diff --git a/README.md b/README.md
index d44e754..02b98f3 100644
--- a/README.md
+++ b/README.md
@@ -19,8 +19,8 @@ Cross-compiling for the phone:
 
 ```sh
 packaging/make-sysroot.sh
-crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8-a --mtune=generic
-crafter-build test --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8-a --mtune=generic
+crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720
+crafter-build test --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720
 ```
 
 Verified on the device: all five suites pass cross-built and run on the phone
diff --git a/packaging/build-package.sh b/packaging/build-package.sh
index 14b45f0..d93d8ca 100755
--- a/packaging/build-package.sh
+++ b/packaging/build-package.sh
@@ -76,13 +76,18 @@ retry "make sysroot" "$SRC/packaging/make-sysroot.sh" "$SYSROOT"
 # under ~/.cache/fingerprintd/libqcomtee-<target>, which is this script's
 # default output dir. Needs git, installed above.
 retry "make libqcomtee" "$SRC/packaging/make-libqcomtee.sh" \
-	--target=aarch64-alpine-linux-musl --sysroot="$SYSROOT" --march=armv8-a
+	--target=aarch64-alpine-linux-musl --sysroot="$SYSROOT" --march=armv8.6-a+fp16fml+aes+sha3+sm4
 
 # --- cross-compile the daemon; run the suites natively. The core is portable
 # by construction (no GLib, no libqcomtee, no system headers), which is what
 # lets the wire formats and state machines be tested on the build host at all.
 cd "$SRC"
-XTARGET="--target=aarch64-alpine-linux-musl --sysroot=$SYSROOT --march=armv8-a --mtune=generic"
+# The phone is one SoC, 4x Cortex-A520 + 4x Cortex-A720, so build for it (the
+# same -march goes to libqcomtee above). armv8.6-a is the highest level whose
+# mandatory set it exposes (8.7 would assume WFxT, 9.x SVE2 - neither is in
+# its hwcaps); +fp16fml+aes+sha3+sm4 are the optional extensions it has. Same
+# string as the fp6-img aports.
+XTARGET="--target=aarch64-alpine-linux-musl --sysroot=$SYSROOT --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720"
 crafter-build -- $XTARGET
 crafter-build -- --product=agent $XTARGET
 crafter-build test