diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index 95be8b2..98a5028 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -1,6 +1,6 @@
 {
     "name": "linkerd-dev",
-    "image": "ghcr.io/linkerd/dev:v52",
+    "image": "ghcr.io/linkerd/dev:v53",
     "customizations": {
         "vscode": {
             "extensions": [
diff --git a/.github/workflows/devcontainer.yml b/.github/workflows/devcontainer.yml
index 078d7fd..f683d1f 100644
--- a/.github/workflows/devcontainer.yml
+++ b/.github/workflows/devcontainer.yml
@@ -6,18 +6,39 @@ on:
       - .devcontainer/**
       - .github/workflows/devcontainer.yml
       - Dockerfile
+      - bin/just-cargo
       - justfile
 
 permissions:
   contents: read
 
 jobs:
-  dev-build:
-    runs-on: ubuntu-latest
+  # Published images support both architectures, so build each on a native
+  # runner rather than under emulation.
+  dev-build-arch:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            runner: ubuntu-24.04
+          - arch: arm64
+            runner: ubuntu-24.04-arm
+    name: dev-build (${{ matrix.arch }})
+    runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - uses: ./actions/setup-tools
-      - run: just build
+      - run: just docker_arch=linux/${{ matrix.arch }} build
+
+  # Branch protection requires a check named dev-build. always() so that a
+  # failed arch build fails this check rather than skipping it.
+  dev-build:
+    needs: dev-build-arch
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - run: test '${{ needs.dev-build-arch.result }}' = success
 
   dev-shellcheck:
     runs-on: ubuntu-latest
diff --git a/Dockerfile b/Dockerfile
index a96d5b9..d0587c9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -354,11 +354,21 @@ RUN rustup target add \
 RUN --mount=type=cache,from=apt-base,source=/etc/apt,target=/etc/apt,sharing=locked \
     --mount=type=cache,from=apt-base,source=/var/cache/apt,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,from=apt-base,source=/var/lib/apt,target=/var/lib/apt,sharing=locked \
+    dpkg --add-architecture amd64 && \
+    dpkg --add-architecture arm64 && \
+    apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install -y \
         binutils-aarch64-linux-gnu \
-        g++-aarch64-linux-gnu \
+        binutils-x86-64-linux-gnu \
         gcc-aarch64-linux-gnu \
-        libc6-dev-arm64-cross
+        gcc-x86-64-linux-gnu \
+        libc6-dev-arm64-cross \
+        musl-dev:amd64 \
+        musl-dev:arm64
+ARG CLANG_INCLUDE=/usr/lib/llvm-19/lib/clang/19/include
+ENV CFLAGS_aarch64_unknown_linux_musl="-nostdinc -isystem ${CLANG_INCLUDE} -isystem /usr/include/aarch64-linux-musl" \
+    CFLAGS_x86_64_unknown_linux_musl="-nostdinc -isystem ${CLANG_INCLUDE} -isystem /usr/include/x86_64-linux-musl" \
+    CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER=x86_64-linux-gnu-gcc
 
 ##
 ## Devcontainer
diff --git a/actions/setup-tools/action.yml b/actions/setup-tools/action.yml
index 9b7ad6f..647d8a6 100644
--- a/actions/setup-tools/action.yml
+++ b/actions/setup-tools/action.yml
@@ -5,7 +5,7 @@ inputs:
   # TODO(ver): CI should validate at this version matches the most recent release tag
   version:
     description: Container image version
-    default: v52
+    default: v53
 
 runs:
   using: composite