diff --git a/.forgejo/workflows/build-openbao-csi-provider.yaml b/.forgejo/workflows/build-openbao-csi-provider.yaml
new file mode 100644
index 0000000..c252cb5
--- /dev/null
+++ b/.forgejo/workflows/build-openbao-csi-provider.yaml
@@ -0,0 +1,22 @@
+on:
+  push:
+    paths:
+      - containers/openbao-csi-provider/*
+      - .forgejo/workflows/build-openbao-csi-provider.yaml
+jobs:
+  build-openbao-csi-provider:
+    runs-on: docker
+    container:
+      image: library/docker:dind
+    steps:
+      - run: apk add --no-cache nodejs git
+      - name: login to container registry
+        run: echo "${{ secrets.DEPLOY_TOKEN }}" | docker login --username ${{ secrets.DEPLOY_USER }} --password-stdin git.janky.solutions
+      - name: build container image
+        uses: docker/build-push-action@v6
+        with:
+          file: Containerfile
+          context: "{{defaultContext}}:containers/openbao-csi-provider"
+          tags: git.janky.solutions/jankysolutions/infra/openbao-csi-provider:latest
+          platforms: linux/amd64
+          push: true
diff --git a/containers/openbao-csi-provider/Containerfile b/containers/openbao-csi-provider/Containerfile
new file mode 100644
index 0000000..61ee7e3
--- /dev/null
+++ b/containers/openbao-csi-provider/Containerfile
@@ -0,0 +1,9 @@
+FROM library/golang:1.22 AS build
+ENV CGO_ENABLED=0
+RUN git clone -b v1.4.0 https://github.com/openbao/openbao-csi-provider /openbao-csi-provider
+WORKDIR /openbao-csi-provider
+RUN go build -o openbao-csi-provider
+
+FROM gcr.io/distroless/static-debian12:latest
+COPY --from=build /openbao-csi-provider/openbao-csi-provider /bin/
+ENTRYPOINT [ "/bin/openbao-csi-provider" ]