diff --git a/.github/actions/build-php-images/action.yml b/.github/actions/build-php-images/action.yml
index f192cee5..194a628d 100644
--- a/.github/actions/build-php-images/action.yml
+++ b/.github/actions/build-php-images/action.yml
@@ -114,7 +114,7 @@ runs:
         password: ${{ inputs.ghcr_user && inputs.ghcr_token || inputs.github_token }}
 
     - name: Set up QEMU
-      if: ${{ !((runner.arch == 'ARM64' && startsWith(inputs.platform, 'linux/arm64')) || (runner.arch == 'X64' && startsWith(inputs.platform, 'linux/amd64'))) }}
+      if: ${{ !(runner.arch == 'X64' && startsWith(inputs.platform, 'linux/amd64')) }}
       uses: docker/setup-qemu-action@v4
 
     - name: Set up Docker Buildx
diff --git a/README.md b/README.md
index 6812e82c..72b29456 100644
--- a/README.md
+++ b/README.md
@@ -31,6 +31,10 @@ Each PHP version ships three layered variants.
 
 Release candidate tags end with `-rc` (e.g. `8.3-base-rc`).
 
+The bundled legacy `devpanel` CLI is AMD64-only, including in ARM64 images.
+Executing it on an ARM64 host requires AMD64 emulation on that host; CI runner
+emulation is not included in the published images.
+
 Available PHP versions: **7.4 · 8.0 · 8.1 · 8.2 · 8.3**
 
 ---
@@ -281,9 +285,10 @@ for setup instructions.
   Run `./test.sh build run --version <v>` to test a single PHP version quickly.
 - The build workflow is `docker-build.yml`, which handles both push-triggered
   and manual dispatch builds.  It runs a detect → build (per-platform,
-  parallel) → merge pipeline.  ARM64 builds use native `ubuntu-24.04-arm`
-  runners; AMD64 builds use `ubuntu-latest`.  QEMU is only set up when the
-  requested platform does not match the runner architecture.
+  parallel) → merge pipeline.  ARM64 builds use native `ubuntu-26.04-arm`
+  runners; AMD64 builds use `ubuntu-26.04`. QEMU is set up on ARM runners
+  to execute the bundled AMD64 DevPanel CLI, and for cross-platform builds.
+  Native AMD64 builds skip QEMU.
 - The `advance` variant depends on `secure`, which depends on `base`.
   The build chain is enforced via the bake target dependency graph.
 
diff --git a/TODO.md b/TODO.md
index 1adc41a8..a7fa5f1f 100644
--- a/TODO.md
+++ b/TODO.md
@@ -2,6 +2,20 @@
 
 Use this file to track work that needs to be done. Lint scripts automatically append baseline-cleanup entries here when all violations for a linter reach zero.
 
+# Task: Restore DevPanel CLI and enable QEMU on ARM runners
+
+## Steps
+- [x] Restore unconditional CLI installation and remove architecture-specific omission tests.
+- [x] Enable QEMU on ARM runners and document the runtime emulation requirement.
+- [x] Restore the Dockerfile lint baseline; YAML/Dockerfile/shell lint, shell syntax and ARM64 Bake parsing pass.
+- [x] Scan changed files for secrets (none); independent review found no significant issues. Automated review unavailable; CodeQL has no analyzable changes.
+- [x] Record validation limitation: native ARM runner execution cannot be verified in this AMD64-only sandbox.
+
+## Definition of Done
+- All image builds install and verify the bundled CLI.
+- ARM runners register QEMU before Buildx; native AMD64 builds still skip it.
+- Focused checks pass; unavailable full-build verification is explicitly reported.
+
 # Task: Use native ARM runners for ARM64 builds
 
 ## Steps