diff --git a/.woodpecker/build-amd64.yaml b/.woodpecker/build-amd64.yaml
new file mode 100644
index 0000000..aabbb44
--- /dev/null
+++ b/.woodpecker/build-amd64.yaml
@@ -0,0 +1,36 @@
+# Hand-authored (not generated) for oleks/ci-scripts#14, #15.
+#
+# Deviation from the shared generator's "matrix" kind (which emits one
+# build.yaml with `matrix: {ARCH: [...]}` + `labels: {arch: ${ARCH}}`): a
+# Woodpecker scheduler bug/regression on this cluster's agent version left
+# that unresolved-at-label-matching-time `${ARCH}` literal never matching
+# any agent, so the pipeline sat pending forever with zero dispatch
+# (diagnosed via cluster:ci-agent). Splitting into one file per arch with a
+# hardcoded literal label sidesteps the whole class of bug for this new
+# self-build pipeline. The shared generator's matrix kind still needs an
+# audit across the ~15 repos that use it (see oleks/ci-scripts#12/#13 CI
+# registration + drift-detection work) — not fixed here, flagged on #14.
+when:
+  - event: tag
+    ref: "refs/tags/v*"
+
+labels:
+  arch: amd64
+
+steps:
+  - name: build-and-push
+    image: git.oleks.space/oleks/nix-ci:latest
+    environment:
+      REGISTRY_TOKEN:
+        from_secret: registry_token
+      BUILDKIT_ADDR: "tcp://buildkit-amd64.infra.svc.cluster.local:1234"
+      PUBLISH: "1"
+    commands:
+      - echo "▸ arch=$(uname -m)"
+      - ci/local.sh --arch amd64
+    backend_options:
+      kubernetes:
+        labels:
+          commit-tag: "${CI_COMMIT_TAG}"
+          pipeline-number: "${CI_PIPELINE_NUMBER}"
+          build-arch: amd64
diff --git a/.woodpecker/build-arm64.yaml b/.woodpecker/build-arm64.yaml
new file mode 100644
index 0000000..9dd2a1d
--- /dev/null
+++ b/.woodpecker/build-arm64.yaml
@@ -0,0 +1,27 @@
+# Hand-authored (not generated) for oleks/ci-scripts#14, #15. See
+# build-amd64.yaml for why this is split per-arch instead of using the
+# shared generator's matrix kind (unresolved `${ARCH}` label bug).
+when:
+  - event: tag
+    ref: "refs/tags/v*"
+
+labels:
+  arch: arm64
+
+steps:
+  - name: build-and-push
+    image: git.oleks.space/oleks/nix-ci:latest
+    environment:
+      REGISTRY_TOKEN:
+        from_secret: registry_token
+      BUILDKIT_ADDR: "tcp://buildkit-arm64.infra.svc.cluster.local:1234"
+      PUBLISH: "1"
+    commands:
+      - echo "▸ arch=$(uname -m)"
+      - ci/local.sh --arch arm64
+    backend_options:
+      kubernetes:
+        labels:
+          commit-tag: "${CI_COMMIT_TAG}"
+          pipeline-number: "${CI_PIPELINE_NUMBER}"
+          build-arch: arm64
diff --git a/.woodpecker/build.yaml b/.woodpecker/build.yaml
deleted file mode 100644
index 3e0ba93..0000000
--- a/.woodpecker/build.yaml
+++ /dev/null
@@ -1,38 +0,0 @@
-# GENERATED by oleks/ci-scripts — do not hand-edit.
-# Source manifest: manifests/ci-fleet-publish.yaml
-# Regenerate: python3 generator/render.py manifests/ci-fleet-publish.yaml --out <repo>/.woodpecker
-
-matrix:
-  ARCH:
-    - amd64
-    - arm64
-
-when:
-  - event: tag
-    ref: "refs/tags/v*"
-
-labels:
-  arch: ${ARCH}
-
-# Thin wrapper (cluster #196, emmett#44): CI runs the SAME ci/local.sh a
-# developer runs, so CI and local can't drift. CI-specific bits are env
-# overrides only: BUILDKIT_ADDR -> the in-cluster NATIVE per-arch buildkit
-# (no QEMU), PUBLISH=1 -> actually push. Output is unchanged: a per-arch
-# :<version>-<arch> image, later merged into :<version>+:latest by manifest.yaml.
-steps:
-  - name: build-and-push
-    image: git.oleks.space/oleks/nix-ci:latest
-    environment:
-      REGISTRY_TOKEN:
-        from_secret: registry_token
-      BUILDKIT_ADDR: "tcp://buildkit-${ARCH}.infra.svc.cluster.local:1234"
-      PUBLISH: "1"
-    commands:
-      - echo "▸ arch=$(uname -m)"
-      - ci/local.sh --arch "${ARCH}"
-    backend_options:
-      kubernetes:
-        labels:
-          commit-tag: "${CI_COMMIT_TAG}"
-          pipeline-number: "${CI_PIPELINE_NUMBER}"
-          build-arch: "${ARCH}"
diff --git a/.woodpecker/manifest.yaml b/.woodpecker/manifest.yaml
index ab2cbc6..7c99e2d 100644
--- a/.woodpecker/manifest.yaml
+++ b/.woodpecker/manifest.yaml
@@ -1,21 +1,21 @@
-# GENERATED by oleks/ci-scripts — do not hand-edit.
-# Source manifest: manifests/ci-fleet-publish.yaml
-# Regenerate: python3 generator/render.py manifests/ci-fleet-publish.yaml --out <repo>/.woodpecker
-
+# Hand-authored (not generated) for oleks/ci-scripts#14, #15 — see
+# build-amd64.yaml for why the arch builds are split per-file instead of a
+# single generated matrix build.yaml.
 when:
   - event: tag
     ref: "refs/tags/v*"
 
 depends_on:
-  - build
+  - build-amd64
+  - build-arm64
 
-# oleks/ci-scripts#9: run even if a per-arch matrix leg failed. Without
-# `runs_on`, Woodpecker skips a dependent workflow outright once any leg of
-# `build` fails, so a lone arm64 success would silently produce no image at
-# all. `ci/local.sh --manifest` itself must probe the registry for which
-# per-arch tags actually landed (not assume a fixed arch list, and not rely
-# on step/pipeline success status) and build the manifest from whatever
-# exists — a partial manifest beats none.
+# oleks/ci-scripts#9: run even if a per-arch build failed. Without
+# `runs_on`, Woodpecker skips a dependent workflow outright once any
+# dependency fails, so a lone arm64 success would silently produce no
+# image at all. `ci/local.sh --manifest` itself must probe the registry
+# for which per-arch tags actually landed (not assume a fixed arch list,
+# and not rely on step/pipeline success status) and build the manifest
+# from whatever exists — a partial manifest beats none.
 runs_on:
   - success
   - failure
diff --git a/manifests/ci-fleet-publish.yaml b/manifests/ci-fleet-publish.yaml
deleted file mode 100644
index 64e9f09..0000000
--- a/manifests/ci-fleet-publish.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-repo: ci-fleet-publish
-kind: matrix
-image: git.oleks.space/oleks/nix-ci
-script: ci/local.sh
-arches: [amd64, arm64]
-buildkit_prefix: buildkit