diff --git a/.cargo/config.toml b/.cargo/config.toml
index 57766cbecde..493077312e1 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -13,5 +13,13 @@ rustflags = ["-C", "target-cpu=x86-64-v3", "--cfg", "tokio_unstable"]
 # Targeting neoverse-n1 covers AWS Graviton2+ and GCP T2A (Ampere Altra).
 # Key gains over generic ARMv8-A: LSE atomics (better concurrency), dot
 # product instructions, and ARMv8.2 crypto extensions.
-rustflags = ["-C", "target-cpu=neoverse-n1", "--cfg", "tokio_unstable"]
-
+# sasl2-sys omits libresolv when HOST != TARGET, but its vendored Kerberos
+# archive still references resolver symbols when cross-compiling for Linux.
+rustflags = [
+  "-C",
+  "target-cpu=neoverse-n1",
+  "-C",
+  "link-arg=-lresolv",
+  "--cfg",
+  "tokio_unstable",
+]
diff --git a/.github/workflows/publish_release_packages.yml b/.github/workflows/publish_release_packages.yml
index f71cf22bdcf..6fc0d94641f 100644
--- a/.github/workflows/publish_release_packages.yml
+++ b/.github/workflows/publish_release_packages.yml
@@ -107,12 +107,12 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ needs.build-lambda.outputs.artifact-name }}
-          # Must be within the workspace so cross can mount it into the build container.
-          path: ./lambda-artifact
+          # `cross` mounts the Rust workspace (`quickwit/`) at `/project` in the container.
+          path: ./quickwit/lambda-artifact
       - name: Set LAMBDA_ZIP_PATH
         run: |
-          ZIP=$(ls lambda-artifact/*.zip)
-          echo "LAMBDA_ZIP_PATH=$(pwd)/$ZIP" >> $GITHUB_ENV
+          ZIP=$(ls quickwit/lambda-artifact/*.zip)
+          echo "LAMBDA_ZIP_PATH=/project/lambda-artifact/$(basename "$ZIP")" >> "$GITHUB_ENV"
       - uses: ./.github/actions/cross-build-binary
         with:
           target: ${{ matrix.target }}
diff --git a/Makefile b/Makefile
index 4f2da23cd93..2d765eba28d 100644
--- a/Makefile
+++ b/Makefile
@@ -71,7 +71,8 @@ IMAGE_TAGS = x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-unknown-l
 
 .PHONY: cross-images
 cross-images:
-	@for tag in ${IMAGE_TAGS}; do \
+	@set -e; \
+	for tag in ${IMAGE_TAGS}; do \
 		docker build --tag quickwit/cross:$$tag --file ./build/cross-images/$$tag.dockerfile ./build/cross-images; \
 		docker push quickwit/cross:$$tag; \
 	done
diff --git a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile
index db0908faf59..0da8de13d60 100644
--- a/build/cross-images/aarch64-unknown-linux-gnu.dockerfile
+++ b/build/cross-images/aarch64-unknown-linux-gnu.dockerfile
@@ -12,14 +12,30 @@ ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5
 # `rdkafka/gssapi-vendored` feature when there is a release including:
 # https://github.com/MaterializeInc/rust-sasl/pull/48
 
+# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled.
 RUN dpkg --add-architecture arm64 && \
     apt-get update && \
     apt-get install -y --no-install-recommends \
         binutils-aarch64-linux-gnu \
+        g++-10-aarch64-linux-gnu \
+        gcc-10-aarch64-linux-gnu \
+        libcurl4-openssl-dev:arm64 \
         libsasl2-dev:arm64 \
         unzip && \
     rm -rf /var/lib/apt/lists/*
 
