diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 6695e431..a28db4d5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -86,6 +86,23 @@ oci-image:x86_64-unknown-linux-gnu:
     paths:
       - oci-image.tar.gz
 
+oci-image:aarch64-unknown-linux-musl:
+  stage: artifacts
+  needs:
+    # Wait for the static binary job to finish before starting so we don't have
+    # to build that twice for no reason
+    - static:aarch64-unknown-linux-musl
+  image: nixos/nix:2.19.2
+  script:
+    # Push artifacts and build requirements to binary cache
+    - ./bin/nix-build-and-cache .#oci-image-aarch64-unknown-linux-musl
+
+    # Make the output less difficult to find
+    - cp result oci-image.tar.gz
+  artifacts:
+    paths:
+      - oci-image.tar.gz
+
 debian:x86_64-unknown-linux-gnu:
   stage: artifacts
   # See also `rust-toolchain.toml`
diff --git a/flake.nix b/flake.nix
index 5f4df1e1..1bc5c148 100644
--- a/flake.nix
+++ b/flake.nix
@@ -182,6 +182,16 @@
         default = package pkgsHost;
 
         oci-image = mkOciImage pkgsHost self.packages.${system}.default;
+
+        # Build an OCI image from the musl aarch64 build so we don't have to
+        # build for aarch64 twice (to make a gnu version specifically for the
+        # OCI image)
+        oci-image-aarch64-unknown-linux-musl = mkOciImage
+          pkgsHost
+          self.packages.${system}.static-aarch64-unknown-linux-musl;
+
+        # Don't build a musl x86_64 OCI image because that would be pointless.
+        # Just use the gnu one (i.e. `self.packages."x86_64-linux".oci-image`).
       } // builtins.listToAttrs (
         builtins.map
           (crossSystem: {