diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 3ad7480..7b18b91 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -91,6 +91,12 @@ jobs:
         run: |
           platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
+          # debian:bookworm-slim has no riscv64 image; fall back to sid-slim for that platform
+          if [ "$platform" = "linux/riscv64" ]; then
+            echo "RUNTIME_IMAGE=debian:sid-slim" >> $GITHUB_ENV
+          else
+            echo "RUNTIME_IMAGE=debian:bookworm-slim" >> $GITHUB_ENV
+          fi
 
       - name: Set version
         run: echo "version=$(cat VERSION)" >> $GITHUB_ENV
@@ -126,6 +132,7 @@ jobs:
           sbom: false
           build-args: |
             version=${{ env.version }}
+            RUNTIME_IMAGE=${{ env.RUNTIME_IMAGE }}
 
       - name: Export digest
         run: |
diff --git a/build/Dockerfile b/build/Dockerfile
index 51b3681..a33c4d6 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -1,5 +1,7 @@
 # debian:sid-slim is required for the build stage to support riscv64 (golang:bookworm does not).
-# For the runtime stage we use debian:bookworm-slim for stable, predictable package names.
+# For the runtime stage we default to debian:bookworm-slim for stable, predictable package names.
+# riscv64 requires debian:sid-slim at runtime too (bookworm has no riscv64 image);
+# the workflow passes RUNTIME_IMAGE=debian:sid-slim for that platform.
 FROM debian:sid-slim AS build
 
 ARG version
@@ -12,7 +14,8 @@ ADD https://github.com/ProtonMail/proton-bridge.git#${version} /build/
 WORKDIR /build/
 RUN make build-nogui vault-editor
 
-FROM debian:bookworm-slim
+ARG RUNTIME_IMAGE=debian:bookworm-slim
+FROM ${RUNTIME_IMAGE}
 LABEL maintainer="Dan Williams <dancwilliams@github>"
 
 EXPOSE 25/tcp