diff --git a/.circleci/config.yml b/.circleci/config.yml
index 088da5573..375a7f7b0 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -7,6 +7,8 @@ jobs:
       - checkout
       - docker_prepare
       - run: docker login --username $DOCKER_HUB_USERNAME --password $DOCKER_HUB_PASSWORD
+      # for release builds, we want to get the amd64 image out asap, so first
+      # we do an amd64-only build, before following up with a multiarch build.
       - docker_build:
           tag: -t matrixdotorg/synapse:${CIRCLE_TAG}
           platforms: linux/amd64
@@ -21,9 +23,8 @@ jobs:
       - checkout
       - docker_prepare
       - run: docker login --username $DOCKER_HUB_USERNAME --password $DOCKER_HUB_PASSWORD
-      - docker_build:
-          tag: -t matrixdotorg/synapse:latest
-          platforms: linux/amd64
+      # for `latest`, we don't want the arm images to disappear, so don't update the tag
+      # until all of the platforms are built.
       - docker_build:
           tag: -t matrixdotorg/synapse:latest
           platforms: linux/amd64,linux/arm/v7,linux/arm64
diff --git a/changelog.d/8909.misc b/changelog.d/8909.misc
new file mode 100644
index 000000000..b45972f0f
--- /dev/null
+++ b/changelog.d/8909.misc
@@ -0,0 +1 @@
+Don't publish `latest` docker image until all archs are built.