diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 86de9af8..87d56eb6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -87,3 +87,16 @@ jobs:
             tests/e2e/playwright-report
             tests/e2e/test-results
           retention-days: 7
+
+  docker-build:
+    name: Docker build smoke
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+      # Smoke-build the sandbox image so a bad Dockerfile pin (e.g. an
+      # apt "nodejs=${NODEJS_VERSION}" that no longer resolves) fails a check
+      # instead of only surfacing at sandbox-provision time. No push, no
+      # registry credentials: this only proves the image builds.
+      - name: Build sandbox image (no push)
+        run: docker build --pull -t open-swe-sandbox:ci .