diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eaf4b34458..301d6c88a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -180,6 +180,14 @@ jobs:
       - name: Override rust toolchain
         run: rustup override set ${{ matrix.rust }}
 
+      - uses: taiki-e/install-action@nextest
+
+      # qemu runs the cross-compiled aarch64 test binaries; the aarch64 cross
+      # runtime provides the sysroot qemu loads guest libs from; gpgsm is needed
+      # by the x509 signing e2e test (ssh-keygen/gpg/openssl are preinstalled).
+      - name: Install emulation and signing tools
+        run: sudo apt-get update && sudo apt-get install -y qemu-user-static libc6-arm64-cross libgcc-s1-arm64-cross gpgsm
+
       - name: Setup ARM toolchain
         run: |
           rustup target add aarch64-unknown-linux-gnu
@@ -201,6 +209,16 @@ jobs:
       - name: Build Debug
         run: |
           make build-linux-arm-debug
+
+      # Run the suite for aarch64 under emulation. qemu emulates the aarch64
+      # test binary (loading its libs from the cross sysroot via -L) while
+      # passing native x86 child processes (git, gpg, ssh-keygen, ...) straight
+      # through to the host, so the signing e2e tests exercise the real tools.
+      - name: Run tests (aarch64, emulated)
+        env:
+          CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUNNER: qemu-aarch64-static -L /usr/aarch64-linux-gnu
+        run: make test-linux-arm
+
       - name: Build Release
         run: |
           make build-linux-arm-release
diff --git a/Makefile b/Makefile
index 939c8118ef..c45bcba3f0 100644
--- a/Makefile
+++ b/Makefile
@@ -61,6 +61,14 @@ build-linux-musl-release:
 test-linux-musl:
 	cargo nextest run --workspace --target=x86_64-unknown-linux-musl
 
+# aarch64 test binaries are cross-compiled, so CI runs them under qemu via a
+# CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_RUNNER (see .github/workflows/ci.yml).
+# Exclude test_hook_with_missing_shebang: it needs the kernel's ENOEXEC (so
+# gitui retries the hook via `sh`), which qemu-user doesn't emulate — the exec
+# just exits 127. It passes on real aarch64 hardware.
+test-linux-arm:
+	cargo nextest run --workspace --target=aarch64-unknown-linux-gnu -E 'not test(test_hook_with_missing_shebang)'
+
 release-linux-arm: build-linux-arm-release
 	mkdir -p release