diff --git a/CHANGELOG.md b/CHANGELOG.md
index f1865b3..7b88e03 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,8 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 ### Changed
 - `test/sample-workflows/docker-login.yml` and `docker-build-push.yml`: now run on the `host` label instead of `ubuntu-latest`. Docker build/push need the runner's bundled Docker CLI and mounted socket, which the `ubuntu-latest` node job container does not provide. Also fixed a doubled image path in the build/push sample (`gitea.repository` already includes the owner).
+- Published `v0.1.0`/`latest` as a **multi-arch** manifest (`linux/amd64` + `linux/arm64`) so it runs on Unraid (amd64) as well as Apple Silicon. The amd64 variant passes the 17/17 smoke test.
+- Unraid docs and compose example: corrected the image path to include the `jason/` owner namespace (`registry.alwisp.com/jason/custom-gitea-runner`), added a required **registry-login** step (the package is private), and recommended the `host` label for Docker build/push jobs (`GITEA_RUNNER_LABELS=…,host:host`).
 
 ### Fixed
 - `docker/runner/Dockerfile`: `COPY` paths for the entrypoint, healthcheck, and smoke-test scripts now resolve from the repo-root build context used by `scripts/build-image.sh` (previously assumed the build context was `docker/runner/`, so the build failed at the `COPY` steps).
diff --git a/docker/compose/docker-compose.example.yml b/docker/compose/docker-compose.example.yml
index 4fa2155..5d114ef 100644
--- a/docker/compose/docker-compose.example.yml
+++ b/docker/compose/docker-compose.example.yml
@@ -7,7 +7,7 @@
 
 services:
   gitea-runner:
-    image: registry.alwisp.com/custom-gitea-runner:v0.1.0  # pin your version here
+    image: registry.alwisp.com/jason/custom-gitea-runner:v0.1.0  # pin your version here (Gitea CR requires the owner namespace)
     container_name: gitea-runner
     restart: unless-stopped
 
@@ -18,7 +18,9 @@ services:
       GITEA_RUNNER_TOKEN: ${GITEA_RUNNER_TOKEN}      # set in .env file
 
       # ── Optional ──────────────────────────────────────────────────────────
-      GITEA_RUNNER_LABELS: ubuntu-latest:docker://node:20-bullseye
+      # `host` runs steps in the runner container (Docker CLI + socket available),
+      # needed for docker build/push. `ubuntu-latest` runs in a clean node container.
+      GITEA_RUNNER_LABELS: ubuntu-latest:docker://node:20-bullseye,host:host
       RUNNER_CONFIG_PATH: /config/runner.yaml
       RUNNER_WORKDIR: /work
       TZ: America/Chicago
diff --git a/docker/compose/unraid-template-notes.md b/docker/compose/unraid-template-notes.md
index 66d2ebb..a0eac21 100644
--- a/docker/compose/unraid-template-notes.md
+++ b/docker/compose/unraid-template-notes.md
@@ -8,13 +8,26 @@ This document covers the recommended Unraid Docker container configuration for t
 
 | Field | Value |
 |---|---|
-| Repository | `registry.alwisp.com/custom-gitea-runner:v0.1.0` |
+| Repository | `registry.alwisp.com/jason/custom-gitea-runner:v0.1.0` |
 | Container name | `gitea-runner` |
 | Network type | `Bridge` |
 | Privileged | `No` (leave unchecked — socket mount handles Docker access) |
 
 ---
 
+## Registry authentication (required — image is private)
+
+The image is published as a **private** package on the Gitea Container Registry, so the Unraid host must authenticate before it can pull it. Do this once via the Unraid terminal (or SSH):
+
+```bash
+docker login registry.alwisp.com -u <gitea-user>
+# password: a Gitea access token with at least read:package scope
+```
+
+Credentials are stored in `/root/.docker/config.json` and persist across container recreations (but not necessarily across a full Unraid reboot if `/root` is on tmpfs — re-run if pulls start failing with `unauthorized`). Alternatively, make the package public in Gitea (Packages → custom-gitea-runner → Settings) to allow unauthenticated pulls.
+
+---
+
 ## Environment variables
 
