diff --git a/README.md b/README.md
index 43db490..a3bdbb6 100644
--- a/README.md
+++ b/README.md
@@ -19,8 +19,8 @@ Cross-compiling for the phone:
 
 ```sh
 packaging/make-sysroot.sh
-crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8-a --mtune=generic
-crafter-build test --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8-a --mtune=generic
+crafter-build -- --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720
+crafter-build test --target=aarch64-alpine-linux-musl --sysroot=~/.cache/fingerprintd/sysroot-aarch64-alpine --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720
 ```
 
 Verified on the device: all five suites pass cross-built and run on the phone
diff --git a/packaging/actions.conf.example b/packaging/actions.conf.example
index bfb6ff9..da6ce1d 100644
--- a/packaging/actions.conf.example
+++ b/packaging/actions.conf.example
@@ -1,19 +1,14 @@
-# fingerprintd — per-finger actions.
+# fingerprintd per-finger actions.
 #
 # Install as /etc/fingerprintd/actions.conf. With no such file, a finger does
 # exactly what it always did: it unlocks.
 #
-# YOU PROBABLY DO NOT NEED THIS FILE. Every matched finger is already
-# announced on the system bus, unconditionally and with nothing configured:
+# This file is for running root scripts on finger actions.
+# For scripts that run in your session, you can use this D-Bus:
 #
 #     net.catcrafts.Fingerprintd1.FingerMatched(finger, uid)
 #     on /net/reactivated/Fprint/Device/0
 #
-# That is how a finger launches an application. An agent in your own session
-# hears the signal and decides what the finger means, from your own
-# configuration, running as you with your bus and your display. The daemon is
-# root and deliberately does not try to do that for you.
-#
 # This file is for the two things that do need the daemon.
 #
 # THIS FILE IS A ROOT SHELL. Every command here is run by root when that
@@ -38,30 +33,18 @@
 #   no-unlock  this finger never unlocks. The client is told it did not match,
 #              whatever really happened.
 #
-#   command    an ABSOLUTE path, passed to /bin/sh -c with a fixed environment
-#              plus FINGERPRINTD_FINGER. Double-forked, so it may outlive the
-#              daemon and can never delay an unlock.
+#   command    an absolute path, passed to /bin/sh -c with a fixed environment
+#              plus FINGERPRINTD_FINGER.
 #
-# At least one of the two is required. A finger listed on its own says nothing
-# the signal above does not already say.
-
 # --- A finger that also does something, as root -----------------------------
 #right-ring-finger    /usr/local/bin/toggle-something
-
-# --- A finger that does not unlock ------------------------------------------
-#left-thumb           no-unlock
-
+#
 # --- A duress finger: rejected, and the script runs anyway ------------------
 #
-# Think carefully before making that script destructive:
-#
-#   * a false accept that opens a camera is a shrug; one that wipes is not,
-#   * and anyone who can compel one unlock can usually compel a second.
-#
-# AND KNOW WHAT THIS IS NOT. It is a panic button, not deniability. The
-# rejection it fabricates is far faster than a real one — a finger the sensor
+# Know what this is not: It is a panic button, not deniability. The
+# rejection it fabricates is far faster than a real one. A finger the sensor
 # genuinely does not know takes about three seconds to be refused, this takes
-# milliseconds — the daemon's journal records that the finger really matched,
+# milliseconds. The daemon's journal records that the finger really matched,
 # this file names it in plain text, and the finger still shows as enrolled in
 # fprintd-list. It reliably runs your script. It does not reliably hide that
 # it did.
diff --git a/packaging/build-package.sh b/packaging/build-package.sh
index 14b45f0..d93d8ca 100755
--- a/packaging/build-package.sh
+++ b/packaging/build-package.sh
@@ -76,13 +76,18 @@ retry "make sysroot" "$SRC/packaging/make-sysroot.sh" "$SYSROOT"
 # under ~/.cache/fingerprintd/libqcomtee-<target>, which is this script's
 # default output dir. Needs git, installed above.
 retry "make libqcomtee" "$SRC/packaging/make-libqcomtee.sh" \
-	--target=aarch64-alpine-linux-musl --sysroot="$SYSROOT" --march=armv8-a
+	--target=aarch64-alpine-linux-musl --sysroot="$SYSROOT" --march=armv8.6-a+fp16fml+aes+sha3+sm4
 
 # --- cross-compile the daemon; run the suites natively. The core is portable
 # by construction (no GLib, no libqcomtee, no system headers), which is what
 # lets the wire formats and state machines be tested on the build host at all.
 cd "$SRC"
-XTARGET="--target=aarch64-alpine-linux-musl --sysroot=$SYSROOT --march=armv8-a --mtune=generic"
+# The phone is one SoC, 4x Cortex-A520 + 4x Cortex-A720, so build for it (the
+# same -march goes to libqcomtee above). armv8.6-a is the highest level whose
+# mandatory set it exposes (8.7 would assume WFxT, 9.x SVE2 - neither is in
+# its hwcaps); +fp16fml+aes+sha3+sm4 are the optional extensions it has. Same
+# string as the fp6-img aports.
+XTARGET="--target=aarch64-alpine-linux-musl --sysroot=$SYSROOT --march=armv8.6-a+fp16fml+aes+sha3+sm4 --mtune=cortex-a720"
 crafter-build -- $XTARGET
 crafter-build -- --product=agent $XTARGET
 crafter-build test