diff --git a/.github/workflows/__linux-arm64.yml b/.github/workflows/__linux-arm64.yml
new file mode 100644
index 000000000..641099ebc
--- /dev/null
+++ b/.github/workflows/__linux-arm64.yml
@@ -0,0 +1,91 @@
+# Warning: This file is generated automatically, and should not be modified.
+# Instead, please modify the template in the pr-checks directory and run:
+#     pr-checks/sync.sh
+# to regenerate this file.
+
+name: PR Check - Linux Arm64
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  GO111MODULE: auto
+on:
+  push:
+    branches:
+      - main
+      - releases/v*
+  pull_request: {}
+  merge_group:
+    types:
+      - checks_requested
+  schedule:
+    - cron: '0 5 * * *'
+  workflow_dispatch:
+    inputs:
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
+  workflow_call:
+    inputs:
+      go-version:
+        type: string
+        description: The version of Go to install
+        required: false
+        default: '>=1.21.0'
+defaults:
+  run:
+    shell: bash
+concurrency:
+  cancel-in-progress: ${{ github.event_name == 'pull_request' || false }}
+  group: linux-arm64-${{github.ref}}-${{inputs.go-version}}
+jobs:
+  linux-arm64:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-24.04-arm
+            version: nightly-latest
+    name: Linux Arm64
+    if: github.triggering_actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: read
+    timeout-minutes: 45
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: ${{ inputs.go-version || '>=1.21.0' }}
+          cache: false
+      - name: Prepare test
+        id: prepare-test
+        uses: ./.github/actions/prepare-test
+        with:
+          version: ${{ matrix.version }}
+          use-all-platform-bundle: 'false'
+          setup-kotlin: 'true'
+      - uses: ./../action/init
+        with:
+          languages: javascript,python,go
+          tools: ${{ steps.prepare-test.outputs.tools-url }}
+      - name: Build Go code
+        run: go build main.go
+      - uses: ./../action/analyze
+        with:
+          skip-queries: true
+          upload-database: false
+      - name: Assert databases exist
+        run: |
+          cd "$RUNNER_TEMP/codeql_databases"
+          for lang in javascript python go; do
+            if [[ ! -d "$lang" ]]; then
+              echo "Did not find a database for $lang"
+              exit 1
+            fi
+          done
+    env:
+      CODEQL_ACTION_TEST_MODE: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index edd47daa7..2cd2c316d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@ See the [releases page](https://github.com/github/codeql-action/releases) for th
 
 ## [UNRELEASED]
 
-- The CodeQL Action now supports running on Linux Arm64 runners, downloading the native `linux-arm64` CodeQL bundle. [#4072](https://github.com/github/codeql-action/pull/4072)
+- The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native `linux-arm64` CodeQL bundle when available. [#4072](https://github.com/github/codeql-action/pull/4072)
 
 ## 4.37.5 - 03 Aug 2026
 
diff --git a/pr-checks/checks/linux-arm64.yml b/pr-checks/checks/linux-arm64.yml
new file mode 100644
index 000000000..d254799ba
--- /dev/null
+++ b/pr-checks/checks/linux-arm64.yml
@@ -0,0 +1,31 @@
+name: "Linux Arm64"
+description: "An end-to-end integration test running on a Linux Arm64 runner, checking that the native linux-arm64 CodeQL bundle is downloaded and can analyze interpreted and compiled code"
+operatingSystems:
+  - os: ubuntu
+    runner-image: ubuntu-24.04-arm
+# The native linux-arm64 CodeQL bundle is only available in recent CLI releases, so we restrict this
+# check to `nightly-latest`, which is guaranteed to ship it. Older stable versions do not have an
+# arm64 asset, and `prepare-test` would resolve an x64 bundle URL for them on this runner.
+versions:
+  - nightly-latest
+installGo: true
+steps:
+  - uses: ./../action/init
+    with:
+      languages: javascript,python,go
+      tools: ${{ steps.prepare-test.outputs.tools-url }}
+  - name: Build Go code
+    run: go build main.go
+  - uses: ./../action/analyze
+    with:
+      skip-queries: true
+      upload-database: false
+  - name: Assert databases exist
+    run: |
+      cd "$RUNNER_TEMP/codeql_databases"
+      for lang in javascript python go; do
+        if [[ ! -d "$lang" ]]; then
+          echo "Did not find a database for $lang"
+          exit 1
+        fi
+      done
diff --git a/src/setup-codeql.test.ts b/src/setup-codeql.test.ts
index be74bee70..b6b287ff8 100644
--- a/src/setup-codeql.test.ts
+++ b/src/setup-codeql.test.ts
@@ -139,6 +139,13 @@ const LINKED_BUNDLE_TEST_CASES = [
     expectedBundleName: "codeql-bundle-osx64.tar.zst",
     expectedCompressionMethod: "zstd",
   },
+  {
+    platform: "darwin",
+    arch: "x64",
+    tarSupportsZstd: true,
+    expectedBundleName: "codeql-bundle-osx64.tar.zst",
+    expectedCompressionMethod: "zstd",
+  },
   {
     platform: "win32",
     arch: "x64",
@@ -163,7 +170,7 @@ for (const {
   expectedCompressionMethod,
 } of LINKED_BUNDLE_TEST_CASES) {
   test.serial(
-    `getCodeQLSource selects ${expectedBundleName} for linked tools`,
+    `getCodeQLSource selects ${expectedBundleName} for linked tools on ${platform}/${arch}`,
     async (t) => {
       const features = createFeatures([]);
       sinon.stub(process, "platform").value(platform);