diff --git a/.github/workflows/buildspec.yml b/.github/workflows/buildspec.yml
new file mode 100644
index 0000000..9924eab
--- /dev/null
+++ b/.github/workflows/buildspec.yml
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Secluso, Inc.
+# Additional terms apply; see the NOTICE file in the repository root.
+
+# https://github.com/aws-actions/aws-codebuild-run-build/
+# https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html
+# https://github.com/rpcme/meta-amp-benchmark/blob/34f661e503bd54fafa580186fd797ebd3227745d/buildspec.yml#L2
+
+# When this is started, we're at the root of the repository ("CODEBUILD_SRC_DIR") [https://docs.aws.amazon.com/codebuild/latest/userguide/build-env-ref-env-vars.html]
+version: 0.2
+phases:
+  pre_build:
+    commands:
+      # https://pipx.pypa.io/stable/how-to/install-pipx/
+      - apt update
+      - apt install pipx
+      - pipx ensurepath
+      # https://kas.readthedocs.io/en/latest/userguide/getting-started.html
+      - pipx install kas
+  build:
+    commands:
+      - kas build pi-official-image.yml
\ No newline at end of file
diff --git a/.github/workflows/os-reproducibility-check.yml b/.github/workflows/os-reproducibility-check.yml
new file mode 100644
index 0000000..0975d08
--- /dev/null
+++ b/.github/workflows/os-reproducibility-check.yml
@@ -0,0 +1,35 @@
+# SPDX-License-Identifier: GPL-3.0-only
+# Copyright (C) 2026 Secluso, Inc.
+# Additional terms apply; see the NOTICE file in the repository root.
+
+name: Check Reproducibility of OS Images
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [labeled]
+
+concurrency:
+  group: os-repro-check-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-reproducible-os-images:
+    if: github.event_name == 'workflow_dispatch' || github.event.label.name == 'verify-os-reproducible'
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 90
+
+    steps:
+    - name: Configure AWS Credentials
+      uses: aws-actions/configure-aws-credentials@v1
+      with:
+        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        aws-region: us-east-1
+    - name: Run CodeBuild
+      uses: aws-actions/aws-codebuild-run-build@v1
+      with:
+        project-name: secluso-os-repro
\ No newline at end of file