diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index 771327f608ef..2683d88cd276 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -20,12 +20,18 @@ jobs:
     defaults:
       run:
         working-directory: codex-rs
+    env:
+      # Match upstream openai/codex release builds: thin LTO keeps Ubuntu ARM64
+      # release builds within the hosted runner timeout.
+      CARGO_PROFILE_RELEASE_LTO: thin
     strategy:
       fail-fast: false
       matrix:
         include:
           - runner: ubuntu-24.04
             target: x86_64-unknown-linux-musl
+          - runner: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-musl
           - runner: macos-15-intel
             target: x86_64-apple-darwin
           - runner: macos-15
@@ -47,7 +53,7 @@ jobs:
           targets: ${{ matrix.target }}
 
       - name: Use hermetic Cargo home
-        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' }}
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -58,7 +64,7 @@ jobs:
           : > "${cargo_home}/config.toml"
 
       - name: Cache Cargo home and target dir
-        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' }}
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
         uses: actions/cache@v4
         with:
           path: |
@@ -70,7 +76,7 @@ jobs:
             ${{ runner.os }}-${{ matrix.target }}-cargo-
 
       - name: Cache Cargo home and target dir
-        if: ${{ matrix.target != 'x86_64-unknown-linux-musl' }}
+        if: ${{ matrix.target != 'x86_64-unknown-linux-musl' && matrix.target != 'aarch64-unknown-linux-musl' }}
         uses: actions/cache@v4
         with:
           path: |
@@ -82,20 +88,20 @@ jobs:
             ${{ runner.os }}-${{ matrix.target }}-cargo-
 
       - name: Install Zig
-        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' }}
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
         uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29
         with:
           version: 0.14.0
 
       - name: Install musl build tools
-        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' }}
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
         env:
           TARGET: ${{ matrix.target }}
         shell: bash
         run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"
 
       - name: Configure rustc UBSan wrapper
-        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' }}
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -118,7 +124,7 @@ jobs:
           echo "RUSTC_WORKSPACE_WRAPPER=" >> "$GITHUB_ENV"
 
       - name: Clear sanitizer flags
-        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' }}
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
         shell: bash
         run: |
           set -euo pipefail
@@ -135,23 +141,24 @@ jobs:
           echo "CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=" >> "$GITHUB_ENV"
           echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_MUSL_RUSTFLAGS=" >> "$GITHUB_ENV"
 
-      - name: Configure musl rusty_v8 artifact overrides
-        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' }}
-        env:
-          TARGET: ${{ matrix.target }}
-        shell: bash
-        run: |
-          set -euo pipefail
-          version="$(python3 "${GITHUB_WORKSPACE}/.github/scripts/rusty_v8_bazel.py" resolved-v8-crate-version)"
-          release_tag="rusty-v8-v${version}"
-          base_url="https://github.com/openai/codex/releases/download/${release_tag}"
-          archive="${base_url}/librusty_v8_release_${TARGET}.a.gz"
-          binding_dir="${RUNNER_TEMP}/rusty_v8"
-          binding_path="${binding_dir}/src_binding_release_${TARGET}.rs"
-          mkdir -p "${binding_dir}"
-          curl -fsSL "${base_url}/src_binding_release_${TARGET}.rs" -o "${binding_path}"
-          echo "RUSTY_V8_ARCHIVE=${archive}" >> "$GITHUB_ENV"
-          echo "RUSTY_V8_SRC_BINDING_PATH=${binding_path}" >> "$GITHUB_ENV"
+          sanitize_flags() {
+            local input="$1"
+            input="${input//-fsanitize=undefined/}"
+            input="${input//-fno-sanitize-recover=undefined/}"
+            input="${input//-fno-sanitize-trap=undefined/}"
+            echo "$input"
+          }
+
+          cflags="$(sanitize_flags "${CFLAGS-}")"
+          cxxflags="$(sanitize_flags "${CXXFLAGS-}")"
+          echo "CFLAGS=${cflags}" >> "$GITHUB_ENV"
+          echo "CXXFLAGS=${cxxflags}" >> "$GITHUB_ENV"
+
+      - name: Configure musl rusty_v8 artifact overrides and verify checksums
+        if: ${{ matrix.target == 'x86_64-unknown-linux-musl' || matrix.target == 'aarch64-unknown-linux-musl' }}
+        uses: ./.github/actions/setup-rusty-v8-musl
+        with:
+          target: ${{ matrix.target }}
 
       - name: Cargo build
         shell: bash
@@ -276,6 +283,11 @@ jobs:
           chmod +x "${linux_stage}/codext"
           tar -C "${linux_stage}" -czf "${out_dir}/codext-linux-x64-${VERSION}.tar.gz" codext
 
