diff --git a/.github/workflows/rust-multiplatform.yml b/.github/workflows/rust-multiplatform.yml
index b4c21e2d5..95ce19bf2 100644
--- a/.github/workflows/rust-multiplatform.yml
+++ b/.github/workflows/rust-multiplatform.yml
@@ -15,6 +15,7 @@ on:
       - 'vendor/skia-safe-op/**'
       - 'rust-toolchain.toml'
       - 'deny.toml'
+      - 'Cross.toml'
       - '.github/workflows/rust-multiplatform.yml'
   pull_request:
     paths:
@@ -23,6 +24,7 @@ on:
       - 'crates/**'
       - 'vendor/jian/**'
       - 'vendor/skia-safe-op/**'
+      - 'Cross.toml'
       - '.github/workflows/rust-multiplatform.yml'
   workflow_dispatch:
 
diff --git a/Cross.toml b/Cross.toml
new file mode 100644
index 000000000..c393f0ee7
--- /dev/null
+++ b/Cross.toml
@@ -0,0 +1,11 @@
+# Cross-compilation config for `cross` (used by the linux-aarch64 CI job).
+#
+# The aarch64 cross build links the `openpencil-desktop` binary, which pulls
+# system freetype + fontconfig at link time (via skia-bindings and
+# sctk-adwaita). The stock cross image only ships host-arch libs, so the
+# target-arch dev packages must be installed into the container before build.
+[target.aarch64-unknown-linux-gnu]
+pre-build = [
+    "dpkg --add-architecture $CROSS_DEB_ARCH",
+    "apt-get update && apt-get --assume-yes install libfreetype-dev:$CROSS_DEB_ARCH libfontconfig1-dev:$CROSS_DEB_ARCH",
+]