diff --git a/.gitea/workflows/build-push.yaml b/.gitea/workflows/build-push.yaml
index 403d6ed..e39a64f 100644
--- a/.gitea/workflows/build-push.yaml
+++ b/.gitea/workflows/build-push.yaml
@@ -57,9 +57,14 @@ jobs:
             scripts/lsphp-abi-gate.sh \
             scripts/tune-mpm.sh \
             scripts/tests/lsphp-info-probe.test.sh \
+            scripts/lsphp-repo-version.sh \
+            scripts/tests/lsphp-repo-version.test.sh \
             scripts/tests/lsphp-abi-gate.test.sh \
             .gitea/scripts/resolve-base-image.sh
 
+      - name: lsphp repo-version lookup test
+        run: ./scripts/tests/lsphp-repo-version.test.sh
+
       - name: lsphp probe regression test
         run: ./scripts/tests/lsphp-info-probe.test.sh
 
@@ -420,8 +425,7 @@ jobs:
           PHPVER: ${{ matrix.phpver }}
         run: |
           set -euo pipefail
-          idx=$(curl -fsS --proto '=https' --retry 3 --max-time 60 https://rpms.litespeedtech.com/debian/dists/noble/main/binary-amd64/Packages)
-          pkg=$(printf '%s\n' "$idx" | awk -v p="lsphp${PHPVER}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1)
+          pkg=$(./scripts/lsphp-repo-version.sh "${PHPVER}" "${LSPHP_ARCH:-amd64}")
           if [ -z "$pkg" ]; then echo "::error::lsphp${PHPVER} not found in the LiteSpeed repo index"; exit 1; fi
           php="${pkg%%-*}"
           [[ "$pkg" =~ ^[0-9][0-9A-Za-z.+~:-]*$ ]] || { echo "::error::malformed lsphp${PHPVER} package version in the repo index"; exit 1; }
@@ -581,8 +585,7 @@ jobs:
           PHPVER: ${{ matrix.phpver }}
         run: |
           set -euo pipefail
-          idx=$(curl -fsS --proto '=https' --retry 3 --max-time 60 https://rpms.litespeedtech.com/debian/dists/noble/main/binary-amd64/Packages)
-          pkg=$(printf '%s\n' "$idx" | awk -v p="lsphp${PHPVER}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1)
+          pkg=$(./scripts/lsphp-repo-version.sh "${PHPVER}" "${LSPHP_ARCH:-amd64}")
           if [ -z "$pkg" ]; then echo "::error::lsphp${PHPVER} not found in the LiteSpeed repo index"; exit 1; fi
           php="${pkg%%-*}"
           [[ "$pkg" =~ ^[0-9][0-9A-Za-z.+~:-]*$ ]] || { echo "::error::malformed lsphp${PHPVER} package version in the repo index"; exit 1; }
diff --git a/.gitea/workflows/lsphp-source-emergency.yaml b/.gitea/workflows/lsphp-source-emergency.yaml
index e3cfa5e..a5d2e22 100644
--- a/.gitea/workflows/lsphp-source-emergency.yaml
+++ b/.gitea/workflows/lsphp-source-emergency.yaml
@@ -92,8 +92,7 @@ jobs:
           sha=$(printf '%s' "$json" | python3 -c 'import json,sys; d=json.load(sys.stdin); v=sys.argv[1]; print(next((s["sha256"] for s in d.get("source", []) if s.get("filename")=="php-%s.tar.xz"%v), ""))' "$v")
           [ -n "$sha" ] || { echo "::error::php.net has no release php-$v.tar.xz (EOL branch? typo?): $json"; exit 1; }
           [[ "$sha" =~ ^[0-9a-f]{64}$ ]] || { echo "::error::no sha256 for php-$v.tar.xz in the php.net releases JSON"; exit 1; }
-          idx=$(curl -fsS --proto '=https' --retry 3 --max-time 60 https://rpms.litespeedtech.com/debian/dists/noble/main/binary-amd64/Packages)
-          pkg=$(printf '%s\n' "$idx" | awk -v p="lsphp${PHPVER}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1)
+          pkg=$(./scripts/lsphp-repo-version.sh "${PHPVER}" "${LSPHP_ARCH:-amd64}")
           [ -n "$pkg" ] || { echo "::error::lsphp${PHPVER} not in the LiteSpeed repo index"; exit 1; }
           [[ "$pkg" =~ ^[0-9][0-9A-Za-z.+~:-]*$ ]] || { echo "::error::malformed lsphp${PHPVER} package version in the repo index"; exit 1; }
           pphp=${pkg%%-*}
diff --git a/Dockerfile b/Dockerfile
index 3febe42..fef95a5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -80,6 +80,8 @@ COPY ./configs/prod-php.ini /etc/php.ini
 COPY ./configs/zz-php2shell-mitigation.ini /etc/php.d/zz-php2shell-mitigation.ini
 COPY ./configs/phpinfo.php /var/www/html/
 COPY ./configs/mariadb.repo /etc/yum.repos.d/
+# mirror.mariadb.org names the arch dir amd64/aarch64 (not $basearch); amd64 result is byte-identical.
+RUN sed -i "s/rhel\$releasever-amd64/rhel\$releasever-$(uname -m | sed s/x86_64/amd64/)/" /etc/yum.repos.d/mariadb.repo
 COPY ./configs/index.php /var/www/html/
 COPY ./configs/remote_ip.conf /etc/httpd/conf.d/
 COPY ./configs/whp-security.conf /etc/httpd/conf.d/
diff --git a/Dockerfile.fpm b/Dockerfile.fpm
index 8d0978a..2a8ec58 100644
--- a/Dockerfile.fpm
+++ b/Dockerfile.fpm
@@ -77,6 +77,8 @@ COPY ./configs/prod-php.ini /etc/php.ini
 # all images ship PHP >= 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12.
 COPY ./configs/zz-php2shell-mitigation.ini /etc/php.d/zz-php2shell-mitigation.ini
 COPY ./configs/mariadb.repo /etc/yum.repos.d/
+# mirror.mariadb.org names the arch dir amd64/aarch64 (not $basearch); amd64 result is byte-identical.
+RUN sed -i "s/rhel\$releasever-amd64/rhel\$releasever-$(uname -m | sed s/x86_64/amd64/)/" /etc/yum.repos.d/mariadb.repo
 
