diff --git a/debian/changelog b/debian/changelog
index 85d736f9..e224dcbb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+livecd-rootfs (23.10.45) UNRELEASED; urgency=medium
+
+  * live-build/auto/config: fail immediately on unknown arch/subarch.
+
+ -- Steve Langasek <steve.langasek@ubuntu.com>  Fri, 22 Sep 2023 22:19:57 -0700
+
 livecd-rootfs (23.10.44) mantic; urgency=medium
 
   * Fix the subarch used in the hook to identify images for sifive
diff --git a/live-build/auto/config b/live-build/auto/config
index 6b257987..5d83cb66 100755
--- a/live-build/auto/config
+++ b/live-build/auto/config
@@ -1,6 +1,24 @@
 #! /bin/sh
 set -e
 
+case $ARCH:$SUBARCH in
+	amd64:|amd64:generic|amd64:intel-iot|\
+	arm64:|arm64:generic|arm64:raspi|arm64:snapdragon|\
+	arm64:tegra|arm64:tegra-igx|\
+	armhf:|armhf:raspi|\
+	i386:\
+	ppc64el:\
+	riscv64:icicle|riscv64:nezha|riscv64:licheerv|riscv64:unmatched|\
+	riscv64:visionfive|riscv64:visionfive2|\
+	s390x:\
+	*appliance*)
+		;;
+	*)
+		echo "Unknown architecture target $ARCH:$SUBARCH"
+		exit 1
+		;;
+esac
+
 if [ -e config/germinate-output ]; then
             mv -T config/germinate-output germ-tmp
             rm -rf config