diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5ed900d6..0778b9ab 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -76,3 +76,13 @@ jobs:
       - uses: ./.github/actions/setup
       - name: Enforce 80% coverage
         run: npm run test:coverage
+
+  docker-build:
+    name: Docker Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build Docker image
+        run: docker build -f packages/backend/Dockerfile -t mocker-backend:ci .
diff --git a/packages/backend/Dockerfile b/packages/backend/Dockerfile
index c88d30e3..a655b493 100644
--- a/packages/backend/Dockerfile
+++ b/packages/backend/Dockerfile
@@ -25,7 +25,7 @@ WORKDIR /usr/src/app
 # Copy backend build artifacts and writable path from build stage.
 COPY --from=build --chown=65532:65532 /usr/src/app/packages/backend/dist ./dist
 COPY --from=build --chown=65532:65532 /usr/src/app/node_modules ./node_modules
-COPY --from=build --chown=65532:65532 /usr/src/app/images ./images
+COPY --from=build --chown=65532:65532 --chmod=700 /usr/src/app/images ./images
 
 EXPOSE 80