diff --git a/.github/workflows/ffo-test.yml b/.github/workflows/ffo-test.yml
new file mode 100644
index 0000000000..8c374e2124
--- /dev/null
+++ b/.github/workflows/ffo-test.yml
@@ -0,0 +1,20 @@
+name: "Docker Bake Test"
+
+on:
+  push:
+    branches:
+      - docker-bake
+
+jobs:
+  test:
+    timeout-minutes: 10
+    runs-on:
+      group: zitadel-public
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/bake-action@v6
+        with:
+          source: .
+          push: false
+          targets: build,lint
\ No newline at end of file
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 6a25b2b9b1..2a8b417326 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -6,7 +6,6 @@ variable "REGISTRY" {
   default = "ghcr.io/zitadel"
 }
 
-## TODO replace with matix groups
 group "build" {
   targets = ["console-build", "core-build"]
 }
@@ -44,7 +43,7 @@ target "console" {
     "build"  = []
     "output" = []
     "lint"   = []
-    "image"   = ["${REGISTRY}/console:latest"]
+    "image"   = ["${REGISTRY}/console:${GITHUB_SHA}"]
   }[tgt]
   target = tgt
 }
@@ -78,7 +77,7 @@ target "core" {
     "build"  = []
     "output" = []
     "lint"   = []
-    "image"   = ["${REGISTRY}/zitadel:latest"]
+    "image"   = ["${REGISTRY}/zitadel:${GITHUB_SHA}"]
   }[tgt]
   target = tgt
 }
\ No newline at end of file