diff --git a/Makefile b/Makefile
index b695646..7546eec 100644
--- a/Makefile
+++ b/Makefile
@@ -21,6 +21,9 @@ DEVRAIL_LOG_FORMAT ?= json
 VERSION           ?= 0.1.0-dev
 GOOS              ?= $(shell go env GOOS 2>/dev/null || echo linux)
 GOARCH            ?= $(shell go env GOARCH 2>/dev/null || echo amd64)
+VAGRANT_GOARCH    ?= $(shell go env GOHOSTARCH 2>/dev/null || echo amd64)
+VAGRANT_PROVIDER  ?= qemu
+VAGRANT_DESTROY   ?= 1
 DIST_DIR          ?= dist
 BIN_DIR           ?= bin
 PACKAGE_NAME      := devrail-router_$(VERSION)_$(GOOS)_$(GOARCH)
@@ -139,7 +142,8 @@ package: build ## Build a Linux/macOS tarball package
 	cp packaging/linux/install.sh "$(DIST_DIR)/$(PACKAGE_NAME)/packaging/linux/"
 	chmod 0755 "$(DIST_DIR)/$(PACKAGE_NAME)/devrail-router" \
 		"$(DIST_DIR)/$(PACKAGE_NAME)/packaging/linux/install.sh"
-	(cd "$(DIST_DIR)" && tar -czf "$(PACKAGE_NAME).tar.gz" "$(PACKAGE_NAME)")
+	@if command -v xattr >/dev/null 2>&1; then xattr -rc "$(DIST_DIR)/$(PACKAGE_NAME)"; fi
+	(cd "$(DIST_DIR)" && COPYFILE_DISABLE=1 tar --no-xattrs -czf "$(PACKAGE_NAME).tar.gz" "$(PACKAGE_NAME)")
 
 package-smoke: package ## Build and smoke-test the tarball package
 	@set -e; \
@@ -171,8 +175,9 @@ vagrant-smoke: ## Run optional Vagrant systemd installer smoke test
 		echo "Error: vagrant is required for vagrant-smoke"; \
 		exit 2; \
 	fi
-	$(MAKE) package GOOS=linux GOARCH=amd64
-	vagrant up --provision
+	$(MAKE) package GOOS=linux GOARCH=$(VAGRANT_GOARCH)
+	DEVRAIL_VAGRANT_GOARCH="$(VAGRANT_GOARCH)" vagrant up --provider="$(VAGRANT_PROVIDER)" --provision
+	@if [ "$(VAGRANT_DESTROY)" = "1" ]; then vagrant destroy -f; fi
 
 # ===========================================================================
 # Internal targets (run inside container — do NOT invoke directly)
diff --git a/Vagrantfile b/Vagrantfile
index 0697e4c..895956e 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -1,8 +1,21 @@
 # frozen_string_literal: true
 
+host_cpu = RbConfig::CONFIG.fetch("host_cpu", "")
+default_box = host_cpu.include?("arm64") || host_cpu.include?("aarch64") ? "perk/ubuntu-2204-arm64" : "bento/ubuntu-24.04"
+
 Vagrant.configure("2") do |config|
-  config.vm.box = ENV.fetch("DEVRAIL_VAGRANT_BOX", "bento/ubuntu-24.04")
+  config.vm.box = ENV.fetch("DEVRAIL_VAGRANT_BOX", default_box)
   config.vm.hostname = "devrail-router-smoke"
+  config.vm.synced_folder ".", "/vagrant",
+                          type: "rsync",
+                          rsync__exclude: [".git/", ".vagrant/"]
+
+  config.vm.provider "qemu" do |qe|
+    qe.machine = "virt"
+    qe.cpu = host_cpu.include?("arm64") || host_cpu.include?("aarch64") ? "max" : "host"
+    qe.smp = "2"
+    qe.memory = "2048"
+  end
 
   config.vm.provider "virtualbox" do |vb|
     vb.name = "devrail-router-smoke"
@@ -15,5 +28,9 @@ Vagrant.configure("2") do |config|
     lv.memory = 2048
   end
 
