diff --git a/iso/docker/Dockerfile.arm64 b/iso/docker/Dockerfile.arm64
index 20ef1e5..079d678 100644
--- a/iso/docker/Dockerfile.arm64
+++ b/iso/docker/Dockerfile.arm64
@@ -14,7 +14,6 @@ RUN curl -fL --retry 3 --progress-bar \
     mkdir /alarm-root && \
     bsdtar -xpf /tmp/alarm.tar.gz -C /alarm-root && \
     rm /tmp/alarm.tar.gz && \
-    # Verify extraction produced a usable ALARM environment
     test -f /alarm-root/usr/bin/bash || \
         (echo "ERROR: ALARM extraction failed — /usr/bin/bash missing" && exit 1)
 
@@ -26,14 +25,18 @@ COPY --from=alarm-fetch /alarm-root/ /
 # lookup fails when the symlink isn't resolved yet — use the absolute path.
 SHELL ["/usr/bin/bash", "-c"]
 
+# Ensure a working mirrorlist (the tarball ships with a stale/empty one)
+RUN echo 'Server = http://mirror.archlinuxarm.org/$arch/$repo' > /etc/pacman.d/mirrorlist
+
 # Add DisableSandbox inside [options] (not at file end where it lands in [aur])
 RUN sed -i '/^\[options\]/a DisableSandbox' /etc/pacman.conf
 
 RUN pacman-key --init && pacman-key --populate archlinuxarm
 
+# archiso is not packaged for aarch64 in ALARM — install from upstream source.
+# All other build deps are available in the standard ALARM repos.
 RUN pacman -Syu --noconfirm && \
     pacman -S --noconfirm \
-        archiso \
         base-devel \
         libx11 \
         libxft \
@@ -44,8 +47,20 @@ RUN pacman -Syu --noconfirm && \
         fakeroot \
         git \
         sudo \
+        mtools \
+        dosfstools \
+        libisoburn \
+        squashfs-tools \
+        arch-install-scripts \
+        e2fsprogs \
     && pacman -Scc --noconfirm
 
+# Install archiso from upstream source (not packaged for aarch64 in ALARM).
+# PREFIX=/usr so mkarchiso lands in /usr/bin alongside pacman-installed tools.
+RUN git clone --depth=1 https://gitlab.archlinux.org/archlinux/archiso.git /tmp/archiso && \
+    make -C /tmp/archiso PREFIX=/usr install && \
+    rm -rf /tmp/archiso
+
 WORKDIR /orionos
 COPY . .