diff --git a/generator/render.py b/generator/render.py
index 0d3c14b..f4a9e48 100644
--- a/generator/render.py
+++ b/generator/render.py
@@ -156,16 +156,26 @@ def render_split(manifest: dict) -> dict:
             f"      # {line}\n" if line else "      #\n"
             for line in leg["entrypoint_comment"].rstrip("\n").splitlines()
         )
+        tag_event_line = "  - event: tag\n" if manifest.get("when_tag_event", True) else ""
+        publish_flag = " -- --publish" if leg.get("publish_flag", True) else ""
+        default_setup_comment = (
+            f"nix.conf substituters + {git_host} netrc (to fetch the parity-lib\n"
+            "flake input). Same bootstrap as flake-hub/ci/setup.sh."
+        )
+        setup_comment = _comment_block(leg.get("setup_comment", default_setup_comment), "      ")
         out[f"{arch}.yaml"] = tmpl.format(
             repo=repo,
             nix_system=leg["nix_system"],
             arch=arch,
             header=header,
             entrypoint_comment=entrypoint_comment,
+            tag_event_line=tag_event_line,
+            setup_comment=setup_comment,
             git_host=git_host,
             image=leg["image"],
             setup_script=setup_script,
             app=leg["app"],
+            publish_flag=publish_flag,
         )
     return out
 
diff --git a/generator/templates/split/PERARCH.yaml.tmpl b/generator/templates/split/PERARCH.yaml.tmpl
index 7a66a57..95d2330 100644
--- a/generator/templates/split/PERARCH.yaml.tmpl
+++ b/generator/templates/split/PERARCH.yaml.tmpl
@@ -2,8 +2,7 @@
 when:
   - event: push
     branch: main
-  - event: tag
-
+{tag_event_line}
 clone:
   - name: clone
     image: woodpeckerci/plugin-git
@@ -33,7 +32,5 @@ steps:
           pipeline-number: "${{CI_PIPELINE_NUMBER}}"
     commands:
       - echo "▸ arch=$(uname -m)"
-      # nix.conf substituters + {git_host} netrc (to fetch the parity-lib
-      # flake input). Same bootstrap as flake-hub/ci/setup.sh.
-      - sh {setup_script}
-{entrypoint_comment}      - PUBLISH=1 nix run .#{app} -- --publish
+{setup_comment}      - sh {setup_script}
+{entrypoint_comment}      - PUBLISH=1 nix run .#{app}{publish_flag}
diff --git a/manifests/flake-hub.yaml b/manifests/flake-hub.yaml
new file mode 100644
index 0000000..a1f52e0
--- /dev/null
+++ b/manifests/flake-hub.yaml
@@ -0,0 +1,36 @@
+repo: flake-hub
+kind: split
+git_host: git.oleks.space
+setup_script: ci/setup.sh
+when_tag_event: false
+legs:
+  amd64:
+    nix_system: x86_64-linux
+    image: git.oleks.space/oleks/nix-ci:latest
+    app: publish
+    publish_flag: false
+    setup_comment: ""
+    header: |
+      # Build flake-hub packages for x86_64-linux and push to attic.
+      # Separate workflow per arch — sharing one PVC across arches makes
+      # the second pod permanently Unschedulable (PV node affinity binds
+      # to the first arch's node).
+    entrypoint_comment: |
+      Same front door as a local `nix run .#publish -- --publish`. The app
+      is parity-lib's mkAtticClosurePublish (attic-closure archetype); CI and
+      local share one audited impl. PUBLISH=1 makes it actually push (local
+      runs dry-run).
+  arm64:
+    nix_system: aarch64-linux
+    image: git.oleks.space/oleks/nix-ci:latest
+    app: publish-aarch64-linux
+    publish_flag: false
+    setup_comment: ""
+    header: |
+      # Build flake-hub packages for aarch64-linux and push to attic.
+      # Separate workflow per arch — see amd64.yaml for rationale.
+    entrypoint_comment: |
+      NODE-BOUND LEG (emmett#44, cluster#192): aarch64-linux can't be built on
+      emmett (linux/amd64) and these native packages have no cross path, so this
+      leg must run on an aarch64 node (the arch nodeSelector above). Same
+      parity-lib attic-closure front door as amd64, only the arch app differs.