diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 97aeb11..8740bfe 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -41,6 +41,9 @@ jobs:
   app:
     name: app image (timeplus/tpk-app)
     runs-on: ubuntu-latest
+    # A hung buildx (seen once: an arm64 QEMU crash that never returned) must
+    # fail fast, not sit until GitHub's 6h default and end up 'cancelled'.
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v4
 
@@ -102,6 +105,9 @@ jobs:
     # registry secrets are available. PRs skip it.
     if: github.event_name != 'pull_request'
     runs-on: ubuntu-latest
+    # A hung buildx (seen once: an arm64 QEMU crash that never returned) must
+    # fail fast, not sit until GitHub's 6h default and end up 'cancelled'.
+    timeout-minutes: 30
     env:
       TP_REGISTRY_USER: ${{ secrets.TIMEPLUSD_REGISTRY_USERNAME }}
     steps:
diff --git a/deploy/docker/Dockerfile b/deploy/docker/Dockerfile
index aa82435..ad9945b 100644
--- a/deploy/docker/Dockerfile
+++ b/deploy/docker/Dockerfile
@@ -13,7 +13,12 @@
 # builds the app target; docker-compose.allinone.yml builds the allinone target.
 
 # --- shared: React chat UI (so runtime images don't need node) ---------------
-FROM node:22-alpine AS webbuild
+# Built ONCE on the runner's own architecture: the bundle is plain JS/CSS, the
+# same for every target platform. Without --platform=$BUILDPLATFORM buildx runs
+# `npm ci` a second time under arm64 QEMU emulation, which crashed with
+# "qemu: uncaught target signal 4 (Illegal instruction)" on the v0.0.7 release
+# build and hung the job until GitHub's 6h timeout.
+FROM --platform=$BUILDPLATFORM node:22-alpine AS webbuild
 WORKDIR /web
 COPY web/package.json web/package-lock.json ./
 RUN npm ci