diff --git a/.tangled/workflows/release.yml b/.tangled/workflows/release.yml
index d4ff95d..61bfb4d 100644
--- a/.tangled/workflows/release.yml
+++ b/.tangled/workflows/release.yml
@@ -188,10 +188,15 @@ steps:
       # verify auth against the host the clone just accepted a key for
       ssh -T git@tangled.org 2>&1 | head -3 || true
 
-      # copy the freshly built release into place
+      # copy the freshly built release into place.
+      # NOTE: the loose raw binary .release/dist/sheaf-linux-amd64 is NOT
+      # published — extensionless paths 308-redirect into a 404 on Tangled
+      # Pages (L13), so it would be a dead link. It ships inside the
+      # .tar.gz and .zip below instead; only those get copied.
       REL_DIR="$DEPLOY/sheaf/v${VERSION}"
       mkdir -p "$REL_DIR"
-      cp .release/dist/sheaf-linux-* .release/dist/SHA256SUMS.txt \
+      cp .release/dist/sheaf-linux-amd64.tar.gz .release/dist/sheaf-linux-amd64.zip \
+         .release/dist/SHA256SUMS.txt \
          .release/dist/sheaf-"${VERSION}"-source.tar.gz \
          .release/dist/sheaf-bin-*-x86_64.pkg.tar.zst \
          .release/dist/sheaf-*.AppImage .release/dist/sheaf-*.AppImage.zsync \
diff --git a/RELEASE.md b/RELEASE.md
index 7552fac..f3b8f13 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -4,7 +4,7 @@ Tangled has no GitHub-style Releases tab, so Sheaf ships releases through a
 Spindle pipeline + Tangled Pages. One annotated tag push does everything:
 
 1. `spindle.tangled.sh` runs [.tangled/workflows/release.yml](.tangled/workflows/release.yml).
-2. It builds `linux-amd64` + `linux-arm64` binaries, tar/zip archives, a
+2. It builds the `linux-amd64` binary, tar/zip archives, a
    source tarball, `SHA256SUMS.txt`, a prebuilt `sheaf-bin-…​.pkg.tar.zst`
    Arch package, and an x86_64 AppImage with zsync delta-update info, then
    runs the full Go test suite first.
@@ -66,18 +66,19 @@ curl -s  https://katsuricata.tngl.io/sheaf/v1.0.0/SHA256SUMS.txt # checksums
 
 ## What gets published (URL → artifact, for v1.0.0)
 
-    /sheaf/v1.0.0/sheaf-linux-amd64                    raw binary (upx-packed)
-    /sheaf/v1.0.0/sheaf-linux-arm64                    raw binary (upx-packed)
-    /sheaf/v1.0.0/sheaf-linux-amd64.tar.gz             tarball
-    /sheaf/v1.0.0/sheaf-linux-arm64.tar.gz             tarball
-    /sheaf/v1.0.0/sheaf-linux-amd64.zip                zip
-    /sheaf/v1.0.0/sheaf-linux-arm64.zip                zip
+    /sheaf/v1.0.0/sheaf-linux-amd64.tar.gz             tarball (raw upx-packed binary)
+    /sheaf/v1.0.0/sheaf-linux-amd64.zip                zip (same binary)
     /sheaf/v1.0.0/sheaf-1.0.0-source.tar.gz            git archive of the tag
     /sheaf/v1.0.0/sheaf-bin-1.0.0-1-x86_64.pkg.tar.zst pacman package (see below)
     /sheaf/v1.0.0/sheaf-1.0.0-x86_64.AppImage         AppImage (zstd-compressed)
     /sheaf/v1.0.0/sheaf-1.0.0-x86_64.AppImage.zsync   zsync delta-update control file
     /sheaf/v1.0.0/SHA256SUMS.txt                       sha256 for all of the above
 
+Only amd64 is published for now (arm64 was dropped to fit the spindle
+microvm timeout). The loose extensionless raw binary is deliberately *not*
+published on its own — extensionless paths 308-redirect into a 404 on
+Tangled Pages — so it ships only inside the `.tar.gz` and `.zip`.
+
 The AppImage also lands in a stable alias directory that is refreshed on
 every release: