{{ .Tag }}-amd64"
-      - "hookdeck/outpost:{{ .Tag }}-arm64"
+      - "--provenance=false"
+    labels:
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.name: "{{ .ProjectName }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
+      org.opencontainers.image.version: "{{ .Version }}"
+      repository: "https://github.com/hookdeck/outpost"
+      homepage: "https://hookdeck.com"
diff --git a/build/Dockerfile.goreleaser b/build/Dockerfile.goreleaser
index a02a38b9..3c782cc6 100644
--- a/build/Dockerfile.goreleaser
+++ b/build/Dockerfile.goreleaser
@@ -5,9 +5,11 @@ FROM gcr.io/distroless/base-debian13:nonroot
 # Copy statically linked shell from busybox for entrypoint script
 COPY --from=busybox /bin/sh /bin/sh
 
-# Copy all binaries
-COPY outpost /usr/local/bin/outpost
-COPY outpost-server /usr/local/bin/outpost-server
+# Copy all binaries. GoReleaser stages each platform's artifacts under
+# $TARGETPLATFORM/ in the build context, since one buildx build covers both arches.
+ARG TARGETPLATFORM
+COPY $TARGETPLATFORM/outpost /usr/local/bin/outpost
+COPY $TARGETPLATFORM/outpost-server /usr/local/bin/outpost-server
 
 # Copy entrypoint script
 COPY build/entrypoint.sh /usr/local/bin/entrypoint.sh