+# cmake-rs passes vendored dependency prefixes in the CMAKE_PREFIX_PATH
+# environment variable. Materialize that colon-separated value before the
+# cross-rs toolchain constructs its target-only search roots.
+RUN sed -i '/set(CMAKE_FIND_ROOT_PATH /i\    string(REPLACE ":" ";" CMAKE_PREFIX_PATH "$ENV{CMAKE_PREFIX_PATH}")' /opt/toolchain.cmake
+
+# GCC 9.4 is affected by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189.
+# aws-lc cannot execute its compiler probe while cross-compiling, so select the
+# verified GCC 10.5 toolchain explicitly for both compilation and linking.
+ENV CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc-10 \
+    CXX_aarch64_unknown_linux_gnu=aarch64-linux-gnu-g++-10 \
+    CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc-10
+
 RUN curl -fLO $PBC_URL && \
     unzip protoc-21.5-linux-x86_64.zip -d ./protobuf && \
     mv ./protobuf/bin/protoc /usr/bin/ && \
diff --git a/build/cross-images/aarch64-unknown-linux-musl.dockerfile b/build/cross-images/aarch64-unknown-linux-musl.dockerfile
index 3a2be3e81bf..5a5eaefe610 100644
--- a/build/cross-images/aarch64-unknown-linux-musl.dockerfile
+++ b/build/cross-images/aarch64-unknown-linux-musl.dockerfile
@@ -11,6 +11,7 @@ FROM rustembedded/cross:aarch64-unknown-linux-musl@sha256:22627e0ba533781062127b
 # ALSO UPDATE hooks/build!
 ARG OPENSSL_VERSION=1.1.1i
 ARG ZLIB_VERSION=1.2.11
+ARG ZLIB_SHA256=629380c90a77b964d896ed37163f5c3a34f6e6d897311f1df2a7016355c45eff
 
 RUN echo "Building OpenSSL" && \
     cd /tmp && \
@@ -26,7 +27,9 @@ RUN echo "Building OpenSSL" && \
 
 RUN echo "Building zlib" && \
     cd /tmp && \
-    curl -fLO "https://zlib.net/fossils/zlib-$ZLIB_VERSION.tar.gz" && \
+    curl -fL --retry 3 -o "zlib-$ZLIB_VERSION.tar.gz" \
+        "https://github.com/madler/zlib/archive/refs/tags/v$ZLIB_VERSION.tar.gz" && \
+    echo "$ZLIB_SHA256  zlib-$ZLIB_VERSION.tar.gz" | sha256sum --check - && \
     tar xzf "zlib-$ZLIB_VERSION.tar.gz" && cd "zlib-$ZLIB_VERSION" && \
     AR=aarch64-linux-musl-ar CC=aarch64-linux-musl-gcc ./configure --static --prefix=/usr/local/aarch64-linux-musl && \
     make && make install && \
diff --git a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile
index 0e50e6ed366..6280c492c2f 100644
--- a/build/cross-images/x86_64-unknown-linux-gnu.dockerfile
+++ b/build/cross-images/x86_64-unknown-linux-gnu.dockerfile
@@ -7,12 +7,22 @@ FROM ghcr.io/cross-rs/x86_64-unknown-linux-gnu:main@sha256:2431cbfcf2499f8a00570
 
 ARG PBC_URL="https://github.com/protocolbuffers/protobuf/releases/download/v21.5/protoc-21.5-linux-x86_64.zip"
 
+# librdkafka 2.12.1 includes curl/curl.h even when OIDC support is disabled.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
+        g++-10 \
+        gcc-10 \
+        libcurl4-openssl-dev \
         libsasl2-dev \
         unzip && \
     rm -rf /var/lib/apt/lists/*
 
+# GCC 9.4 is affected by https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95189,
+# which aws-lc correctly rejects because it can miscompile memcmp at -O3.
+ENV CC_x86_64_unknown_linux_gnu=gcc-10 \
+    CXX_x86_64_unknown_linux_gnu=g++-10 \
+    CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=gcc-10
+
 RUN curl -fLO $PBC_URL && \
     unzip protoc-21.5-linux-x86_64.zip -d ./protobuf && \
     mv ./protobuf/bin/protoc /usr/bin/ && \