diff --git a/.github/workflows/docker-dev.yml b/.github/workflows/docker-dev.yml
index 1f9495a30..b8ff35a65 100644
--- a/.github/workflows/docker-dev.yml
+++ b/.github/workflows/docker-dev.yml
@@ -132,7 +132,8 @@ jobs:
         with:
           path: /tmp/digests
           pattern: digests-*
-          merge-multiple: true
+          # Deliberately NOT merged: the per-platform folder names are what lets
+          # the manifest below be assembled in a fixed order.
 
       - uses: docker/setup-buildx-action@v3
 
@@ -144,9 +145,24 @@ jobs:
       - name: Create and push multi-arch manifest
         working-directory: /tmp/digests
         run: |
+          set -euo pipefail
           VERSION="${{ needs.version-bump.outputs.version }}"
-          mapfile -t digests < <(printf 'mauriceboe/trek@sha256:%s\n' *)
           MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)-pre"
+          # amd64 first, always. This used to be a glob over hash-named files, so
+          # the order changed from one release to the next: 3.4.1 listed amd64
+          # first and 4.0.0 listed arm64 first. Clients that read the first entry
+          # of the index rather than matching their own platform then compare the
+          # wrong digest and report "no update" — which is what Unraid users hit
+          # on :latest after 4.0.0 shipped. The image was fine; the order was not.
+          digests=()
+          for platform in linux-amd64 linux-arm64; do
+            dir="digests-$platform"
+            [ -d "$dir" ] || { echo "::error::missing digest artifact for $platform"; exit 1; }
+            for f in "$dir"/*; do
+              [ -e "$f" ] || { echo "::error::no digest file in $dir"; exit 1; }
+              digests+=("mauriceboe/trek@sha256:$(basename "$f")")
+            done
+          done
           docker buildx imagetools create \
             -t "mauriceboe/trek:latest-pre" \
             -t "mauriceboe/trek:$MAJOR_TAG" \
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 50d8751e3..34dfee87e 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -176,7 +176,8 @@ jobs:
         with:
           path: /tmp/digests
           pattern: digests-*
-          merge-multiple: true
+          # Deliberately NOT merged: the per-platform folder names are what lets
+          # the manifest below be assembled in a fixed order.
 
       - uses: docker/setup-buildx-action@v3
 
@@ -188,9 +189,24 @@ jobs:
       - name: Create and push multi-arch manifest
         working-directory: /tmp/digests
         run: |
+          set -euo pipefail
           VERSION="${{ needs.version-bump.outputs.version }}"
-          mapfile -t digests < <(printf 'mauriceboe/trek@sha256:%s\n' *)
           MAJOR_TAG="$(echo "$VERSION" | cut -d. -f1)"
+          # amd64 first, always. This used to be a glob over hash-named files, so
+          # the order changed from one release to the next: 3.4.1 listed amd64
+          # first and 4.0.0 listed arm64 first. Clients that read the first entry
+          # of the index rather than matching their own platform then compare the
+          # wrong digest and report "no update" — which is what Unraid users hit
+          # on :latest after 4.0.0 shipped. The image was fine; the order was not.
+          digests=()
+          for platform in linux-amd64 linux-arm64; do
+            dir="digests-$platform"
+            [ -d "$dir" ] || { echo "::error::missing digest artifact for $platform"; exit 1; }
+            for f in "$dir"/*; do
+              [ -e "$f" ] || { echo "::error::no digest file in $dir"; exit 1; }
+              digests+=("mauriceboe/trek@sha256:$(basename "$f")")
+            done
+          done
           docker buildx imagetools create \
             -t "mauriceboe/trek:latest" \
             -t "mauriceboe/trek:$MAJOR_TAG" \