diff --git a/infra/updater/src/publish-workflow.test.ts b/infra/updater/src/publish-workflow.test.ts
index b4654c4..67e992a 100644
--- a/infra/updater/src/publish-workflow.test.ts
+++ b/infra/updater/src/publish-workflow.test.ts
@@ -19,31 +19,38 @@ const workflow = parse(workflowText) as {
 };
 
 describe("server image publish workflow", () => {
-  it("builds every architecture natively instead of emulating arm64", () => {
+  it("builds amd64 natively on the Linux runner and keeps arm64 paused, not emulated", () => {
     expect(workflowText).not.toContain("setup-qemu-action");
+    expect(workflowText).toContain("arm64 is paused");
     const build = workflow.jobs.build;
     expect(build["runs-on"]).toContain("matrix.runner");
-    expect(build.strategy?.matrix?.arch).toEqual(["amd64", "arm64"]);
+    expect(build.strategy?.matrix?.arch).toEqual(["amd64"]);
     const runners = Object.fromEntries(
       (build.strategy?.matrix?.include ?? [])
         .filter((entry) => entry.arch !== undefined)
         .map((entry) => [entry.arch, entry.runner]),
     );
-    expect(runners).toEqual({
-      amd64: ["self-hosted", "evoo-ci", "Linux"],
-      arm64: ["self-hosted", "evoo-ci", "macOS"],
-    });
+    expect(runners).toEqual({ amd64: ["self-hosted", "evoo-ci", "Linux"] });
   });
 
-  it("publishes one verified multi-arch manifest per image after both builds", () => {
+  it("publishes one verified manifest per image after the build", () => {
     const publish = workflow.jobs.publish;
     expect(publish.needs).toBe("build");
     expect(workflowText).toContain("push-by-digest=true");
     expect(workflowText).toContain("docker buildx imagetools create");
-    expect(workflowText).toContain("for want in linux/amd64 linux/arm64");
+    expect(workflowText).toContain('if [[ "${#sources[@]}" -ne 1 ]]');
+    expect(workflowText).toContain("for want in linux/amd64; do");
     expect(workflowText).toContain("actions/attest-build-provenance@");
   });
 
+  it("names every image under the lowercase repository namespace", () => {
+    expect(workflowText).not.toContain("ghcr.io/${{ github.repository }}");
+    const references =
+      workflowText.match(/ghcr\.io\/\$\{\{ steps\.ns\.outputs\.repo \}\}\//g) ?? [];
+    expect(references.length).toBeGreaterThanOrEqual(6);
+    expect(workflowText).toContain("repo=${GITHUB_REPOSITORY,,}");
+  });
+
   it("keeps pull requests read-only and every action pinned to a commit", () => {
     const validate = workflow.jobs.validate;
     const build = workflow.jobs.build;