diff --git a/roles/web-app-checkmk/meta/services.yml b/roles/web-app-checkmk/meta/services.yml
index 6173504b02..2e3a68d360 100644
--- a/roles/web-app-checkmk/meta/services.yml
+++ b/roles/web-app-checkmk/meta/services.yml
@@ -49,6 +49,9 @@ prometheus:
   shared: "{{ 'web-app-prometheus' in group_names }}"
 # nocheck: playwright-service-flag  self-provider
 checkmk:
+  # nocheck: architecture-pin  Reason: checkmk ships the Raw edition as an appliance image only, and every 2.4 and 2.5 tag of checkmk/check-mk-raw answers with a single linux/amd64 manifest, so there is nothing to pin to and nothing to build from
+  architectures:
+    - amd64
   enabled: true
   shared: true
   bond: 1
diff --git a/roles/web-app-chess/meta/services.yml b/roles/web-app-chess/meta/services.yml
index a147ac34e8..f74d3d5581 100644
--- a/roles/web-app-chess/meta/services.yml
+++ b/roles/web-app-chess/meta/services.yml
@@ -23,6 +23,9 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 chess:
+  # nocheck: architecture-pin  Reason: the published v1.0.1 of ghcr.io/kevinveenbirkenbach/fedi-chess is a single linux/amd64 manifest; its workflow now builds linux/amd64,linux/arm64, so the next release makes this declaration removable
+  architectures:
+    - amd64
   healthcheck:
     flavor: curl
   modes:
diff --git a/roles/web-app-decidim/meta/services.yml b/roles/web-app-decidim/meta/services.yml
index a764a122c0..5c5413298c 100644
--- a/roles/web-app-decidim/meta/services.yml
+++ b/roles/web-app-decidim/meta/services.yml
@@ -27,6 +27,9 @@ postgres:
   shared: "{{ 'svc-db-postgres' in group_names }}"
   enabled: true # nocheck: dynamic-flag
 decidim:
+  # nocheck: architecture-pin  Reason: ghcr.io/decidim/decidim publishes a single linux/amd64 manifest and upstream offers no arm64 tag, so reaching arm64 means building the Rails application from source the way web-app-pretix does, which this role does not
+  architectures:
+    - amd64
   healthcheck:
     flavor: curl
     path: up
diff --git a/roles/web-app-pixelfed/meta/services.yml b/roles/web-app-pixelfed/meta/services.yml
index be8a82d596..1f621849a8 100644
--- a/roles/web-app-pixelfed/meta/services.yml
+++ b/roles/web-app-pixelfed/meta/services.yml
@@ -40,6 +40,9 @@ mariadb:
   shared: "{{ 'svc-db-mariadb' in group_names }}"
 # nocheck: playwright-service-flag — self-provider
 pixelfed:
+  # nocheck: architecture-pin  Reason: zknt/pixelfed publishes a single linux/amd64 manifest; the official ghcr.io/pixelfed/pixelfed does carry arm64 but serves FrankenPHP and Caddy on 8080 out of /var/www/html where this role expects nginx on 80 out of /var/www, so adopting it is a rewrite of the role rather than a repin
+  architectures:
+    - amd64
   modes:
     compose:
       enabled: true
diff --git a/roles/web-app-taiga/meta/services.yml b/roles/web-app-taiga/meta/services.yml
index d66c2fe8c6..8e221004ae 100644
--- a/roles/web-app-taiga/meta/services.yml
+++ b/roles/web-app-taiga/meta/services.yml
@@ -35,6 +35,9 @@ postgres:
   enabled: true # nocheck: dynamic-flag
   shared: "{{ 'svc-db-postgres' in group_names }}"
 taiga:
+  # nocheck: architecture-pin  Reason: every tag of taiga-back, taiga-front, taiga-events and taiga-protected answers with a single linux/amd64 manifest, so arm64 would mean building all four of the stack's images from source rather than one
+  architectures:
+    - amd64
   healthcheck:
     test: ["CMD", "python", "-c", "import socket; socket.create_connection(('127.0.0.1',8000),5).close()"]
     retries: 5