diff --git a/.claude/settings.json b/.claude/settings.json
index df827ad..e2442c7 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -9,8 +9,8 @@
       "Bash(task doc:helm)",
       "Bash(task go:tidy)",
       "Bash(task go:upgrade)",
-      "Bash(task image)",
       "Bash(task image:local)",
+      "Bash(task image:all)",
       "Bash(task lint)",
       "Bash(task lint:go)",
       "Bash(task lint:gocritic)",
diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bbb7ee6..58cef6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -25,7 +25,7 @@ before:
 
 # ─── Binaries ────────────────────────────────────────────────────────────────
 # Two entries gated by GORELEASER_LOCAL_PLATFORM=1: full cross-OS
-# matrix (CI / `task image`) vs. Linux-only with the three supported
+# matrix (CI / `task image:all`) vs. Linux-only with the three supported
 # arches (`task image:local` — fast iteration). Cross-compiling to all
 # three Linux archs is essentially free in Go, but skipping the 20+
 # non-Linux targets shaves real seconds. dockers_v2's local entries
@@ -142,7 +142,7 @@ signs:
 #
 # Each variant has TWO entries, gated by GORELEASER_LOCAL_PLATFORM=1:
 #   - default (env unset): full multi-arch (linux/amd64,arm64,riscv64).
-#     Used by CI and `task image`.
+#     Used by CI and `task image:all`.
 #   - local (env=1):       host-arch only. Used by `task image:local`
 #     for fast iteration, skipping QEMU cross-builds.
 # Exactly one entry per variant is active per run via the `disable:`
diff --git a/CLAUDE.md b/CLAUDE.md
index a51c081..ebd9ed4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -30,8 +30,9 @@ everything.
   scratch (default) + busybox (alt) variants, push to
   ghcr/quay/docker.io, cosign keyless on everything, GitHub Release
   (CI via `release.yaml`).
-  Local: `task image` (full snapshot), `task image:local` (host-arch
-  only). Dev: Tilt's `custom_build` calls `goreleaser` directly with
+  Local: `task image:local` (host-arch, fast iteration),
+  `task image:all` (every cross-arch variant). Dev: Tilt's
+  `custom_build` calls `goreleaser` directly with
   `GORELEASER_TILT=1`, gating a dedicated dockers_v2 entry that uses
   `build/Dockerfile.busybox` (the alt release variant — chosen for
   dev because it ships a shell for `kubectl exec` debugging, not
@@ -45,9 +46,9 @@ everything.
 
 | Goal | Command | Notes |
 |---|---|---|
-| Local binary | `task build` | Direct `go build -trimpath -tags netgo,osusergo` to `bin/x509-certificate-exporter` |
-| Snapshot all images | `task image` | `goreleaser release --snapshot --skip=publish,sign` — verify config without pushing |
-| Snapshot host-arch only | `task image:local` | Same as `task image` but only host arch (no QEMU cross-build) |
+| Local binary | `task build` | `goreleaser build --single-target --snapshot --clean` — host-arch binary under `dist/x509ce_<os>_<arch>_<v>/x509-certificate-exporter` (same flags / ldflags / version stamping as the release pipeline) |
+| Snapshot host-arch only | `task image:local` | `goreleaser release --snapshot --skip=publish,sign` with `GORELEASER_LOCAL_PLATFORM=1` — fast iteration, no QEMU cross-build |
+| Snapshot all images | `task image:all` | Like `task image:local` but every cross-arch variant — validates the full release matrix without pushing |
 | Lint Go | `task lint:go` | `dagger call lint-go` — full golangci-lint set |
 | gocritic only | `task lint:gocritic` | `dagger call lint-go --mode=gocritic` |
 | Go lint without gocritic | `task lint:gonocritic` | `dagger call lint-go --mode=no-critic` |
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5410f3a..610ff81 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -112,7 +112,7 @@ peer's machine to read the exact versions, or check `flake.lock`):
 - **[Dagger CLI](https://dagger.io)** (only needed if you want
   `dagger` on your `$PATH`; the SDK in `dagger/` runs without it)
 - **[GoReleaser](https://goreleaser.com/install/)** (for local image
-  snapshots via `task image`)
+  snapshots via `task image:local` / `task image:all`)
 - **[Task](https://taskfile.dev/installation/)** ≥ 3
 - **[Tilt](https://docs.tilt.dev/install.html)**
 - **[k3d](https://k3d.io)**
@@ -183,9 +183,9 @@ attach assets to a GitHub Release.
 
 Locally:
 
-- `task image` — full snapshot (all archs, both variants); validates
-  the release config end-to-end without pushing.
-- `task image:local` — same but only the host arch; fast iteration.
+- `task image:local` — host-arch snapshot, fast iteration.
+- `task image:all` — full snapshot (all archs, both variants);
+  validates the release config end-to-end without pushing.
 - Tilt's `custom_build` invokes `goreleaser` directly with
   `GORELEASER_TILT=1`, which gates a dedicated `dockers_v2` entry
   using `build/Dockerfile.busybox` (the alt release variant — picked
@@ -206,8 +206,9 @@ GoReleaser invocations, or direct CLI calls:
 
 ```sh
 task --list                   # show every available task with description
-task build                    # `go build` directly (host-arch only)
-task image                    # `goreleaser release --snapshot ...`
+task build                    # `goreleaser build --single-target` (host-arch only, output under dist/)
+task image:local              # `goreleaser release --snapshot ...` host-arch only
+task image:all                # same but every cross-arch variant
 task lint                     # → go run ./dagger lint:go (+helm, +renovate)
 task test                     # runs test:unit, test:fuzz, test:e2e
 ```
diff --git a/Taskfile.yml b/Taskfile.yml
index 5879989..0ce2d68 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -7,8 +7,9 @@ version: '3'
 #   - GoReleaser for ALL image builds — release pipeline AND the dev
 #     image consumed by Tilt (one Dockerfile path, dev image == release
 #     image). Driven by .goreleaser.yaml; in CI via release.yaml;
-#     locally via `task image` (full) or `task image:local` (host-arch
-#     only). Tilt invokes goreleaser directly with GORELEASER_TILT=1.
+#     locally via `task image:local` (host-arch, fast) or
+#     `task image:all` (every cross-arch variant). Tilt invokes
+#     goreleaser directly with GORELEASER_TILT=1.
 #   - Direct CLI for things that don't need sandboxing: k3d/tilt for
 #     the dev cluster, Renovate dry-run via Docker, and `go mod tidy` /
 #     `go get -u`. GitHub Action SHA-pinning is owned by Renovate
@@ -80,6 +81,18 @@ tasks:
     cmds:
       - goreleaser release --snapshot --skip=publish,sign --clean
 
+  image:all:
+    desc: 'Like `task image:local` but every cross-arch variant (no host-only short-circuit) — validates the full release matrix without pushing'
+    # Snapshot mode skips git tag validation, push, and signing, so
+    # this is safe to run on any branch / dirty tree. Useful to verify
+    # the .goreleaser.yaml config produces what's expected.
+    # IMAGE_NAME defaults to the project name for local snapshots; CI
+    # overrides it via the `release` Environment's `vars.IMAGE_NAME`.
+    env:
+      IMAGE_NAME: '{{.IMAGE_NAME | default "x509-certificate-exporter"}}'
+    cmds:
+      - goreleaser release --snapshot --skip=publish,sign --clean
+
   # ─── Dev environment ─────────────────────────────────────────────────────
   dev:up:
     desc: tilt up — full dev loop (cluster, build, deploy, seed)