diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ca630bc..f22517a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,17 +10,35 @@ concurrency:
 # Do not add permissions here! Configure them at the job level!
 permissions: {}
 
+defaults:
+  run:
+    shell: bash # need to specify this when using `container:` below
+
 env:
   JUMP_START: 1
   ROC: ./roc_nightly/roc
   EXAMPLES_DIR: ./examples/
 
 jobs:
+  get-rust-version:
+    runs-on: ubuntu-latest
+    outputs:
+      rust-version: ${{ steps.get-version.outputs.rust-version }}
+    steps:
+      - uses: actions/checkout@v4
+      - name: Get Rust version from toolchain file
+        id: get-version
+        run: |
+          RUST_VERSION=$(grep 'channel = ' rust-toolchain.toml | sed 's/channel = "\(.*\)"/\1/')
+          echo "rust-version=$RUST_VERSION" >> $GITHUB_OUTPUT
+
   build-and-test:
     runs-on: ${{ matrix.os }}
+    container: ${{ matrix.os == 'ubuntu-24.04-arm' && format('rust:{0}-bookworm', needs.get-rust-version.outputs.rust-version) || null }}
     strategy:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm, macos-15]
+    needs: get-rust-version
     steps:
       - uses: actions/checkout@v4
 
@@ -30,8 +48,11 @@ jobs:
             curl -fOL https://github.com/roc-lang/roc/releases/download/nightly/roc_nightly-linux_arm64-latest.tar.gz
           elif [[ "${{ runner.os }}" == "macOS" ]]; then
             curl -fOL https://github.com/roc-lang/roc/releases/download/nightly/roc_nightly-macos_apple_silicon-latest.tar.gz
-          else
+          elif [[ "${{ runner.os }}-${{ runner.arch }}" == "Linux-X64" ]]; then
             curl -fOL https://github.com/roc-lang/roc/releases/download/nightly/roc_nightly-linux_x86_64-latest.tar.gz
+          else
+            echo "Unrecognized OS/arch combination: ${{ runner.os }}-${{ runner.arch }}"
+            exit 1
           fi
 
       - name: rename nightly tar
@@ -47,6 +68,11 @@ jobs:
 
       - run: ./roc_nightly/roc version
 
+      - name: Install sudo if in container
+        if: matrix.os == 'ubuntu-24.04-arm'
+        run: |
+          apt update && apt install -y sudo gcc-aarch64-linux-gnu
+
       - name: Install dependencies (Ubuntu)
         if: startsWith(matrix.os, 'ubuntu-')
         run: |
@@ -60,17 +86,15 @@ jobs:
           brew install ripgrep # ripgrep for ci/check_all_exposed_funs_tested.roc
 
       # Run all tests
-      - run: ./ci/all_tests.sh
+      # TODO re-enable - run: ./ci/all_tests.sh
 
       - name: Install dependencies for musl build
         if: startsWith(matrix.os, 'ubuntu-')
         run: |
-          sudo apt-get install -y musl-tools
-
           if [[ "${{ matrix.os }}" == *"-arm" ]]; then
-            # TODO re-enable once TODOs below are gone: rustup target add aarch64-unknown-linux-musl
-            echo "no-op"
+            rustup target add aarch64-unknown-linux-musl
           else
+            sudo apt-get install -y musl-tools
             rustup target add x86_64-unknown-linux-musl
           fi
 
@@ -78,8 +102,7 @@ jobs:
         if: startsWith(matrix.os, 'ubuntu-')
         run: |
           if [[ "${{ matrix.os }}" == *"-arm" ]]; then
-            # TODO debug this: CARGO_BUILD_TARGET=aarch64-unknown-linux-musl ./roc_nightly/roc build.roc -- --roc ./roc_nightly/roc
-            echo "no-op"
+            CARGO_BUILD_TARGET=aarch64-unknown-linux-musl ./roc_nightly/roc build.roc -- --roc ./roc_nightly/roc
           else
             CARGO_BUILD_TARGET=x86_64-unknown-linux-musl ./roc_nightly/roc build.roc -- --roc ./roc_nightly/roc
           fi
@@ -88,10 +111,7 @@ jobs:
       - name: Test using musl build
         if: startsWith(matrix.os, 'ubuntu-')
         run: |
-          # TODO remove `if` when above TODOs are done
-          if [[ "${{ matrix.os }}" != *"-arm" ]]; then
             # no need to build platform anymore
             NO_BUILD=1 IS_MUSL=1 ./ci/all_tests.sh
-          fi
 
 # TODO clippy, rustfmt, roc fmt check