diff --git a/.github/workflows/updater-ci.yml b/.github/workflows/updater-ci.yml
index da71d84e..1779d301 100644
--- a/.github/workflows/updater-ci.yml
+++ b/.github/workflows/updater-ci.yml
@@ -3,12 +3,14 @@ name: Updater CI
 on:
   pull_request:
     paths:
+      - "deployment/compose.postgres.yml"
       - "deployment/updater/**"
       - ".github/workflows/updater-ci.yml"
   push:
     branches:
       - main
     paths:
+      - "deployment/compose.postgres.yml"
       - "deployment/updater/**"
       - ".github/workflows/updater-ci.yml"
 
@@ -79,3 +81,27 @@ jobs:
         run: |
           mkdir -p dist
           go build -o dist/control-plane-updater-${{ matrix.goos }}-${{ matrix.goarch }} .
+
+  image:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    defaults:
+      run:
+        working-directory: deployment/updater
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build updater image
+        run: docker buildx build --pull --load --platform "${{ matrix.platform }}" --tag techulus-cloud-updater:test .
diff --git a/deployment/updater/Dockerfile b/deployment/updater/Dockerfile
index 1aefe27e..f463f92f 100644
--- a/deployment/updater/Dockerfile
+++ b/deployment/updater/Dockerfile
@@ -3,9 +3,20 @@ WORKDIR /src
 COPY go.mod main.go ./
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/control-plane-updater .
 
-FROM docker:28-cli
+FROM docker:28-cli AS docker-cli
 
-RUN apk add --no-cache bash curl docker-cli-compose postgresql-client
+FROM alpine:3.23
+
+# Keep pg_dump on the same major version as the bundled postgres:18 service.
+RUN apk add --no-cache ca-certificates curl postgresql18-client
+
+COPY --from=docker-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker-cli /usr/local/libexec/docker/cli-plugins/docker-compose /usr/local/libexec/docker/cli-plugins/docker-compose
+
+RUN pg_dump --version | grep -Eq 'PostgreSQL\) 18\.' \
+    && docker --version \
+    && docker compose version \
+    && curl --version
 
 WORKDIR /app
 COPY --from=builder /out/control-plane-updater ./control-plane-updater