diff --git a/elements/bluefin-server/os-release-flatcar.bst b/elements/bluefin-server/os-release-flatcar.bst
index a181790..5399604 100644
--- a/elements/bluefin-server/os-release-flatcar.bst
+++ b/elements/bluefin-server/os-release-flatcar.bst
@@ -1,6 +1,9 @@
 kind: manual
 description: Create custom Flatcar-compatible os-release metadata to support Flatcar system extensions (sysext).
 
+# %{flatcar-board} — derived from the `arch` option, never hardcoded here.
+(@): include/arch.yml
+
 build-depends:
   # Needed so the manual-element sandbox provides /bin/sh and coreutils (cat, ln, mkdir, sed).
   - freedesktop-sdk.bst:public-stacks/runtime-minimal.bst
@@ -45,7 +48,7 @@ config:
       ANSI_COLOR="0;38;5;208"
       HOME_URL="https://github.com/projectbluefin/server"
       BUG_REPORT_URL="https://github.com/projectbluefin/server/issues"
-      FLATCAR_BOARD="amd64-usr"
+      FLATCAR_BOARD="%{flatcar-board}"
       CPE_NAME="cpe:/o:flatcar-linux:flatcar_linux:${FLATCAR_VERSION}"
       IMAGE_VERSION=${FSDK_VERSION}
       EOF
diff --git a/elements/k3s/k3s-bin.bst b/elements/k3s/k3s-bin.bst
index d3faa9b..91fcb14 100644
--- a/elements/k3s/k3s-bin.bst
+++ b/elements/k3s/k3s-bin.bst
@@ -20,4 +20,16 @@ sources:
 
 config:
   install-commands:
+    - |
+      # The pinned `sources` entry above is the upstream amd64 asset (its
+      # SHA256 comes from sha256sum-amd64.txt). Nothing downstream inspects
+      # the ELF, so under any other `arch` this would silently stage an
+      # x86-64 binary into a foreign rootfs. Fail closed instead; adding the
+      # k3s-arm64 source is a deliberate, separate change.
+      if [ "%{arch}" != "x86_64" ]; then
+        echo "ERROR: elements/k3s/k3s-bin.bst pins the upstream k3s amd64 binary;" >&2
+        echo "       arch=%{arch} has no pinned source. Add an arch-conditional" >&2
+        echo "       source (k3s-arm64) before building k3s for %{arch}." >&2
+        exit 1
+      fi
     - install -D -m 0755 k3s "%{install-root}/usr/bin/k3s"
diff --git a/elements/oci/k3s-sysext.bst b/elements/oci/k3s-sysext.bst
index 64207bd..83807c4 100644
--- a/elements/oci/k3s-sysext.bst
+++ b/elements/oci/k3s-sysext.bst
@@ -9,6 +9,10 @@ description: |
   metadata, Bluefin tuning defaults, and a tmpfiles.d entry that seeds
   those defaults into /etc/rancher/k3s/config.yaml.d/.
 
+# %{systemd-arch} — the extension-release ARCHITECTURE= value, derived from
+# the `arch` option rather than hardcoded in the staged source file.
+(@): include/arch.yml
+
 build-depends:
   # Core runtime for /bin/sh, coreutils, install, and sha256sum.
   - base/base-stack.bst
@@ -54,8 +58,11 @@ config:
       # systemd units (not enabled; provisioning can enable them).
       cp -a k3s.service k3s-agent.service sysext/usr/lib/systemd/system/
 
-      # Extension identity required by systemd-sysext.
+      # Extension identity required by systemd-sysext. ARCHITECTURE= is
+      # generated from the build's `arch` option so it can never disagree
+      # with the architecture of the k3s binary staged above.
       cp -a extension-release.k3s sysext/usr/lib/extension-release.d/
+      echo "ARCHITECTURE=%{systemd-arch}" >> sysext/usr/lib/extension-release.d/extension-release.k3s
 
       # Tuning defaults shipped in /usr and seeded into /etc via tmpfiles.
       cp -a 50-bluefin-tuning.yaml sysext/usr/share/bluefin/k3s/
diff --git a/files/k3s/sysext/extension-release.k3s b/files/k3s/sysext/extension-release.k3s
index cf9d04e..c1c55c6 100644
--- a/files/k3s/sysext/extension-release.k3s
+++ b/files/k3s/sysext/extension-release.k3s
@@ -1,4 +1,3 @@
 NAME=k3s
 ID=_any
 VERSION_ID=v1.36.2+k3s1
-ARCHITECTURE=x86-64
diff --git a/include/arch.yml b/include/arch.yml
new file mode 100644
index 0000000..2dce89d
--- /dev/null
+++ b/include/arch.yml
@@ -0,0 +1,25 @@
+# Single source of truth for CPU-architecture identity strings.
+#
+# project.conf declares `options.arch` (aarch64, x86_64) and binds it to
+# `%{arch}`. Artifacts that have to restate that choice in a vendor-specific
+# spelling read it from here instead of hardcoding a literal, so the build
+# axis and the identity written into the image cannot drift apart.
+#
+#   %{arch}           BuildStream / uname -m      x86_64      aarch64
+#   %{systemd-arch}   systemd `ARCHITECTURE=`     x86-64      arm64
+#   %{flatcar-board}  Flatcar `FLATCAR_BOARD=`    amd64-usr   arm64-usr
+#
+# `options.arch.values` in project.conf constrains the axis to the two
+# architectures mapped below, so an unmapped architecture cannot be selected.
+#
+# Included by:
+#   elements/oci/k3s-sysext.bst              -> %{systemd-arch}
+#   elements/bluefin-server/os-release-flatcar.bst -> %{flatcar-board}
+variables:
+  (?):
+    - arch == "x86_64":
+        systemd-arch: "x86-64"
+        flatcar-board: "amd64-usr"
+    - arch == "aarch64":
+        systemd-arch: "arm64"
+        flatcar-board: "arm64-usr"