diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 495d705..c8781e1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -59,6 +59,59 @@ jobs:
       - name: Build UI
         run: make build-ui
 
+  docker:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      IMAGE_REF: agentevals:ci
+      IMAGE_VERSION: 0.0.0.dev0
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+
+      # The release workflow is the only other place this Dockerfile gets built, and it
+      # runs after the GitHub release is already published. Build it here so a break
+      # lands on the PR instead of halfway through a release.
+      # Single-arch keeps it native; the multi-arch build stays release-only because
+      # emulating arm64 through the node and uv layers is an order of magnitude slower.
+      - name: Build image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          platforms: linux/amd64
+          build-args: VERSION=${{ env.IMAGE_VERSION }}
+          tags: ${{ env.IMAGE_REF }}
+          push: false
+          load: true
+          cache-from: type=gha
+          # Pull requests read main's layers but never write, so a branch cannot grow
+          # or displace the cache the other jobs share.
+          cache-to: ${{ github.event_name == 'push' && 'type=gha,mode=max' || '' }}
+
+      - name: Smoke test
+        run: |
+          docker run -d --name agentevals-ci -p 127.0.0.1:8001:8001 "$IMAGE_REF"
+          for _ in $(seq 1 30); do
+            if curl -fsS --max-time 3 http://127.0.0.1:8001/api/health -o "$RUNNER_TEMP/health.json"; then
+              break
+            fi
+            sleep 2
+          done
+          test -s "$RUNNER_TEMP/health.json" || { echo "server never became healthy"; exit 1; }
+          cat "$RUNNER_TEMP/health.json"
+          grep -q '"status":"ok"' "$RUNNER_TEMP/health.json"
+          # Proves the SETUPTOOLS_SCM_PRETEND_VERSION path still resolves; a silent
+          # break there would ship a mis-versioned image.
+          grep -q "\"version\":\"$IMAGE_VERSION\"" "$RUNNER_TEMP/health.json"
+          curl -fsS http://127.0.0.1:8001/ | grep -q '<div id="root">'
+          test "$(docker exec agentevals-ci id -u)" = "1000"
+
+      - name: Container logs
+        if: failure()
+        run: docker logs agentevals-ci
+
   test:
     runs-on: ubuntu-latest
     strategy:
diff --git a/Makefile b/Makefile
index 8eb30ee..88cd31a 100644
--- a/Makefile
+++ b/Makefile
@@ -9,13 +9,17 @@ DOCKER_IMAGE_REF := $(if $(DOCKER_REGISTRY),$(DOCKER_REGISTRY:%/=%)/$(DOCKER_IMA
 # Multi-arch build (requires docker buildx). Manifest lists must be pushed — use build-docker-local for a single-arch --load.
 PLATFORMS ?= linux/amd64,linux/arm64
 
+# LOCAL_VERSION falls back to a stub so build-docker-local works without uv or git history.
+LOCAL_VERSION ?= $(if $(VERSION),$(VERSION),0.0.0.dev0)
+LOCAL_TAG ?= local
+
 HELM_REPO ?= oci://ghcr.io/agentevals-dev/agentevals
 HELM_DIST_FOLDER ?= dist/helm
 HELM_CHART_DIR ?= charts/agentevals
 HELM_CHART_OCI_URL ?= $(HELM_REPO)/helm
 HELM_CHART_VERSION ?= $(VERSION)
 
-.PHONY: build build-bundle build-docker build-ui release clean dev-backend dev-backend-pg dev-frontend dev-bundle pg-up pg-down migrate test test-unit test-integration test-e2e helm-lint helm-template helm-test helm-cleanup helm-package helm-publish
+.PHONY: build build-bundle build-docker build-docker-local build-ui release clean dev-backend dev-backend-pg dev-frontend dev-bundle pg-up pg-down migrate test test-unit test-integration test-e2e helm-lint helm-template helm-test helm-cleanup helm-package helm-publish
 
 PG_CONTAINER ?= agentevals-pg
 PG_PORT      ?= 5432
@@ -31,6 +35,9 @@ build-docker:
 	@test -n "$(VERSION)" || { echo "ERROR: VERSION is empty. Pass VERSION=x.y.z explicitly, or install uv so hatch-vcs can resolve it."; exit 1; }
 	docker buildx build --platform $(PLATFORMS) --build-arg VERSION=$(VERSION) -t $(DOCKER_IMAGE_REF):$(DOCKER_TAG) --push .
 
+build-docker-local:
+	docker buildx build --build-arg VERSION=$(LOCAL_VERSION) -t $(DOCKER_IMAGE_REF):$(LOCAL_TAG) --load .
+
 build-ui:
 	cd ui && npm ci && npm run build