+          linux_arm64_stage="$(mktemp -d "${RUNNER_TEMP}/release-linux-arm64-XXXXXX")"
+          cp "${artifacts_root}/codex-bin-aarch64-unknown-linux-musl/codex" "${linux_arm64_stage}/codext"
+          chmod +x "${linux_arm64_stage}/codext"
+          tar -C "${linux_arm64_stage}" -czf "${out_dir}/codext-linux-arm64-${VERSION}.tar.gz" codext
+
           darwin_x64_stage="$(mktemp -d "${RUNNER_TEMP}/release-darwin-x64-XXXXXX")"
           cp "${artifacts_root}/codex-bin-x86_64-apple-darwin/codex" "${darwin_x64_stage}/codext"
           chmod +x "${darwin_x64_stage}/codext"
@@ -366,12 +378,15 @@ jobs:
 
           mkdir -p \
             "${vendor_root}/x86_64-unknown-linux-musl/codex" \
+            "${vendor_root}/aarch64-unknown-linux-musl/codex" \
             "${vendor_root}/x86_64-apple-darwin/codex" \
             "${vendor_root}/aarch64-apple-darwin/codex" \
             "${vendor_root}/x86_64-pc-windows-msvc/codex"
 
           cp "${artifacts_root}/codex-bin-x86_64-unknown-linux-musl/codex" \
             "${vendor_root}/x86_64-unknown-linux-musl/codex/codex"
+          cp "${artifacts_root}/codex-bin-aarch64-unknown-linux-musl/codex" \
+            "${vendor_root}/aarch64-unknown-linux-musl/codex/codex"
           cp "${artifacts_root}/codex-bin-x86_64-apple-darwin/codex" \
             "${vendor_root}/x86_64-apple-darwin/codex/codex"
           cp "${artifacts_root}/codex-bin-aarch64-apple-darwin/codex" \
@@ -401,6 +416,7 @@ jobs:
           packages=(
             codex
             codex-linux-x64
+            codex-linux-arm64
             codex-darwin-x64
             codex-darwin-arm64
             codex-win32-x64
diff --git a/codex-cli/bin/codex.js b/codex-cli/bin/codex.js
index 53f97a53cfdf..bb1c15307742 100755
--- a/codex-cli/bin/codex.js
+++ b/codex-cli/bin/codex.js
@@ -14,6 +14,7 @@ const require = createRequire(import.meta.url);
 
 const PLATFORM_PACKAGE_BY_TARGET = {
   "x86_64-unknown-linux-musl": "@loongphy/codext-linux-x64",
+  "aarch64-unknown-linux-musl": "@loongphy/codext-linux-arm64",
   "x86_64-apple-darwin": "@loongphy/codext-darwin-x64",
   "aarch64-apple-darwin": "@loongphy/codext-darwin-arm64",
   "x86_64-pc-windows-msvc": "@loongphy/codext-win32-x64",
@@ -29,6 +30,9 @@ switch (platform) {
       case "x64":
         targetTriple = "x86_64-unknown-linux-musl";
         break;
+      case "arm64":
+        targetTriple = "aarch64-unknown-linux-musl";
+        break;
       default:
         break;
     }
diff --git a/codex-cli/scripts/build_npm_package.py b/codex-cli/scripts/build_npm_package.py
index c27bd67968fe..5f8df7ed67e7 100755
--- a/codex-cli/scripts/build_npm_package.py
+++ b/codex-cli/scripts/build_npm_package.py
@@ -26,6 +26,13 @@
         "os": "linux",
         "cpu": "x64",
     },
+    "codex-linux-arm64": {
+        "npm_name": "@loongphy/codext-linux-arm64",
+        "npm_tag": "linux-arm64",
+        "target_triple": "aarch64-unknown-linux-musl",
+        "os": "linux",
+        "cpu": "arm64",
+    },
     "codex-darwin-x64": {
         "npm_name": "@loongphy/codext-darwin-x64",
         "npm_tag": "darwin-x64",
@@ -56,6 +63,7 @@
 PACKAGE_NATIVE_COMPONENTS: dict[str, list[str]] = {
     "codex": [],
     "codex-linux-x64": ["codex", "rg"],
+    "codex-linux-arm64": ["codex", "rg"],
     "codex-darwin-x64": ["codex", "rg"],
     "codex-darwin-arm64": ["codex", "rg"],
     "codex-win32-x64": ["codex", "rg", "codex-windows-sandbox-setup", "codex-command-runner"],
diff --git a/codex-cli/scripts/install_native_deps.py b/codex-cli/scripts/install_native_deps.py
index e5cd02d996e6..7789c56b606b 100755
--- a/codex-cli/scripts/install_native_deps.py
+++ b/codex-cli/scripts/install_native_deps.py
@@ -25,6 +25,7 @@
 RG_MANIFEST = CODEX_CLI_ROOT / "bin" / "rg"
 BINARY_TARGETS = (
     "x86_64-unknown-linux-musl",
+    "aarch64-unknown-linux-musl",
     "x86_64-apple-darwin",
     "aarch64-apple-darwin",
     "x86_64-pc-windows-msvc",
@@ -68,6 +69,7 @@ class BinaryComponent:
 
 RG_TARGET_PLATFORM_PAIRS: list[tuple[str, str]] = [
     ("x86_64-unknown-linux-musl", "linux-x86_64"),
+    ("aarch64-unknown-linux-musl", "linux-aarch64"),
     ("x86_64-apple-darwin", "macos-x86_64"),
     ("aarch64-apple-darwin", "macos-aarch64"),
     ("x86_64-pc-windows-msvc", "windows-x86_64"),