diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 13ece8599..0291857a5 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,4 +1,4 @@
-on: [ pull_request, push, workflow_dispatch ]
+on: [ pull_request, push, workflow_dispatch, merge_group]
 name: ci
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ref: ${{ github.event.pull_request.head.sha }}
         fetch-depth: 0
@@ -89,7 +89,7 @@ jobs:
       fail-fast: false
     name: ${{matrix.name}}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
        ref: ${{ github.event.pull_request.head.sha }}
        fetch-depth: 0
@@ -100,10 +100,11 @@ jobs:
         github.ref != 'refs/heads/master'
       run: |
         # Ensure git-describe works on a tag.
-        #  (checkout@v2 action may have left current tag as
+        #  (checkout@v3 action may have left current tag as
         #   lightweight instead of annotated. See
         #   https://github.com/actions/checkout/issues/290)
         #
+        echo github.ref == ${{ github.ref }} ;
         git fetch -f origin ${{ github.ref }}:${{ github.ref }} ;
         echo git describe now reports $(git describe --always)
 
@@ -117,6 +118,15 @@ jobs:
         pip3 install --upgrade pip ;
         pip3 install --upgrade --force-reinstall coverage ;
 
+
+    - name: docker buildx
+      uses: docker/setup-buildx-action@v2
+      if: matrix.needs_buildx
+
+    - uses: dbhi/qus/action@main
+      with:
+        targets: aarch64
+
     - name: docker-run-checks
       env: ${{matrix.env}}
       run: ${{matrix.command}}
@@ -155,6 +165,23 @@ jobs:
         prerelease: true
         body: |
           View [Release Notes](https://github.com/${{ github.repository }}/blob/${{ matrix.tag }}/NEWS.md) for flux-sched ${{ matrix.tag }}
+  generate-manifest:
+    name: Generate docker manifest
+    runs-on: ubuntu-latest
+    needs: [ci-checks]
+    env:
+      DOCKER_REPO: fluxrm/flux-core
+      DOCKER_USERNAME: travisflux
+      DOCKER_PASSWORD: ${{ secrets.DOCKER_HUB_TRAVISFLUX_TOKEN }}
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+    - name: make and push manifest as fluxrm/flux-core
+      if: >
+        (startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/master')
+      run: |
+        echo "$DOCKER_PASSWORD" | docker login -u "$DOCKER_USERNAME" --password-stdin
+        docker manifest create fluxrm/flux-core:bookworm fluxrm/flux-core:bookworm-amd64 fluxrm/flux-core:bookworm-386 fluxrm/flux-core:bookworm-arm64
+        docker manifest push fluxrm/flux-core:bookworm
 
     - name: upload tarball
       id: upload-tarball
diff --git a/src/test/generate-matrix.py b/src/test/generate-matrix.py
index 68ecb81ef..d597c434c 100755
--- a/src/test/generate-matrix.py
+++ b/src/test/generate-matrix.py
@@ -168,6 +168,7 @@ def __str__(self):
 matrix.add_build(
     name="bookworm - test-install",
     env=dict(TEST_INSTALL="t"),
+    platform="linux/amd64",
     docker_tag=True,
 )