diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a743f2bccb6d23ff87f733eab5f0b8e26225b26b..f04f66b44c916873613fefaa23a4b155abbb43ec 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -92,6 +92,28 @@ build:
     - ninja -C build_ci install >/dev/null
     - ${MESON_TEST} --suite unit --suite config --suite dnstap --no-suite snowflake
 
+build:armhf:
+  <<: *build
+  tags:
+    - armhf
+    - shell
+  script:
+    - meson build_ci_armhf --default-library=static --prefix=$PREFIX -Dwerror=true -Dextra_tests=enabled
+    - ninja -C build_ci_armhf
+    - ninja -C build_ci_armhf install >/dev/null
+    - MESON_TESTTHREADS=1 ${MESON_TEST} --suite unit --suite config --no-suite snowflake --no-suite y2k38
+
+build:arm64:
+  <<: *build
+  tags:
+    - arm64
+    - shell
+  script:
+    - meson build_ci_arm64 --default-library=static --prefix=$PREFIX -Dwerror=true -Dextra_tests=enabled
+    - ninja -C build_ci_arm64
+    - ninja -C build_ci_arm64 install >/dev/null
+    - MESON_TESTTHREADS=1 ${MESON_TEST} --suite unit --suite config --no-suite snowflake
+
 build-asan:
   <<: *build
   script:
@@ -101,7 +123,7 @@ build-asan:
     - ninja -C build_ci_asan install >/dev/null
       # TODO _leaks: not sure what exactly is wrong in leak detection on config tests
       # TODO skip_asan: all three of these disappear locally when using gcc 9.1 (except some leaks)
-    - ASAN_OPTIONS=detect_leaks=0 ${MESON_TEST} --suite unit --suite config --suite dnstap --no-suite skip_asan --no-suite snowflake
+    - MESON_TESTTHREADS=1 ASAN_OPTIONS=detect_leaks=0 ${MESON_TEST} --suite unit --suite config --suite dnstap --no-suite skip_asan --no-suite snowflake
 
 build:macOS:
   <<: *nodep
diff --git a/daemon/http.c b/daemon/http.c
index 3055f3d0c9cf61ce22355459302f5a770bc7ab59..e21b0db1408f5a48447c120f2254e8c8e60ae9e8 100644
--- a/daemon/http.c
+++ b/daemon/http.c
@@ -331,7 +331,7 @@ static int header_callback(nghttp2_session *h2, const nghttp2_frame *frame,
 			/* Limit maximum value size to reduce attack surface. */
 			if (valuelen > HTTP_MAX_HEADER_IN_SIZE) {
 				kr_log_verbose(
-					"[http] stream %d: header too large (%ld B), refused\n",
+					"[http] stream %d: header too large (%zu B), refused\n",
 					stream_id, valuelen);
 				refuse_stream(h2, stream_id);
 				return 0;
diff --git a/daemon/lua/meson.build b/daemon/lua/meson.build
index 08539b0cb0a6774d59994d7b11f08d89c7256f0a..fabf0414bd1498d0d5c334b7b8d62317a1ab7d9e 100644
--- a/daemon/lua/meson.build
+++ b/daemon/lua/meson.build
@@ -5,7 +5,7 @@ config_tests += [
   ['controlsock', files('controlsock.test.lua')],
   ['krprint', files('krprint.test.lua')],
   ['ta', files('trust_anchors.test/ta.test.lua')],
-  ['ta_bootstrap', files('trust_anchors.test/bootstrap.test.lua')],
+  ['ta_bootstrap', files('trust_anchors.test/bootstrap.test.lua'), ['y2k38']],
 ]
 
 integr_tests += [
diff --git a/tests/pytests/proxy/tls-proxy.h b/tests/pytests/proxy/tls-proxy.h
index c6f468d49e4383d8a21630bd86b02746cba4bb00..2dbd9fd81a9a2f5ce1fe2c95a5656e52a6dca614 100644
--- a/tests/pytests/proxy/tls-proxy.h
+++ b/tests/pytests/proxy/tls-proxy.h
@@ -1,6 +1,8 @@
 #pragma once
 /* SPDX-License-Identifier: GPL-3.0-or-later */
 
+#define __STDC_FORMAT_MACROS
+#include <inttypes.h>
 #include <stdint.h>
 #include <stdbool.h>
 #include <netinet/in.h>
diff --git a/tests/pytests/proxy/tlsproxy.c b/tests/pytests/proxy/tlsproxy.c
index f1b4acc2fb19bc8833a0536ba357299f433d83ec..bcdffb03dfb5fae8c756d0ce4c8c974aa627e074 100644
--- a/tests/pytests/proxy/tlsproxy.c
+++ b/tests/pytests/proxy/tlsproxy.c
@@ -25,7 +25,7 @@ void help(char *argv[], struct args *a)
 	       " -t, --cert=[path]      Path to certificate file (default: %s).\n"
 	       " -k, --key=[path]       Path to key file (default: %s).\n"
 	       " -c, --close=[N]        Close connection to client after\n"
-	       "                        every N ms (default: %li).\n"
+	       "                        every N ms (default: %" PRIu64 ").\n"
 	       " -f, --fail=[N]         Delay every Nth incoming connection by 10 sec,\n"
 	       "                        0 disables delaying (default: 0).\n"
 	       " -r, --rehandshake      Do TLS rehandshake after every 8 bytes\n"