diff --git a/.github/actions/build-php-images/action.yml b/.github/actions/build-php-images/action.yml
index 194a628d..b0aa6c25 100644
--- a/.github/actions/build-php-images/action.yml
+++ b/.github/actions/build-php-images/action.yml
@@ -113,8 +113,10 @@ runs:
         username: ${{ inputs.ghcr_token && inputs.ghcr_user || github.actor }}
         password: ${{ inputs.ghcr_user && inputs.ghcr_token || inputs.github_token }}
 
+    # QEMU is required only when this runner cannot execute the target
+    # architecture. Native amd64 and arm64 builds skip it.
     - name: Set up QEMU
-      if: ${{ !(runner.arch == 'X64' && startsWith(inputs.platform, 'linux/amd64')) }}
+      if: ${{ (runner.arch == 'X64' && !startsWith(inputs.platform, 'linux/amd64')) || (runner.arch == 'ARM64' && !startsWith(inputs.platform, 'linux/arm64')) }}
       uses: docker/setup-qemu-action@v4
 
     - name: Set up Docker Buildx
diff --git a/AGENTS.md b/AGENTS.md
index abbe2022..f3751189 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -20,7 +20,7 @@ Images are published to Docker Hub as `devpanel/php:<version>-<variant>` (e.g. `
 ```
 base/                         # Shared base Dockerfile (PHP + Apache)
   Dockerfile
-  bin/                        # DevPanel CLI binary
+  bin/                        # devpanel CLI binaries from devpanel/cli, named devpanel-$arch
   drush/                      # Drush version directories (drush7–drush11)
   scripts/                    # Apache startup scripts
   templates/                  # Apache/PHP config templates
diff --git a/README.md b/README.md
index 72b29456..44741cfc 100644
--- a/README.md
+++ b/README.md
@@ -31,9 +31,9 @@ Each PHP version ships three layered variants.
 
 Release candidate tags end with `-rc` (e.g. `8.3-base-rc`).
 
-The bundled legacy `devpanel` CLI is AMD64-only, including in ARM64 images.
-Executing it on an ARM64 host requires AMD64 emulation on that host; CI runner
-emulation is not included in the published images.
+Each image includes the `devpanel` CLI built from
+[devpanel/cli](https://github.com/devpanel/cli) for its own architecture
+(`base/bin/devpanel-amd64` or `base/bin/devpanel-arm64`).
 
 Available PHP versions: **7.4 · 8.0 · 8.1 · 8.2 · 8.3**
 
@@ -184,6 +184,10 @@ removed).  To remove all `devpanel-php-test:*` images at once, run:
 bash tests/cleanup-test-images.sh
 ```
 
+The image build copies the committed `base/bin/devpanel-amd64` or
+`base/bin/devpanel-arm64` binary from
+[devpanel/cli](https://github.com/devpanel/cli).
+
 Build tests take several minutes per PHP version because the images download
 packages (code-server, composer, etc.).  Run a single version during
 development to keep the feedback loop short:
@@ -286,9 +290,10 @@ for setup instructions.
 - The build workflow is `docker-build.yml`, which handles both push-triggered
   and manual dispatch builds.  It runs a detect → build (per-platform,
   parallel) → merge pipeline.  ARM64 builds use native `ubuntu-26.04-arm`
-  runners; AMD64 builds use `ubuntu-26.04`. QEMU is set up on ARM runners
-  to execute the bundled AMD64 DevPanel CLI, and for cross-platform builds.
-  Native AMD64 builds skip QEMU.
+  runners; AMD64 builds use `ubuntu-26.04`. Each image copies the committed
+  `devpanel` binary for its platform.
+  QEMU is set up only when the runner architecture differs from that
+  platform. Native AMD64 and ARM64 builds skip QEMU.
 - The `advance` variant depends on `secure`, which depends on `base`.
   The build chain is enforced via the bake target dependency graph.
 
diff --git a/TODO.md b/TODO.md
index a7fa5f1f..1985eacc 100644
--- a/TODO.md
+++ b/TODO.md
@@ -102,3 +102,41 @@ Use this file to track work that needs to be done. Lint scripts automatically ap
 - Legacy images use a PEAR release with HTTP chunked response decoding.
 - OPcache remains loaded on every PHP version without enabling a nonexistent PHP 8.5 shared module.
 - Focused checks pass; any remaining build or CI blockers are explicitly reported.
+
+# Task: Install the platform-matching DevPanel CLI
+
+## Steps
+- [x] Copy `base/bin/devpanel-${TARGETARCH}` in the shared image build.
+- [x] Download the matching release asset from `devpanel/dp-cli` before publish builds.
+- [x] Register QEMU only when the runner architecture differs from the target platform.
+- [x] Document the architecture-specific CLI and the native-build QEMU skip.
+- [x] Run YAML, shell, and Dockerfile lint; self-test asset selection and the amd64 fallback.
+
+## Definition of Done
+- ARM64 image builds install an arm64 `devpanel` binary from `devpanel/dp-cli`.
+- Native AMD64 and ARM64 builds do not register QEMU. Cross-architecture builds still do.
+- YAML, shell, and Dockerfile lint baselines match, and the changed files contain no secrets.
+
+# Task: Use GHCR_TOKEN for the latest DevPanel CLI
+
+## Steps
+- [x] Download the latest `devpanel/dp-cli` release with `GHCR_TOKEN` when that secret is set.
+- [x] Remove the release-version input.
+- [x] Verify the committed fallback CLIs with `devpanel cli:version`.
+- [x] Keep the committed `base/bin/devpanel-amd64` and `devpanel-arm64` binaries when `GHCR_TOKEN` is unset.
+
+## Definition of Done
+- Builds with `GHCR_TOKEN` install the latest platform-matching CLI from `devpanel/dp-cli`.
+- Builds without that token use the committed fallback binary and `devpanel cli:version` succeeds.
+- There is no input for pinning a CLI release.
+
+# Task: Build the DevPanel CLI from devpanel/cli
+
+## Steps
+- [x] Confirm the original `base/bin/devpanel` binary is `github.com/devpanel/cli/cmd/devpanel-client`.
+- [x] Restore that amd64 binary and stop downloading `devpanel/dp-cli` during image builds.
+- [x] Verify the restored amd64 binary with `devpanel version`.
+
+## Definition of Done
+- Image builds copy `base/bin/devpanel-$TARGETARCH` and run `devpanel version`.
+- The committed amd64 binary is the original `github.com/devpanel/cli` executable.
diff --git a/base/Dockerfile b/base/Dockerfile
index 6c243dcb..fb55c215 100644
--- a/base/Dockerfile
+++ b/base/Dockerfile
@@ -294,7 +294,10 @@ RUN a2enmod rewrite remoteip headers
 
 # Copy shared assets from the 'common' build context (./base/ directory).
 # Per-version Dockerfiles may overlay version-specific files on top.
-COPY --from=common bin/devpanel /usr/local/bin/devpanel
+# devpanel-$TARGETARCH is the CLI for this image, built from
+# https://github.com/devpanel/cli (package cmd/devpanel-client).
+ARG TARGETARCH
+COPY --from=common bin/devpanel-${TARGETARCH} /usr/local/bin/devpanel
 RUN chmod +x /usr/local/bin/devpanel && devpanel version
 COPY --from=common templates /templates
 COPY --from=common scripts   /scripts
diff --git a/base/bin/devpanel b/base/bin/devpanel-amd64
similarity index 100%
rename from base/bin/devpanel
rename to base/bin/devpanel-amd64