diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml
index 2952274..ea83ac2 100644
--- a/.github/workflows/pythonpackage.yml
+++ b/.github/workflows/pythonpackage.yml
@@ -1,75 +1,136 @@
 name: samplerate
 
-on: [push, pull_request]
+on:
+  push:
+    branches: [master]
+    tags: ["v*", "test-*"]
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  workflow_dispatch:
 
 jobs:
-  build:
+  build_sdist:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        submodules: recursive
+        fetch-depth: 0
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.9"
+    - name: Build sdist
+      run: |
+        python -m pip install --upgrade pip
+        pip install -U setuptools setuptools_scm build twine
+        python -m build --sdist
+        twine check dist/*
+    - uses: actions/upload-artifact@v6
+      with:
+        name: sdist
+        path: dist/*.tar.gz
+
+  build_wheels_pr:
+    if: github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'full-build')
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - os: ubuntu-latest
+          cibw_build: "cp314-manylinux_x86_64"
+          cibw_archs: "x86_64"
+        - os: macos-latest
+          cibw_build: "cp314-macosx_universal2"
+          cibw_archs: "universal2"
+        - os: windows-latest
+          cibw_build: "cp314-win_amd64"
+          cibw_archs: "AMD64"
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        submodules: recursive
+        fetch-depth: 0
+    - uses: pypa/cibuildwheel@v3.4.0
+      env:
+        CIBW_BUILD: ${{ matrix.cibw_build }}
+        CIBW_ARCHS: ${{ matrix.cibw_archs }}
+        CIBW_MANYLINUX_X86_64_IMAGE: manylinux_2_28
+        CIBW_TEST_REQUIRES: "pytest numpy"
+        CIBW_TEST_COMMAND: "pytest {project}/tests"
 
+  build_wheels:
+    if: >-
+      github.event_name == 'push' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'full-build'))
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
-      max-parallel: 12
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
-        python-version: [3.9, "3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-    - uses: actions/checkout@v3
-    - name: Checkout submodules
-      shell: bash
-      run: |
-        auth_header="$(git config --local --get http.https://github.com/.extraheader)"
-        git submodule sync --recursive
-        git -c "http.extraheader=$auth_header" -c protocol.version=2 submodule update --init --force --recursive --depth=1
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+    - uses: actions/checkout@v6
       with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install -U setuptools setuptools_scm wheel build twine
-        pip install -r requirements.txt
-    - name: Build package
-      run: |
-        python -m pip install -e .
-    - name: Test with pytest
-      run: |
-        pytest
-    - name: Test the universal wheels
-      if: matrix.os == 'ubuntu-latest'
-      run: |
-        # do not build binary wheels on linux
-        python -m build --sdist
-        twine check dist/*
-    - name: Test the binary wheels
-      if: matrix.os != 'ubuntu-latest'
-      run: |
-        python -m build
-        twine check dist/*
-    - name: Publish sdist to pypi
-      if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v') && matrix.os == 'ubuntu-latest'
+        submodules: recursive
+        fetch-depth: 0
+    - name: Set up QEMU
+      if: runner.os == 'Linux'
+      uses: docker/setup-qemu-action@v3
+      with:
+        platforms: all
+    - uses: pypa/cibuildwheel@v3.4.0
       env:
-        TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
+        CIBW_BUILD: "cp39-* cp310-* cp311-* cp312-* cp313-* cp314-*"
+        CIBW_SKIP: "*-musllinux_* cp39-*aarch64 cp310-*aarch64"
+        CIBW_ARCHS_LINUX: "x86_64 aarch64"
+        CIBW_ARCHS_MACOS: "universal2"
+        CIBW_ARCHS_WINDOWS: "AMD64"
+        CIBW_MANYLINUX_X86_64_IMAGE: manylinux_2_28
+        CIBW_MANYLINUX_AARCH64_IMAGE: manylinux_2_28
+        CIBW_TEST_REQUIRES: "pytest numpy"
+        CIBW_TEST_COMMAND: "pytest {project}/tests"
+        CIBW_TEST_SKIP: "cp314-*"
+    - uses: actions/upload-artifact@v6
+      with:
+        name: wheels-${{ matrix.os }}
+        path: wheelhouse/*.whl
+
+  publish:
+    needs: [build_sdist, build_wheels]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v')
+    steps:
+    - uses: actions/download-artifact@v8
+      with:
+        path: dist
+        merge-multiple: true
+    - name: Validate wheels
       run: |
-        twine upload --skip-existing dist/*
-    - name: Publish bdist to pypi
-      if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/v') && matrix.os != 'ubuntu-latest'
+        pip install twine
+        twine check dist/*
+    - name: Publish to PyPI
       env:
         TWINE_USERNAME: ${{ secrets.PYPI_USERNAME }}
         TWINE_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
       run: |
         twine upload --skip-existing dist/*
-    - name: Publish sdist to pypi-test
-      if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/test-') && matrix.os == 'ubuntu-latest'
-      env:
-        TWINE_USERNAME: ${{ secrets.PYPITEST_USERNAME }}
-        TWINE_PASSWORD: ${{ secrets.PYPITEST_PASSWORD }}
-        TWINE_REPOSITORY_URL: https://test.pypi.org/legacy/
+
+  publish-test:
+    needs: [build_sdist, build_wheels]
+    runs-on: ubuntu-latest
+    if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/test-')
+    steps:
+    - uses: actions/download-artifact@v8
+      with:
+        path: dist
+        merge-multiple: true
+    - name: Validate wheels
       run: |
-        twine upload --skip-existing dist/*
-    - name: Publish bdist to pypi-test
-      if: github.event_name == 'push' && startsWith(github.event.ref, 'refs/tags/test-') && matrix.os != 'ubuntu-latest'
+        pip install twine
+        twine check dist/*
+    - name: Publish to PyPI Test
       env:
         TWINE_USERNAME: ${{ secrets.PYPITEST_USERNAME }}
         TWINE_PASSWORD: ${{ secrets.PYPITEST_PASSWORD }}
diff --git a/README.rst b/README.rst
index 24aad2d..c95e4f9 100644
--- a/README.rst
+++ b/README.rst
@@ -41,8 +41,9 @@ Installation
 
     $ pip install samplerate
 
-Binary wheels of `libsamplerate`_ for macOS and Windows (64 bit) are available.
-For other systems, a C++ 14 or above compiler is required to build the package.
+Binary wheels of `libsamplerate`_ are available for macOS (x86_64, arm64), Linux
+(x86_64, aarch64), and Windows (x86_64). Building from source on other platforms
+requires a C++14 or later compiler.
 
 
 Usage
diff --git a/external/CMakeLists.txt b/external/CMakeLists.txt
index 45dbbeb..23e6b70 100644
--- a/external/CMakeLists.txt
+++ b/external/CMakeLists.txt
@@ -10,6 +10,7 @@ FetchContent_Declare(
 FetchContent_MakeAvailable(pybind11)
 
 # libsamplerate
+set(CMAKE_POSITION_INDEPENDENT_CODE ON)
 set(BUILD_TESTING OFF CACHE BOOL "Disable libsamplerate test build")
 
 FetchContent_Declare(