-  config.vm.provision "shell", path: "test/smoke/vagrant-provision.sh"
+  config.vm.provision "shell",
+                      path: "test/smoke/vagrant-provision.sh",
+                      env: {
+                        "DEVRAIL_VAGRANT_GOARCH" => ENV.fetch("DEVRAIL_VAGRANT_GOARCH", host_cpu.include?("arm64") || host_cpu.include?("aarch64") ? "arm64" : "amd64")
+                      }
 end
diff --git a/docs/packaging.md b/docs/packaging.md
index 9fae154..029f9af 100644
--- a/docs/packaging.md
+++ b/docs/packaging.md
@@ -117,10 +117,15 @@ for the systemd/user/config paths that Docker does not model cleanly.
 make vagrant-smoke
 ```
 
-The Vagrant smoke test builds a Linux AMD64 tarball, boots an Ubuntu VM, installs
+The Vagrant smoke test builds a Linux package, boots an Ubuntu VM, installs
 DevRail Router through `packaging/linux/install.sh`, starts the systemd service,
 checks `/healthz` and `/v1/models`, verifies reinstall preserves
-`/etc/devrail/router.yaml`, and restarts the service.
+`/etc/devrail/router.yaml`, restarts the service, and destroys the VM after a
+successful run.
+
+On Apple Silicon Macs, the default Vagrant box is ARM64 and `make vagrant-smoke`
+builds a Linux ARM64 package. On x86 hosts, the default package architecture is
+Linux AMD64.
 
 Use `DEVRAIL_VAGRANT_BOX` to try another Linux box:
 
@@ -128,6 +133,19 @@ Use `DEVRAIL_VAGRANT_BOX` to try another Linux box:
 DEVRAIL_VAGRANT_BOX=bento/fedora-40 make vagrant-smoke
 ```
 
+Use `VAGRANT_PROVIDER` and `VAGRANT_GOARCH` to override provider or package
+architecture:
+
+```sh
+VAGRANT_PROVIDER=virtualbox VAGRANT_GOARCH=amd64 make vagrant-smoke
+```
+
+Keep the VM after a run for debugging:
+
+```sh
+VAGRANT_DESTROY=0 make vagrant-smoke
+```
+
 The Vagrant harness is not run in CI yet because it needs a local provider such
 as VirtualBox, libvirt, or another Vagrant-compatible VM backend.
 
diff --git a/test/smoke/vagrant-provision.sh b/test/smoke/vagrant-provision.sh
index ee8c563..7d8651f 100755
--- a/test/smoke/vagrant-provision.sh
+++ b/test/smoke/vagrant-provision.sh
@@ -3,10 +3,22 @@ set -euo pipefail
 
 cd /vagrant
 
-package_path=$(find dist -maxdepth 1 -name 'devrail-router_*_linux_amd64.tar.gz' | sort | tail -n 1)
+goarch="${DEVRAIL_VAGRANT_GOARCH:-}"
+if [ -z "$goarch" ]; then
+	case "$(uname -m)" in
+	aarch64 | arm64) goarch="arm64" ;;
+	x86_64 | amd64) goarch="amd64" ;;
+	*)
+		echo "unsupported VM architecture: $(uname -m)" >&2
+		exit 2
+		;;
+	esac
+fi
+
+package_path=$(find dist -maxdepth 1 -name "devrail-router_*_linux_${goarch}.tar.gz" | sort | tail -n 1)
 if [ -z "$package_path" ]; then
-	echo "missing Linux AMD64 package in dist/" >&2
-	echo "run: make package GOOS=linux GOARCH=amd64" >&2
+	echo "missing Linux ${goarch} package in dist/" >&2
+	echo "run: make package GOOS=linux GOARCH=${goarch}" >&2
 	exit 2
 fi
 
@@ -17,13 +29,21 @@ work_dir=$(mktemp -d)
 trap 'rm -rf "$work_dir"' EXIT
 
 tar -xzf "$package_path" -C "$work_dir"
-package_dir=$(find "$work_dir" -maxdepth 1 -type d -name 'devrail-router_*_linux_amd64' | head -n 1)
+package_dir=$(find "$work_dir" -maxdepth 1 -type d -name "devrail-router_*_linux_${goarch}" | head -n 1)
 
 cd "$package_dir"
 START_SERVICE=1 ./packaging/linux/install.sh
 
 systemctl is-enabled devrail-router.service
 systemctl is-active devrail-router.service
+
+for _ in $(seq 1 30); do
+	if curl -fsS http://127.0.0.1:8080/healthz >/dev/null 2>&1; then
+		break
+	fi
+	sleep 1
+done
+
 curl -fsS http://127.0.0.1:8080/healthz | grep -q '"status":"ok"'
 curl -fsS http://127.0.0.1:8080/v1/models | grep -q '"id":"local-coder"'
 
@@ -33,6 +53,14 @@ grep -q 'preserved by vagrant smoke' /etc/devrail/router.yaml
 
 systemctl restart devrail-router.service
 systemctl is-active devrail-router.service
+
+for _ in $(seq 1 30); do
+	if curl -fsS http://127.0.0.1:8080/healthz >/dev/null 2>&1; then
+		break
+	fi
+	sleep 1
+done
+
 curl -fsS http://127.0.0.1:8080/healthz | grep -q '"status":"ok"'
 
 echo "vagrant smoke passed"