diff --git a/login/Makefile b/login/Makefile
index 9fd43e727d..836a9d12d6 100644
--- a/login/Makefile
+++ b/login/Makefile
@@ -34,6 +34,7 @@ login-help:
 	@echo "Makefile for the login service"
 	@echo "Available targets:"
 	@echo "  login-help              - Show this help message."
+	@echo "  login-generate			 - Generate TypeScript client code from Protobuf definitions."
 	@echo "  login-quality           - Run all quality checks (login-lint, login-test-unit, login-test-integration, login-test-acceptance)."
 	@echo "  login-standalone-build  - Build the docker image for production login containers."
 	@echo "  login-lint              - Run linting and formatting checks. FORCE=true prevents skipping."
@@ -43,6 +44,7 @@ login-help:
 	@echo "  show-run-caches         - Show all run caches with image ids and exit codes."
 	@echo "  clean-run-caches        - Remove all run caches."
 
+
 login-lint:
 	$(LOGIN_BAKE_CLI_WITH_COMMON_ARGS) login-lint
 
@@ -109,6 +111,9 @@ login-standalone-build:
 login-standalone-build-tag:
 	@echo -n "$(LOGIN_TAG)"
 
+typescript-generate:
+	$(LOGIN_BAKE_CLI_WITH_COMMON_ARGS) typescript-proto-client-out
+
 .PHONY: clean-run-caches
 clean-run-caches:
 	@echo "Removing cache directory: $(CACHE_DIR)"
@@ -120,3 +125,4 @@ show-run-caches:
 	@find "$(CACHE_DIR)" -type f 2>/dev/null | while read file; do \
 		echo "$$file: $$(cat $$file)"; \
 	done
+
diff --git a/login/docker-bake.hcl b/login/docker-bake.hcl
index 4553940d44..4e3cfec6a5 100644
--- a/login/docker-bake.hcl
+++ b/login/docker-bake.hcl
@@ -9,11 +9,19 @@ variable "DOCKERFILES_DIR" {
 # The zitadel repository uses this to generate the client and the mock server from local proto files.
 target "typescript-proto-client" {
   dockerfile = "${DOCKERFILES_DIR}typescript-proto-client.Dockerfile"
+  target = "typescript-proto-client"
   contexts = {
     # We directly generate and download the client server-side with buf, so we don't need the proto files
     login-pnpm = "target:login-pnpm"
   }
-  output = ["type=docker"]
+}
+
+target "typescript-proto-client-out" {
+  inherits = ["typescript-proto-client"]
+  target = "typescript-proto-client-out"
+  output = [
+    "type=local,dest=packages/zitadel-proto"
+  ]
 }
 
 # proto-files is only used to build login-core-mock against which the integration tests run.
@@ -62,15 +70,6 @@ target "login-client" {
   }
 }
 
-target "typescript-proto-client" {
-  dockerfile = "${DOCKERFILES_DIR}typescript-proto-client.Dockerfile"
-  contexts = {
-    # We directly generate and download the client server-side with buf, so we don't need the proto files
-    login-pnpm = "target:login-pnpm"
-  }
-  output = ["type=docker"]
-}
-
 variable "LOGIN_CORE_MOCK_TAG" {
   default = "login-core-mock:local"
 }
diff --git a/login/dockerfiles/typescript-proto-client.Dockerfile b/login/dockerfiles/typescript-proto-client.Dockerfile
index 79ee83c413..e93157f408 100644
--- a/login/dockerfiles/typescript-proto-client.Dockerfile
+++ b/login/dockerfiles/typescript-proto-client.Dockerfile
@@ -4,3 +4,9 @@ RUN --mount=type=cache,id=pnpm,target=/pnpm/store \
     pnpm install --frozen-lockfile --workspace-root --filter zitadel-proto
 COPY packages/zitadel-proto packages/zitadel-proto
 RUN pnpm generate
+
+FROM scratch AS typescript-proto-client-out
+COPY --from=typescript-proto-client /build/packages/zitadel-proto/zitadel /zitadel
+COPY --from=typescript-proto-client /build/packages/zitadel-proto/google /google
+COPY --from=typescript-proto-client /build/packages/zitadel-proto/protoc-gen-openapiv2 /protoc-gen-openapiv2
+COPY --from=typescript-proto-client /build/packages/zitadel-proto/validate /validate