diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d3e29bfe..2b16f277 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -114,6 +114,5 @@ jobs:
   # if everything succeeds and PR is ready for review, test the release/package process
   release-builds:
     if: (github.event_name == 'pull_request' && github.event.pull_request.draft == false) || github.event_name == 'workflow_dispatch'
-    needs:
-    - tests-pass
+    needs: tests-pass
     uses: ./.github/workflows/release-build.yml
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index fe408e98..f0c44965 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -23,7 +23,7 @@ jobs:
           - { o: macos-latest,    t: aarch64-apple-darwin                     }
           - { o: ubuntu-20.04,    t: x86_64-unknown-linux-gnu                 }
           - { o: ubuntu-20.04,    t: armv7-unknown-linux-gnueabihf,   c: true }
-          - { o: ubuntu-20.04,    t: aarch64-unknown-linux-gnu,       c: true }
+          - { o: ubuntu-20.04,    t: aarch64-unknown-linux-gnu                }
           - { o: ubuntu-latest,   t: x86_64-unknown-linux-musl                }
           - { o: ubuntu-latest,   t: armv7-unknown-linux-musleabihf,  c: true }
           - { o: ubuntu-latest,   t: aarch64-unknown-linux-musl,      c: true }
diff --git a/justfile b/justfile
index 92ed4389..88d79775 100644
--- a/justfile
+++ b/justfile
@@ -46,15 +46,12 @@ ci-or-no := if ci != "" { "ci" } else { "noci" }
 
 # In release builds in CI, build the std library ourselves so it uses our
 # compile profile, and optimise panic messages out with immediate abort.
-#
-# explicitly disabled on aarch64-unknown-linux-gnu due to a failing build
 cargo-buildstd := if (cargo-profile / ci-or-no) == "release/ci" {
-    if target == "aarch64-unknown-linux-gnu" { ""
-    } else { " -Z build-std=std,panic_abort -Z build-std-features=panic_immediate_abort" }
-} else { "" }
+    " -Z build-std=std,panic_abort -Z build-std-features=panic_immediate_abort"
+    } else { "" }
 
 # In musl release builds in CI, statically link gcclibs.
-cargo-gcclibs := if (cargo-profile / ci-or-no / target-libc) == "release/ci/musl" {
+rustc-gcclibs := if (cargo-profile / ci-or-no / target-libc) == "release/ci/musl" {
     " -C link-arg=-lgcc -C link-arg=-static-libgcc"
 } else { "" }
 
@@ -79,12 +76,23 @@ cargo-split-debuginfo := if cargo-buildstd != "" { " --config='profile.release.s
 # this should be unnecessary once ring 0.17 is released
 win-arm64-ring16 := if target == "aarch64-pc-windows-msvc" { " --config='patch.crates-io.ring.git=\"https://github.com/awakecoding/ring\"' --config='patch.crates-io.ring.branch=\"0.16.20_alpha\"'" } else { "" }
 
+# MIR optimisation level (defaults to 2, bring it up to 4 for release builds)
+# disabled for now, as it ICEs
+# https://github.com/rust-lang/rust/issues/106141
+rustc-miropt := "" #if for-release != "" { " -Z mir-opt-level=4" } else { "" }
+
+# ICF: link-time identical code folding
+# disabled for now, as it requires the gold linker
+rustc-icf := "" #if for-release != "" { " -C link-arg=-Wl,--icf=all" } else { "" }
+
 cargo-build-args := (if for-release != "" { " --release" } else { "" }) + (if target != target-host { " --target " + target } else if cargo-buildstd != "" { " --target " + target } else { "" }) + (cargo-buildstd) + (if extra-build-args != "" { " " + extra-build-args } else { "" }) + (cargo-no-default-features) + (cargo-split-debuginfo) + (if cargo-features != "" { " --features " + cargo-features } else { "" }) + (win-arm64-ring16)
-export RUSTFLAGS := (cargo-gcclibs)
+export RUSTFLAGS := (rustc-gcclibs) + (rustc-miropt) + (rustc-icf)
 
 
+# libblocksruntime-dev provides compiler-rt
 ci-apt-deps := if target == "x86_64-unknown-linux-gnu" { "liblzma-dev libzip-dev libzstd-dev"
     } else if target == "x86_64-unknown-linux-musl" { "musl-tools"
+    } else if target == "aarch64-unknown-linux-gnu" { "g++-aarch64-linux-gnu libc6-dev-arm64-cross binutils binutils-aarch64-linux-gnu libblocksruntime-dev"
     } else { "" }
 
 [linux]