diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
new file mode 100644
index 00000000..c02ad1dc
--- /dev/null
+++ b/.github/workflows/docker-build.yaml
@@ -0,0 +1,65 @@
+name: Docker build
+
+on:
+  pull_request:
+    paths:
+      - 'docker/**'
+      - '.github/workflows/docker-build.yaml'
+
+jobs:
+  docker-build:
+    name: 'Build docker image: Node ${{ matrix.node }}'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      matrix:
+        include:
+          - node: 18
+            platforms: linux/amd64,linux/arm64,linux/arm/v7
+          - node: 20
+            platforms: linux/amd64,linux/arm64,linux/arm/v7
+          - node: 24
+            platforms: linux/amd64,linux/arm64
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Set up Docker
+        uses: docker/setup-docker-action@0234bb73ccb40f0c430b795634f9247e2b5c2d23 #v5.2.0
+        with:
+          daemon-config: |
+            {
+              "features": {
+                "containerd-snapshotter": true
+              }
+            }
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+
+      - name: Build Docker image
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: ${{ matrix.platforms }}
+          tags: flowfuse-device-agent-pr:${{ matrix.node }}-scan
+          push: false
+          load: true
+          build-args: |
+            NODE_VERSION=${{ matrix.node }}
+
+      - name: Perform SAST scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: flowfuse-device-agent-pr:${{ matrix.node }}-scan
+          trivy-config: .github/trivy.yaml
+          output: 'sast-results.sarif'
+
+      - name: Upload scan results
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        with:
+          sarif_file: sast-results.sarif