diff --git a/bastion/Dockerfile.bastion b/bastion/Dockerfile.bastion
index a84edf9..6952325 100644
--- a/bastion/Dockerfile.bastion
+++ b/bastion/Dockerfile.bastion
@@ -29,7 +29,9 @@ COPY src/modules/modules/ src/modules/modules/
 RUN pnpm build
 
 # ── Stage 1b: Build iPXE snp.efi (uses UEFI SNP protocol for ISO boot) ──
-FROM fedora:43 AS ipxe-builder
+# Pinned to the build platform: this stage cross-compiles BOTH arch outputs
+# itself, and the iPXE toolchain does not survive qemu-user emulation.
+FROM --platform=$BUILDPLATFORM fedora:43 AS ipxe-builder
 
 RUN dnf install -y git gcc make perl-interpreter xz-devel gcc-aarch64-linux-gnu && dnf clean all
 RUN git clone --depth=1 https://github.com/ipxe/ipxe.git /tmp/ipxe