diff --git a/CHANGELOG.md b/CHANGELOG.md
index 85da748..795b57c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.7] - 2026-06-12
+
+### Fixed
+
+- **arm64 base reverted to Ubuntu 24.04**: Ubuntu 26.04 ships Python 3.14, not 3.13 — `python3.13` was not locatable in its repos. Reverted arm64 base to `ubuntu:24.04`.
+- **Deadsnakes PPA now uses curl+gpg instead of `add-apt-repository`**: `add-apt-repository` spawns a gpg-agent which crashes under QEMU (arm64 CI). The PPA is now added by fetching the key via `curl` and piping through `gpg --dearmor` — no agent, works on both architectures.
+- **PPA conditional removed**: both amd64 (Ubuntu 22.04 CUDA) and arm64 (Ubuntu 24.04) now go through the same deadsnakes install path, eliminating the per-arch branching and the `ARG TARGETARCH` dependency in RUN commands.
+
 ## [0.2.6] - 2026-06-12
 
 ### Fixed
diff --git a/Dockerfile b/Dockerfile
index a894fc5..5c8df9f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,28 +1,29 @@
 # ── Platform-conditional base ─────────────────────────────────────────────
-#   amd64:  NVIDIA CUDA 12.6 (GPU acceleration when available, CPU fallback)
-#   arm64:  Ubuntu 26.04 (CPU-only; no CUDA on ARM)
+#   amd64:  NVIDIA CUDA 13.3 (GPU acceleration when available, CPU fallback)
+#   arm64:  Ubuntu 24.04 (CPU-only; no CUDA on ARM)
 
 FROM --platform=$BUILDPLATFORM nvidia/cuda:13.3.0-cudnn-runtime-ubuntu22.04 AS base-amd64
-FROM --platform=$BUILDPLATFORM ubuntu:26.04 AS base-arm64
+FROM --platform=$BUILDPLATFORM ubuntu:24.04 AS base-arm64
 
 # ── Build stage ───────────────────────────────────────────────────────────
 ARG TARGETARCH
 
 FROM base-${TARGETARCH} AS build
 
-ARG TARGETARCH
 ENV DEBIAN_FRONTEND=noninteractive
 
-# amd64 (Ubuntu 22.04 CUDA base): Python 3.13 via deadsnakes PPA
-# arm64 (Ubuntu 26.04): Python 3.13 available natively in repos
+# Both bases use Ubuntu 22.04 or 24.04 — neither has python3.13 natively.
+# Add the deadsnakes PPA using curl+gpg (no gpg-agent, safe under QEMU).
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
     curl \
-    && if [ "$TARGETARCH" = "amd64" ]; then \
-        apt-get install -y --no-install-recommends gnupg software-properties-common \
-        && add-apt-repository ppa:deadsnakes/ppa -y \
-        && apt-get update; \
-    fi \
+    gnupg \
+    && curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xBA6932366A755776" \
+        | gpg --dearmor > /usr/share/keyrings/deadsnakes-archive-keyring.gpg \
+    && . /etc/os-release \
+    && echo "deb [signed-by=/usr/share/keyrings/deadsnakes-archive-keyring.gpg] https://ppa.launchpad.net/deadsnakes/ppa/ubuntu ${VERSION_CODENAME} main" \
+        > /etc/apt/sources.list.d/deadsnakes.list \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
     python3.13 python3.13-venv python3.13-dev \
     libgl1 libglib2.0-0 libxext6 g++ \
@@ -48,20 +49,23 @@ RUN chmod +x /app/entrypoint.sh
 
 FROM base-${TARGETARCH} AS runtime
 
-ARG TARGETARCH
 ENV DEBIAN_FRONTEND=noninteractive
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
+    curl \
+    gnupg \
     tini \
-    && if [ "$TARGETARCH" = "amd64" ]; then \
-        apt-get install -y --no-install-recommends gnupg software-properties-common \
-        && add-apt-repository ppa:deadsnakes/ppa -y \
-        && apt-get update; \
-    fi \
+    && curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xBA6932366A755776" \
+        | gpg --dearmor > /usr/share/keyrings/deadsnakes-archive-keyring.gpg \
+    && . /etc/os-release \
+    && echo "deb [signed-by=/usr/share/keyrings/deadsnakes-archive-keyring.gpg] https://ppa.launchpad.net/deadsnakes/ppa/ubuntu ${VERSION_CODENAME} main" \
+        > /etc/apt/sources.list.d/deadsnakes.list \
+    && apt-get update \
     && apt-get install -y --no-install-recommends \
     python3.13 python3.13-venv \
     libgl1 libglib2.0-0 libxext6 \
+    && apt-get purge -y --auto-remove curl gnupg \
     && rm -rf /var/lib/apt/lists/* \
     && ln -sf /usr/bin/python3.13 /usr/bin/python3
 
diff --git a/pyproject.toml b/pyproject.toml
index bd96b79..19be510 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "winnow"
-version = "0.2.6"
+version = "0.2.7"
 description = "Immich to Frigate training sets"
 license = "MIT"
 requires-python = ">=3.13"
diff --git a/uv.lock b/uv.lock
index 6e90b03..559e437 100644
--- a/uv.lock
+++ b/uv.lock
@@ -2193,7 +2193,7 @@ wheels = [
 
 [[package]]
 name = "winnow"
-version = "0.2.6"
+version = "0.2.7"
 source = { editable = "." }
 dependencies = [
     { name = "croniter" },