diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a4765239d86e7e53032a4753b02f6f143e455198..3c308006bb573481d33b32ffa8a2d4b428c19a2a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,8 @@
 include:
   - component: "${CI_SERVER_HOST}/ci/component/bazelisk/bazelisk@v1.0.0-beta.4"
     inputs:
+      image: "${CI_REGISTRY_IMAGE}"
+      tag: "${CI_COMMIT_SHA}"
       variables: |
         CI_PROJECT_DIR
         CI_PROJECT_ID
@@ -19,8 +21,29 @@ default:
   tags:
     - arm64
 
+oci:
+  stage: .pre
+  image: docker:27.3.0
+  tags:
+    - dind
+  services:
+    - docker:27.3.0-dind
+  variables:
+    DOCKER_TLS_CERTDIR: "/certs"
+    DOCKER_HOST: tcp://docker:2376
+    DOCKER_TLS_VERIFY: "true"
+    DOCKER_CERT_PATH: "$DOCKER_TLS_CERTDIR/client"
+    HEALTHCHECK_TCP_PORT: "2376"
+  script:
+    - docker info
+    - echo "$CI_REGISTRY_PASSWORD" | docker login --username "$CI_REGISTRY_USER" --password-stdin "$CI_REGISTRY"
+    - docker buildx build --tag="$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA" --push --cache-from "type=registry,ref=$CI_REGISTRY_IMAGE:$CI_COMMIT_BEFORE_SHA" --build-arg BUILDKIT_INLINE_CACHE=1 .
+  rules: !reference [.bazelisk, rules]
+
 test:
   extends: .bazelisk
+  needs:
+    - oci
   cache:
     - !reference [.bazelisk, cache]
     - key: "bazel-cache-${CI_PROJECT_ID}"
diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000000000000000000000000000000000000..38eeb036ca387680490899a8b14521c8c36b97cd
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,3 @@
+FROM debian:12-slim
+RUN apt update && apt install -y ca-certificates openssh-client && rm -r /var/lib/apt/lists/*
+COPY --from=registry.gitlab.arm.com/ci/component/bazelisk:1.0.0-beta.5 /usr/bin/bazelisk /usr/local/bin/bazelisk