diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ffb6b9e1e..b4eaeecf4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,8 +14,7 @@ jobs:
         # zstd for faster actions/cache
         # tar needed for actions/cache (busybox tar is incompatible)
         # git for a native checkout (also needed in tests)
-        # jansson is here until we move to prebuilt ctags binaries (TODO: remove)
-        run: apk add zstd git tar jansson
+        run: apk add zstd git tar
 
       - name: checkout
         uses: actions/checkout@v7
@@ -29,12 +28,14 @@ jobs:
       - name: Cache ctags
         uses: actions/cache@v6
         with:
-          path: /usr/local/bin/universal-ctags
+          path: |
+            /usr/bin/ctags
+            /usr/bin/universal-ctags
           key: ${{ runner.os }}-ctags-${{ hashFiles('install-ctags-alpine.sh') }}
 
       - name: install ctags
         run: |
-          if [ ! -f /usr/local/bin/universal-ctags ]; then
+          if [ ! -f /usr/bin/ctags ]; then
             ./install-ctags-alpine.sh
           fi
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d52ce0c02..1029a095a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -11,6 +11,7 @@ on:
 jobs:
   docker:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
@@ -24,6 +25,9 @@ jobs:
         id: version
         run: .github/workflows/docker-version.sh
 
+      - name: setup-qemu
+        uses: docker/setup-qemu-action@v4
+
       - name: setup-buildx
         uses: docker/setup-buildx-action@v4
 
@@ -50,6 +54,7 @@ jobs:
         uses: docker/build-push-action@v7
         with:
           context: .
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
diff --git a/Dockerfile b/Dockerfile
index 97bce12f8..2fc234341 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,9 @@
 # syntax=docker/dockerfile:1.7
-FROM golang:1.26.5-alpine AS builder
+# Build on the native host arch and cross-compile; avoid QEMU for `go build`.
+FROM --platform=$BUILDPLATFORM golang:1.26.5-alpine AS builder
+
+ARG TARGETOS
+ARG TARGETARCH
 
 RUN apk add --no-cache ca-certificates
 
@@ -16,20 +20,20 @@ ARG VERSION=dev
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     mkdir -p /out && \
-    go build \
-      -trimpath \
-      -ldflags "-X github.com/sourcegraph/zoekt.Version=$VERSION" \
-      -o /out/ \
-      ./cmd/...
+    GOOS="$TARGETOS" GOARCH="$TARGETARCH" go build \
+    -trimpath \
+    -ldflags "-X github.com/sourcegraph/zoekt.Version=$VERSION" \
+    -o /out/ \
+    ./cmd/...
 
 FROM alpine:3
 
-RUN apk add --no-cache git ca-certificates bind-tools tini jansson wget
+RUN apk add --no-cache git ca-certificates bind-tools tini
 
 COPY --chmod=755 install-ctags-alpine.sh /usr/local/bin/install-ctags-alpine.sh
-RUN /usr/local/bin/install-ctags-alpine.sh && \
-    rm /usr/local/bin/install-ctags-alpine.sh \
-      /usr/local/bin/universal-optscript
+ARG TARGETARCH
+RUN TARGETARCH="$TARGETARCH" /usr/local/bin/install-ctags-alpine.sh && \
+    rm /usr/local/bin/install-ctags-alpine.sh
 
 RUN addgroup -S zoekt && \
     adduser -S -G zoekt -h /home/zoekt zoekt && \
diff --git a/install-ctags-alpine.sh b/install-ctags-alpine.sh
index ae0cfcc93..d395cd116 100755
--- a/install-ctags-alpine.sh
+++ b/install-ctags-alpine.sh
@@ -1,50 +1,44 @@
 #!/bin/sh
 
