diff --git a/Makefile b/Makefile
index 2fac06cd0..6ad4b1291 100644
--- a/Makefile
+++ b/Makefile
@@ -15,8 +15,7 @@ IMAGE_TYPE=$(shell if [ "$(PLATFORM)" = raspberrypi ]; then echo img; else echo
 WEB_UIS := web/dist/raw/ui/index.html web/dist/raw/setup-wizard/index.html
 COMPRESSED_WEB_UIS := web/dist/static/ui/index.html web/dist/static/setup-wizard/index.html
 FIRMWARE_ROMS := build/lib/firmware/$(PLATFORM) $(shell jq --raw-output '.[] | select(.platform[] | contains("$(PLATFORM)")) | "./build/lib/firmware/$(PLATFORM)/" + .id + ".rom.gz"' build/lib/firmware.json)
-TOR_S9PK := build/lib/tor_$(ARCH).s9pk
-BUILD_SRC := $(call ls-files, build/lib) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS) $(TOR_S9PK)
+BUILD_SRC := $(call ls-files, build/lib) build/lib/depends build/lib/conflicts $(FIRMWARE_ROMS)
 IMAGE_RECIPE_SRC := $(call ls-files, build/image-recipe/)
 STARTD_SRC := core/startd.service $(BUILD_SRC)
 CORE_SRC := $(call ls-files, core) $(shell git ls-files --recurse-submodules patch-db) $(GIT_HASH_FILE)
@@ -316,9 +315,6 @@ build/lib/depends build/lib/conflicts: $(ENVIRONMENT_FILE) $(PLATFORM_FILE) $(sh
 $(FIRMWARE_ROMS): build/lib/firmware.json ./build/download-firmware.sh $(PLATFORM_FILE)
 	./build/download-firmware.sh $(PLATFORM)
 
-$(TOR_S9PK): ./build/download-tor-s9pk.sh
-	./build/download-tor-s9pk.sh $(ARCH)
-
 core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox: $(CORE_SRC) $(COMPRESSED_WEB_UIS) web/patchdb-ui-seed.json $(ENVIRONMENT_FILE)
 	ARCH=$(ARCH) PROFILE=$(PROFILE) ./core/build/build-startbox.sh
 	touch core/target/$(RUST_ARCH)-unknown-linux-musl/$(PROFILE)/startbox
diff --git a/build/download-tor-s9pk.sh b/build/download-tor-s9pk.sh
deleted file mode 100755
index b56b4aef8..000000000
--- a/build/download-tor-s9pk.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/bash
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-set -e
-
-ARCH=$1
-VERSION="0.4.9.5:0-beta.1"
-
-if [ -z "$ARCH" ]; then
-	>&2 echo "usage: $0 <ARCH>"
-	exit 1
-fi
-
-curl --fail -L -o "./lib/tor_${ARCH}.s9pk" "https://s9pks.nyc3.cdn.digitaloceanspaces.com/tor/${VERSION}/tor_${ARCH}.s9pk"
diff --git a/build/image-recipe/build.sh b/build/image-recipe/build.sh
index 6648e719a..990abfe89 100755
--- a/build/image-recipe/build.sh
+++ b/build/image-recipe/build.sh
@@ -357,6 +357,8 @@ mkdir -p /media/startos
 chmod 750 /media/startos
 chown root:startos /media/startos
 
+start-cli --registry=https://alpha-registry-x.start9.com registry package download tor -d /usr/lib/startos/tor_${QEMU_ARCH}.s9pk -a "${QEMU_ARCH}"
+
 EOF
 
 SOURCE_DATE_EPOCH="${SOURCE_DATE_EPOCH:-$(date '+%s')}"
diff --git a/core/locales/i18n.yaml b/core/locales/i18n.yaml
index 46df68d25..cce91b5e5 100644
--- a/core/locales/i18n.yaml
+++ b/core/locales/i18n.yaml
@@ -2656,6 +2656,13 @@ help.arg.allow-partial-backup:
   fr_FR: "Laisser le média monté même si backupfs échoue à monter"
   pl_PL: "Pozostaw nośnik zamontowany nawet jeśli backupfs nie może się zamontować"
 
+help.arg.architecture:
+  en_US: "Target CPU architecture (e.g. x86_64, aarch64)"
+  de_DE: "Ziel-CPU-Architektur (z.B. x86_64, aarch64)"
+  es_ES: "Arquitectura de CPU objetivo (ej. x86_64, aarch64)"
+  fr_FR: "Architecture CPU cible (ex. x86_64, aarch64)"
+  pl_PL: "Docelowa architektura CPU (np. x86_64, aarch64)"
+
 help.arg.architecture-mask:
   en_US: "Filter by CPU architecture"
   de_DE: "Nach CPU-Architektur filtern"
diff --git a/core/src/registry/package/get.rs b/core/src/registry/package/get.rs
index 8ad7bcceb..b95095032 100644
--- a/core/src/registry/package/get.rs
+++ b/core/src/registry/package/get.rs
@@ -418,6 +418,9 @@ pub struct CliDownloadParams {
     pub target_version: Option<VersionRange>,
     #[arg(short, long, help = "help.arg.destination-path")]
     pub dest: Option<PathBuf>,
+    #[arg(long, short, help = "help.arg.architecture")]
+    #[ts(type = "string | null")]
+    pub arch: Option<InternedString>,
 }
 
 pub async fn cli_download(
@@ -426,6 +429,7 @@ pub async fn cli_download(
         ref id,
         target_version,
         dest,
+        arch,
     }: CliDownloadParams,
 ) -> Result<(), Error> {
     let progress_tracker = FullProgressTracker::new();
@@ -473,6 +477,13 @@ pub async fn cli_download(
             res.best.remove(version).unwrap()
         }
     };
+    if let Some(arch) = &arch {
+        s9pk.retain(|(hw, _)| {
+            hw.arch
+                .as_ref()
+                .map_or(true, |arches| arches.contains(arch))
+        });
+    }
     let s9pk = match s9pk.len() {
         0 => {
             return Err(Error::new(