diff --git a/Dockerfile b/Dockerfile
index 0d494b6e..ba141d06 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,9 @@
-FROM node:lts-trixie-slim AS base
+# Pin the Node stages to the builder's own platform ($BUILDPLATFORM).
+# The Angular build output is platform-independent static files, so there is
+# no need to run yarn/ng build under qemu emulation for linux/arm64 - doing
+# so is slow and memory hungry and can OOM the machine during multi-arch
+# builds (podman builds all --platform targets concurrently).
+FROM --platform=$BUILDPLATFORM node:lts-trixie-slim AS base
 
 # Install dependencies only when needed
 FROM base AS deps
diff --git a/Makefile b/Makefile
index 34822f60..c27d6a45 100644
--- a/Makefile
+++ b/Makefile
@@ -1,21 +1,36 @@
 .PHONY: build-production
 build-production: ## Build the production container image.
+	@echo "Cloning repository..."
+	@rm -rf .tmp-brewman
+	@git clone --depth 1 $(if $(TAG),--branch v$(TAG)) git@git.tanshu.com:tanshu/brewman.git .tmp-brewman
+
+	@echo "Building image..."
 	@podman manifest rm registry.tanshu.com/brewman:latest 2>/dev/null || true
 	@podman build \
 		--platform linux/amd64,linux/arm64 \
 		--manifest registry.tanshu.com/brewman:latest \
-		git@git.tanshu.com:tanshu/brewman.git$(if $(TAG),#v$(TAG))
+		--pull \
+		.tmp-brewman || (rm -rf .tmp-brewman && exit 1)
+	@rm -rf .tmp-brewman
+
+	@echo "Pushing manifests..."
 	@podman manifest push --all registry.tanshu.com/brewman:latest docker://registry.tanshu.com/brewman:latest
 	$(if $(TAG),@podman manifest push --all registry.tanshu.com/brewman:latest docker://registry.tanshu.com/brewman:$(TAG))
 
 .PHONY: build-check
 build-check: ## Multi-arch build without push (compile check)
+	@echo "Cloning repository..."
+	@rm -rf .tmp-brewman
+	@git clone --depth 1 $(if $(TAG),--branch v$(TAG)) git@git.tanshu.com:tanshu/brewman.git .tmp-brewman
+
+	@echo "Building image..."
 	@podman manifest rm brewman:test 2>/dev/null || true
 	@podman build \
 		--platform linux/amd64,linux/arm64 \
 		--manifest brewman:test \
 		--pull \
-		git@git.tanshu.com:tanshu/brewman.git
+		.tmp-brewman || (rm -rf .tmp-brewman && exit 1)
+	@rm -rf .tmp-brewman
 
 .PHONY: build-check-local
 build-check-local: ## Local build without push (compile check)