diff --git a/CHANGELOG.md b/CHANGELOG.md
index a5c2159f..21783e7a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,12 @@
 - A new Policy/v3 registration records the share key its content source names (`share/<shareId>` on the owner's `default` network) in the registration's transaction, so publishing a share needs no `tinycloud.encryption/key.create` grant: the publisher encrypts to the key's public key and registers. A missing key is created at `keyVersion` 1 and counts toward the network's key limit; at the limit the registration answers 403 `key_limit_exceeded` and stores nothing. An existing key keeps its state. The registration now also requires the source's network to exist and be active. Docs: `docs/encryption-named-keys.md`. Details: TC-2525
 - Share-email issuer trust bundles can pin one next key for the same issuer DID during an explicit UTC overlap window. The legacy key stops at `issuerNotAfter`; malformed, duplicate, unbounded or expired overlaps fail startup and `--validate-config`. Existing single-key bundles remain unchanged. This is node-side trust support only: the OpenCredentials witness and js-sdk policy contract must also support key rotation before activation. Older node images reject overlap fields; restore the previous single-key bundle before rollback. See `deploy/share-email/production-trust-bundle-contract.md`.
 
+## [1.25.21] - 2026-11-10
+
+### Changes
+
+- Release binaries for Apple Silicon Macs (macOS arm64) are published again. Details: TC-2728
+
 ## [1.25.20] - 2026-11-10
 
 ### Changes
diff --git a/Cargo.lock b/Cargo.lock
index 56c4d2e4..1d36fea5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9953,7 +9953,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.25.20"
+version = "1.25.21"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/Cargo.toml b/Cargo.toml
index 4d2f8c67..45ce3f94 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -115,3 +115,6 @@ publish-jobs = ["homebrew"]
 cargo-dist-version = "0.32.0"
 # Path that installers should place binaries in
 install-path = "CARGO_HOME"
+
+[workspace.metadata.dist.github-custom-runners]
+aarch64-apple-darwin = "macos-15"
diff --git a/test/m1-realdata-e2e/Cargo.lock b/test/m1-realdata-e2e/Cargo.lock
index a30a7077..27dc75b0 100644
--- a/test/m1-realdata-e2e/Cargo.lock
+++ b/test/m1-realdata-e2e/Cargo.lock
@@ -8019,7 +8019,7 @@ dependencies = [
 
 [[package]]
 name = "tinycloud-node"
-version = "1.25.20"
+version = "1.25.21"
 dependencies = [
  "aes-gcm",
  "anyhow",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index a44fe6c8..bdab3387 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "tinycloud-node"
 build = "build.rs"
-version = "1.25.20"
+version = "1.25.21"
 authors = ["TinyCloud Protocol"]
 edition = "2021"
 description = "TinyCloud Protocol Node"