diff --git a/.github/workflows/ha-build.yml b/.github/workflows/ha-build.yml
new file mode 100644
index 000000000..f28e6ba1a
--- /dev/null
+++ b/.github/workflows/ha-build.yml
@@ -0,0 +1,50 @@
+name: HA Build & Push to ECR
+
+on:
+  push:
+    branches:
+      - master
+      - main
+      - "feat/ha-*"
+
+jobs:
+  build-and-push:
+    runs-on: [self-hosted, k3s, linux, amd64]
+
+    permissions:
+      id-token: write   # required for OIDC-based AWS auth
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
+        with:
+          role-to-assume: ${{ secrets.AWS_ECR_ROLE_ARN }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Login to Amazon ECR
+        id: ecr-login
+        uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # v2.0.1
+
+      - name: Set image metadata
+        id: meta
+        run: |
+          REPO="${{ steps.ecr-login.outputs.registry }}/${{ secrets.ECR_REPOSITORY }}"
+          SHORT_SHA="${GITHUB_SHA::7}"
+          echo "image_repo=${REPO}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${SHORT_SHA}"  >> "$GITHUB_OUTPUT"
+
+      - name: Build and push image
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: .
+          file: Dockerfile
+          platforms: linux/amd64
+          push: true
+          provenance: false
+          tags: |
+            ${{ steps.meta.outputs.image_repo }}:${{ steps.meta.outputs.short_sha }}
+            ${{ steps.meta.outputs.image_repo }}:latest