-# This script installs universal-ctags within an alpine container.
-
-# Commit hash of github.com/universal-ctags/ctags.
-# Last bumped 2024-09-02.
-CTAGS_VERSION=v6.1.0
-CTAGS_ARCHIVE_TOP_LEVEL_DIR=ctags-6.1.0
-# When using commits you can rely on
-# CTAGS_ARCHIVE_TOP_LEVEL_DIR=ctags-$CTAGS_VERSION
-
-CTAGS_TMPDIR=
-
-cleanup() {
-  apk --no-cache --purge del ctags-build-deps || true
-  cd /
-  if [ -n "$CTAGS_TMPDIR" ]; then
-    rm -rf "$CTAGS_TMPDIR"
-  fi
-}
-
-trap cleanup EXIT
+# Installs universal-ctags from prebuilt Linux tarballs (amd64/arm64).
+# Zoekt looks up "universal-ctags" on PATH; the tarball installs "ctags".
+#
+# When bumping CTAGS_VERSION, update CTAGS_COMMIT and the sha256 sums below
+# together from the release page/API:
+# https://github.com/universal-ctags/ctags-nightly-build/releases
+
+CTAGS_VERSION=2024.01.07
+CTAGS_COMMIT=4053f69a35d8d3d307b274040f27c147eec79ee7
+# GitHub release asset digests for uctags-${CTAGS_VERSION}-linux-*.tar.xz
+CTAGS_TAR_SHA256_X86_64=0c0bbc9f81d3f7151988b94e78c64914ab41ee4c5e10debfe79f73fee54a68a0
+CTAGS_TAR_SHA256_AARCH64=a50e25cb5b4ced8fea119984695e77464aaa73d5d4a53c10fec34dd82b1d9e5f
 
 set -eux
 
-apk --no-cache add \
-  --virtual ctags-build-deps \
-  autoconf \
-  automake \
-  binutils \
-  curl \
-  g++ \
-  gcc \
-  jansson-dev \
-  make \
-  pkgconfig
-
-# ctags is dynamically linked against jansson
-apk --no-cache add jansson
-
-NUMCPUS=$(grep -c '^processor' /proc/cpuinfo)
-CTAGS_TMPDIR=$(mktemp -d /tmp/ctags.XXXXXX)
-
-# Installation
-curl --retry 5 "https://codeload.github.com/universal-ctags/ctags/tar.gz/$CTAGS_VERSION" | tar xz -C "$CTAGS_TMPDIR"
-cd "$CTAGS_TMPDIR/$CTAGS_ARCHIVE_TOP_LEVEL_DIR"
-./autogen.sh
-./configure --program-prefix=universal- --enable-json --disable-readcmd
-make -j"$NUMCPUS" --load-average="$NUMCPUS"
-make install
+apk add --no-cache xz
+
+case "${TARGETARCH:-$(uname -m)}" in
+  amd64 | x86_64)
+    ctags_arch=x86_64
+    tar_sha256=$CTAGS_TAR_SHA256_X86_64
+    ;;
+  arm64 | aarch64)
+    ctags_arch=aarch64
+    tar_sha256=$CTAGS_TAR_SHA256_AARCH64
+    ;;
+  *) echo "unsupported architecture: ${TARGETARCH:-$(uname -m)}" >&2; exit 1 ;;
+esac
+
+archive_name="uctags-${CTAGS_VERSION}-linux-${ctags_arch}.tar.xz"
+extract_dir="uctags-${CTAGS_VERSION}-linux-${ctags_arch}"
+base_url="https://github.com/universal-ctags/ctags-nightly-build/releases/download/${CTAGS_VERSION}%2B${CTAGS_COMMIT}"
+archive_path="/tmp/${archive_name}"
+
+wget -qO "$archive_path" "${base_url}/${archive_name}"
+
+echo "$tar_sha256  $archive_path" | sha256sum -c -
+tar -xJf "$archive_path" -C /tmp
+install -m 0755 "/tmp/${extract_dir}/bin/ctags" /usr/bin/ctags
+rm -rf "$archive_path" "/tmp/${extract_dir}"
+
+ln -sf /usr/bin/ctags /usr/bin/universal-ctags