diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f96a7b4..09b04e0 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,31 +14,32 @@ permissions:
 
 jobs:
   goreleaser:
-    uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     with:
       go-version-file: go.mod
 
   validate:
     needs: goreleaser
-    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     with:
       packages: |
-        - name: testbed-quadlet*.rpm
+        - name: testbed-quadlet*
           files:
-            - /etc/openchami
-            - /etc/openchami/configs
             - /etc/openchami/configs/testbed.yaml
             - /usr/share/containers/systemd/testbed.container
-            - /usr/share/containers/systemd/testbed.container.d
             - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
-            - /usr/share/licenses/testbed-quadlet
+          rpm-files:
             - /usr/share/licenses/testbed-quadlet/MIT.txt
-        - name: testbed-quadlet*.deb
-          files:
-            - /etc/openchami/configs/testbed.yaml
-            - /usr/share/containers/systemd/testbed.container
-            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+          deb-files:
             - /usr/share/doc/testbed-quadlet/copyright
+        # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet.
+        - name: testbed[-_][0-9]*
+          files:
+            - /usr/bin/testbed
+          rpm-files:
+            - /usr/share/licenses/testbed/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed/copyright
 
   build:
     if: ${{ always() }}
diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
index a94f259..b30808a 100644
--- a/.github/workflows/cleanup.yml
+++ b/.github/workflows/cleanup.yml
@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   cleanup:
-    uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 5e3b672..2f42c1f 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   check:
-    uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     permissions:
       contents: read        # baseline for checkout
       pull-requests: write  # summary comment on the PR
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 166afeb..472a931 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   check:
-    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
 
   govulncheck:
     if: ${{ always() }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f2ba4de..27451c7 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,12 +16,12 @@ permissions:
 
 jobs:
   lint-go:
-    uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     with:
       go-version-file: go.mod
 
   lint-ci:
-    uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     permissions:
       contents: read          # baseline for checkout
       security-events: write  # zizmor SARIF upload to GHAS
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6950544..ae4a60a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,10 +43,9 @@ jobs:
       packages: write      # image push, container provenance
       id-token: write      # Sigstore signing (attest-build-provenance)
       attestations: write  # build provenance attestations
-    uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     with:
       go-version-file: go.mod
-      registry-subject-name: ghcr.io/openchami/github-actions-testbed
     secrets:
       gpg-key: ${{ github.event_name == 'push' && needs.test-key.outputs.gpg-key-b64 || '' }}
 
@@ -54,7 +53,7 @@ jobs:
     # Fork PRs build but don't push, so there is no image to scan.
     needs: goreleaser
     if: ${{ needs.goreleaser.outputs.digest != '' }}
-    uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     permissions:
       contents: read          # baseline for checkout
       security-events: write  # SARIF upload to GHAS
@@ -66,29 +65,30 @@ jobs:
     # PR builds produce no packages (they're validated in build.yml).
     if: ${{ github.event_name == 'push' }}
     needs: goreleaser
-    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     with:
       packages: |
-        - name: testbed-quadlet*.rpm
+        - name: testbed-quadlet*
           files:
-            - /etc/openchami
-            - /etc/openchami/configs
             - /etc/openchami/configs/testbed.yaml
             - /usr/share/containers/systemd/testbed.container
-            - /usr/share/containers/systemd/testbed.container.d
             - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
-            - /usr/share/licenses/testbed-quadlet
+          rpm-files:
             - /usr/share/licenses/testbed-quadlet/MIT.txt
-        - name: testbed-quadlet*.deb
-          files:
-            - /etc/openchami/configs/testbed.yaml
-            - /usr/share/containers/systemd/testbed.container
-            - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf
+          deb-files:
             - /usr/share/doc/testbed-quadlet/copyright
+        # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet.
+        - name: testbed[-_][0-9]*
+          files:
+            - /usr/bin/testbed
+          rpm-files:
+            - /usr/share/licenses/testbed/MIT.txt
+          deb-files:
+            - /usr/share/doc/testbed/copyright
 
   publish:
     if: ${{ github.event_name == 'push' }}
     needs: [goreleaser, validate]
     permissions:
       contents: write   # publish the draft GitHub Release
-    uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
index 57e41ae..8bea6d5 100644
--- a/.github/workflows/reuse.yml
+++ b/.github/workflows/reuse.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   check:
-    uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
 
   reuse:
     if: ${{ always() }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 14b36d4..32d83d0 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -19,7 +19,7 @@ jobs:
       contents: read          # baseline for checkout
       security-events: write  # SARIF upload to GHAS
       id-token: write         # publish results to the OpenSSF dashboard
-    uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
 
   scorecard:
     if: ${{ always() }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index e02ba6b..a8ac2f9 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   stale:
-    uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     permissions:
       issues: write          # label, comment on, and close stale issues
       pull-requests: write   # label, comment on, and close stale PRs
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ad875cf..276392c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   test-unit-go:
-    uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment)
+    uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment)
     with:
       go-version-file: go.mod
       coverage: true
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 6feb306..76d6603 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -60,6 +60,27 @@ dockers_v2:
       org.opencontainers.image.revision: "{{ .FullCommit }}"
       org.opencontainers.image.created: "{{ .Date }}"
       org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed
+  # Second, distinctly named image (different title label, so a different
+  # digest) to exercise per-image attestation.
+  - id: testbed-alt
+    ids: [testbed]
+    dockerfile: Dockerfile
+    images:
+      - ghcr.io/openchami/github-actions-testbed-alt
+    tags:
+      - "{{ .Tag }}"                                   # vX.Y.Z or pr-N
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}.{{ .Minor }}{{ end }}'
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}{{ end }}'
+      - '{{ if ne .Env.IS_PR_BUILD "true" }}latest{{ end }}'
+    platforms:
+      - linux/amd64
+      - linux/arm64
+    labels:
+      org.opencontainers.image.title: "{{ .ProjectName }}-alt"
+      org.opencontainers.image.version: "{{ .Version }}"
+      org.opencontainers.image.revision: "{{ .FullCommit }}"
+      org.opencontainers.image.created: "{{ .Date }}"
+      org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed
 
 nfpms:
   - id: testbed-quadlet
@@ -115,6 +136,35 @@ nfpms:
     rpm:
       signature:
         key_file: "{{ .Env.GPG_KEY_PATH }}"
+  # Binary package: one per goarch, so a single package glob matches several
+  # files across architectures.
+  - id: testbed
+    package_name: testbed
+    ids: [testbed]
+    formats: [rpm, deb]
+    file_name_template: "{{ .ConventionalFileName }}"
+    vendor: OpenCHAMI
+    homepage: https://github.com/OpenCHAMI/github-actions-testbed
+    maintainer: "Sean Tronsen <sean.tronsen@gmail.com>"
+    description: Test binary package for the OpenCHAMI github-actions workflows.
+    license: MIT
+    section: admin
+    contents:
+      - src: LICENSES/MIT.txt
+        dst: /usr/share/licenses/testbed/MIT.txt
+        type: license
+        packager: rpm
+      - src: packaging/deb/copyright
+        dst: /usr/share/doc/testbed/copyright
+        packager: deb
+    overrides:
+      rpm:
+        release: "1.el9"
+      deb:
+        release: "1"
+    rpm:
+      signature:
+        key_file: "{{ .Env.GPG_KEY_PATH }}"
 
 release:
   disable: '{{ if eq .Env.IS_PR_BUILD "true" }}true{{ else }}false{{ end }}'