diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9404af75f7..ea3e7cf20f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,13 +1,15 @@
 version: 2
 # Dependabot auto-update config.
 #
-# Cooldown (7 days) is the point of this config: it delays version-update
-# PRs until a newly-published version has aged. Supply-chain attacks like
+# npm and GitHub Actions use a 7-day cooldown so newly published versions age
+# before a PR opens. Supply-chain attacks like
 # the tanstack Shai-Hulud compromise (2026-05-11) live minutes-to-hours
 # before the registry yanks them; a 7-day cooldown keeps poisoned
 # versions out of our lockfiles.
 #
-# Security updates bypass cooldown and continue to flow immediately. See:
+# Security updates bypass cooldown and continue to flow immediately. Docker
+# uses a shorter 3-day operational-freshness policy and does not support
+# Dependabot security updates. See:
 # https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference#cooldown
 #
 # Auto-merge is deliberately NOT enabled. Every dependabot PR gets human
@@ -42,3 +44,18 @@ updates:
       actions:
         patterns: ["*"]
         update-types: [minor, patch]
+
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/Los_Angeles
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 5
+    groups:
+      docker-base-images:
+        group-by: dependency-name
+        patterns: ["*"]
diff --git a/.github/workflows/build-and-push-bskyweb-ghcr.yaml b/.github/workflows/build-and-push-bskyweb-ghcr.yaml
index be05a38ad1..66652d5c9d 100644
--- a/.github/workflows/build-and-push-bskyweb-ghcr.yaml
+++ b/.github/workflows/build-and-push-bskyweb-ghcr.yaml
@@ -1,5 +1,12 @@
 name: build-and-push-bskyweb-ghcr
 on:
+  pull_request:
+    paths:
+      - Dockerfile
+      - Dockerfile.bskylink
+      - Dockerfile.bskyogcard
+      - Dockerfile.embedr
+      - .github/workflows/build-and-push-bskyweb-ghcr.yaml
   push:
     branches:
       - main
@@ -13,8 +20,40 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
+  verify-containers:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: bskyweb
+            file: Dockerfile
+          - image: bskylink
+            file: Dockerfile.bskylink
+          - image: bskyogcard
+            file: Dockerfile.bskyogcard
+          - image: embedr
+            file: Dockerfile.embedr
+    steps:
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: 🔧 Setup Docker buildx
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - name: Build ${{ matrix.image }}
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: .
+          file: ${{ matrix.file }}
+          platforms: linux/amd64
+          push: false
+          cache-from: type=gha,scope=${{ matrix.image }}
+          cache-to: type=gha,mode=max,scope=${{ matrix.image }}
+
   bskyweb-container-ghcr:
-    if: github.repository == 'bluesky-social/social-app'
+    if: github.event_name == 'push' && github.repository == 'bluesky-social/social-app'
     runs-on: ubuntu-latest
     permissions:
       contents: read