diff --git a/pkg/package.mk b/pkg/package.mk
index 93093e1b6..43cfcf1c6 100644
--- a/pkg/package.mk
+++ b/pkg/package.mk
@@ -4,6 +4,8 @@ default: push
 ORG?=linuxkit
 SOURCE ?= .
 
+ARCH := $(shell uname -m)
+
 # Hash is of $(CURDIR) not $(CURDIR)$(SOURCE) to allow autogenerated
 # source subdirectories (which would not be covered by ls-tree, but
 # the code which autogenerates should be in $(CURDIR) so that is what
@@ -15,14 +17,7 @@ HASH?=$(shell git ls-tree --full-tree $(HASH_COMMIT) -- $(CURDIR) | awk '{print
 ifneq ($(HASH_COMMIT),HEAD) # Others can't be dirty by definition
 DIRTY:=$(shell git update-index -q --refresh && git diff-index --quiet HEAD -- $(CURDIR) || echo "-dirty")
 endif
-endif
 
-# Makefiles can specify specific architectures they compile for. Default: all
-ifeq ($(ARCHES),)
-ARCHES:=x86_64 aarch64
-endif
-
-ARCH := $(shell uname -m)
 ifeq ($(ARCH), x86_64)
 SUFFIX=-amd64
 endif
@@ -30,6 +25,13 @@ ifeq ($(ARCH), aarch64)
 SUFFIX=-arm64
 endif
 
+endif
+
+# Makefiles can specify specific architectures they compile for. Default: all
+ifeq ($(ARCHES),)
+ARCHES:=x86_64 aarch64
+endif
+
 ifneq ($(filter $(ARCH),$(ARCHES)),)
 REAL:=-y
 else
@@ -87,6 +89,9 @@ check-dirty:
 ifneq ($(DIRTY),)
 	$(error Your repository is not clean. Will not push package image)
 endif
+ifeq ($(SUFFIX),)
+	$(error Refusing to push without a SUFFIX)
+endif
 
 push-y: tag-y check-dirty
 	docker pull $(TAG)$(SUFFIX) || \