diff --git a/.github/workflows/dekaf.yaml b/.github/workflows/dekaf.yaml
new file mode 100644
index 0000000000..e47e1c9728
--- /dev/null
+++ b/.github/workflows/dekaf.yaml
@@ -0,0 +1,50 @@
+name: dekaf
+
+on:
+  push:
+    branches: [master]
+    paths:
+      - "crates/dekaf/**"
+      - "Cargo.lock"
+  pull_request:
+    branches: [master]
+    paths:
+      - ".github/workflows/dekaf.yaml"
+      - "crates/dekaf/**"
+      - "Cargo.lock"
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-20.04
+
+    steps:
+      - uses: actions/checkout@v2
+        with:
+          fetch-depth: 0
+          submodules: false
+      - name: Login to GitHub container registry
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | \
+            docker login --username ${{ github.actor }} --password-stdin ghcr.io
+      # This step uses [docker/metadata-action](https://github.com/docker/metadata-action#about) to extract tags and labels that will be applied to the specified image.
+      # The `id` "meta" allows the output of this step to be referenced in a subsequent step. The `images` value provides the base name for the tags and labels.
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@a64d0487d7069df33b279515d35d60fa80e2ea62
+        with:
+          images: ghcr.io/estuary/dekaf
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
+            type=sha
+            type=ref,event=branch
+      # This step uses the `docker/build-push-action` action to build the image, based on your repository's `Dockerfile`. If the build succeeds, it pushes the image to GitHub Packages.
+      # It uses the `context` parameter to define the build's context as the set of files located in the specified path. For more information, see "[Usage](https://github.com/docker/build-push-action#usage)" in the README of the `docker/build-push-action` repository.
+      # It uses the `tags` and `labels` parameters to tag and label the image with the output from the "meta" step.
+      - name: Build and push Docker image
+        uses: docker/build-push-action@9552610e81f4c8002dadc4670f1fdced6a2c830b
+        with:
+          context: .
+          file: crates/dekaf/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
\ No newline at end of file
diff --git a/crates/dekaf/.dockerignore b/crates/dekaf/.dockerignore
new file mode 100644
index 0000000000..1d1fe94df4
--- /dev/null
+++ b/crates/dekaf/.dockerignore
@@ -0,0 +1 @@
+Dockerfile
\ No newline at end of file
diff --git a/crates/dekaf/Dockerfile b/crates/dekaf/Dockerfile
new file mode 100644
index 0000000000..8167e6e433
--- /dev/null
+++ b/crates/dekaf/Dockerfile
@@ -0,0 +1,17 @@
+FROM rust:1.81-bookworm
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates
+
+RUN mkdir ~/dekaf
+WORKDIR ~/dekaf
+COPY ./ ./
+
+RUN apt-get install -y clang
+
+# Build and cache as much as possible first, then fail if needed
+RUN cargo build --target x86_64-unknown-linux-gnu --locked --release -p dekaf --keep-going
+RUN cargo build --target x86_64-unknown-linux-gnu --locked --release -p dekaf
+
+USER daemon
+CMD target/x86_64-unknown-linux-gnu/release/dekaf
\ No newline at end of file