 Set these in the "Environment Variables" section of the Unraid container template.
@@ -24,7 +37,7 @@ Set these in the "Environment Variables" section of the Unraid container templat
 | `GITEA_INSTANCE_URL` | Yes | `https://git.example.com` |
 | `GITEA_RUNNER_TOKEN` | Yes | Registration token from Gitea admin |
 | `GITEA_RUNNER_NAME` | Yes | e.g. `unraid-runner-01` |
-| `GITEA_RUNNER_LABELS` | No | `ubuntu-latest:docker://node:20-bullseye` |
+| `GITEA_RUNNER_LABELS` | No | `ubuntu-latest:docker://node:20-bullseye,host:host` |
 | `RUNNER_CONFIG_PATH` | No | `/config/runner.yaml` |
 | `RUNNER_WORKDIR` | No | `/work` |
 | `TZ` | No | `America/Chicago` |
@@ -73,3 +86,7 @@ Set these in the "Environment Variables" section of the Unraid container templat
 ## Notes on Docker socket
 
 Mounting `/var/run/docker.sock` gives the runner access to the host Docker daemon. This is intentional for build/push workflows. Understand this means jobs running on this runner can interact with all containers on the Unraid host. For a self-owned, trusted environment this is acceptable. Future hardening options are documented in `docs/architecture.md`.
+
+## Labels: which to use for Docker build/push
+
+`docker build`/`docker push` steps need the bundled Docker CLI and the mounted socket, which only exist in the runner container itself — not inside the `ubuntu-latest` job container (a plain `node` image). Run Docker-centric jobs with `runs-on: host`. Use `ubuntu-latest:docker://…` for jobs that should run in a clean throwaway container. Registering with both labels (`ubuntu-latest:…,host:host`) covers both patterns. This was validated end-to-end against `git.alwisp.com` (see `forgerunner.src/ROADMAP.md` Phase 3).
diff --git a/scripts/publish-image.sh b/scripts/publish-image.sh
index a567d24..db6d930 100755
--- a/scripts/publish-image.sh
+++ b/scripts/publish-image.sh
@@ -25,6 +25,31 @@ LOCAL_TAG="${IMAGE_NAME}:${VERSION}"
 REMOTE_TAG="${REMOTE_REPO}:${VERSION}"
 REMOTE_LATEST="${REMOTE_REPO}:latest"
 
+# PLATFORMS (e.g. "linux/amd64,linux/arm64") triggers a multi-arch buildx build
+# that is pushed directly as a single manifest list. This is the recommended
+# path: Unraid hosts are amd64, so the published image must include amd64 even
+# when built on an arm64 (Apple Silicon) machine. Leave unset for a single-arch
+# tag-and-push of an already-built local image.
+PLATFORMS="${PLATFORMS:-}"
+
+if [ -n "${PLATFORMS}" ]; then
+    VCS_REF="$(git rev-parse --short HEAD 2>/dev/null || echo unknown)"
+    BUILD_DATE="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    echo "Building and pushing multi-arch (${PLATFORMS}) ${REMOTE_TAG} ..."
+    docker buildx build \
+        --platform "${PLATFORMS}" \
+        --build-arg "VERSION=${VERSION}" \
+        --build-arg "VCS_REF=${VCS_REF}" \
+        --build-arg "BUILD_DATE=${BUILD_DATE}" \
+        --tag "${REMOTE_TAG}" \
+        --tag "${REMOTE_LATEST}" \
+        --file docker/runner/Dockerfile \
+        --push \
+        .
+    echo "Published multi-arch: ${REMOTE_TAG} (${PLATFORMS})"
+    exit 0
+fi
+
 echo "Tagging ${LOCAL_TAG} as ${REMOTE_TAG} ..."
 docker tag "${LOCAL_TAG}" "${REMOTE_TAG}"
 docker tag "${LOCAL_TAG}" "${REMOTE_LATEST}"