 # Set up cron job for log rotation
 RUN echo "15 */12 * * * root /scripts/log-rotate.sh" >> /etc/crontab
diff --git a/scripts/lsphp-repo-version.sh b/scripts/lsphp-repo-version.sh
new file mode 100755
index 0000000..d7eb94e
--- /dev/null
+++ b/scripts/lsphp-repo-version.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+## lsphp-repo-version.sh PHPVER [ARCH] — print the newest lsphpPHPVER package
+## version in LiteSpeed's noble apt index for ARCH (amd64 | arm64; default
+## $LSPHP_ARCH, else amd64, so callers that pass nothing behave as before).
+## The awk/sort pipeline is byte-for-byte the one that used to be inlined in
+## build-push.yaml and lsphp-source-emergency.yaml.
+## Test hook: LSPHP_INDEX_FILE=<path> reads that Packages file instead of curl.
+## Exit 1 (message on stderr) if the arch is unknown or the package is absent.
+set -euo pipefail
+phpver="${1:?usage: lsphp-repo-version.sh PHPVER [ARCH]}"
+arch="${2:-${LSPHP_ARCH:-amd64}}"
+case "$arch" in amd64|arm64) ;; *) echo "unsupported lsphp arch '$arch' (amd64|arm64)" >&2; exit 1 ;; esac
+[[ "$phpver" =~ ^[0-9]+$ ]] || { echo "malformed PHPVER '$phpver'" >&2; exit 1; }
+if [ -n "${LSPHP_INDEX_FILE:-}" ]; then
+    idx=$(cat "$LSPHP_INDEX_FILE")
+else
+    idx=$(curl -fsS --proto '=https' --retry 3 --max-time 60 "https://rpms.litespeedtech.com/debian/dists/noble/main/binary-${arch}/Packages")
+fi
+printf '%s\n' "$idx" | awk -v p="lsphp${phpver}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1
diff --git a/scripts/tests/lsphp-repo-version.test.sh b/scripts/tests/lsphp-repo-version.test.sh
new file mode 100755
index 0000000..b986b95
--- /dev/null
+++ b/scripts/tests/lsphp-repo-version.test.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+## lsphp-repo-version.test.sh — fixture test for scripts/lsphp-repo-version.sh.
+## Asserts: amd64 (explicit and default) equals the OLD inline pipeline on the
+## same fixture; arm64 picks from the arm64 index (fixtures deliberately differ);
+## bad arch is refused.
+set -euo pipefail
+HERE=$(cd "$(dirname "$0")/.." && pwd)
+S="$HERE/lsphp-repo-version.sh"
+T=$(mktemp -d); trap 'rm -rf "$T"' EXIT
+mk() { # file, version-for-lsphp85
+cat >"$T/$1" <<EOT
+Package: lsphp84
+Version: 8.4.20-1+ubuntu24.04.1+deb.sury.org+1
+Architecture: x
+
+Package: lsphp85
+Version: 8.5.1-1+ubuntu24.04.1+deb.sury.org+1
+Architecture: x
+
+Package: lsphp85
+Version: $2
+Architecture: x
+
+Package: lsphp85-common
+Version: 9.9.9-1
+Architecture: x
+EOT
+}
+mk amd64.Packages 8.5.12-1+ubuntu24.04.1+deb.sury.org+1
+mk arm64.Packages 8.5.11-1+ubuntu24.04.1+deb.sury.org+1
+old() { printf '%s\n' "$(cat "$1")" | awk -v p="lsphp${2}" '/^Package: /{n=$2} /^Version: / && n==p {print $2}' | sort -V | tail -n1; }
+fail=0
+chk() { if [ "$2" = "$3" ]; then echo "ok   $1: $2"; else echo "FAIL $1: got '$2' want '$3'"; fail=1; fi; }
+for v in 84 85; do
+  chk "amd64 explicit lsphp$v == old inline" "$(LSPHP_INDEX_FILE=$T/amd64.Packages "$S" $v amd64)" "$(old "$T/amd64.Packages" $v)"
+  chk "default arch lsphp$v == old inline"   "$(LSPHP_INDEX_FILE=$T/amd64.Packages "$S" $v)" "$(old "$T/amd64.Packages" $v)"
+done
+chk "arm64 reads arm64 index" "$(LSPHP_INDEX_FILE=$T/arm64.Packages "$S" 85 arm64)" "8.5.11-1+ubuntu24.04.1+deb.sury.org+1"
+chk "LSPHP_ARCH env" "$(LSPHP_ARCH=arm64 LSPHP_INDEX_FILE=$T/arm64.Packages "$S" 85)" "8.5.11-1+ubuntu24.04.1+deb.sury.org+1"
+chk "missing pkg is empty" "$(LSPHP_INDEX_FILE=$T/amd64.Packages "$S" 99)" ""
+if "$S" 85 s390x >/dev/null 2>&1; then echo "FAIL bad arch accepted"; fail=1; else echo "ok   bad arch refused"; fi
+exit $fail