diff --git a/.github/scripts/src/build-images/index.ts b/.github/scripts/src/build-images/index.ts
index a1270fb..e2721cd 100644
--- a/.github/scripts/src/build-images/index.ts
+++ b/.github/scripts/src/build-images/index.ts
@@ -17,7 +17,7 @@ const { ver, shouldUpload } = await yargs(hideBin(process.argv))
   .strict()
   .parse();
 
-const targets = ["pg-az"] as const;
+const targets = ["pg-az", "gerrit"] as const;
 
 export async function main() {
   const { dockerHubPat, dockerHubUsername } = parseCiEnv();
diff --git a/Justfile b/Justfile
index d808a4e..5eaffe5 100644
--- a/Justfile
+++ b/Justfile
@@ -1,6 +1,9 @@
 build-pg-az:
     docker build --platform linux/amd64 -t Patina-Network/pg-az -f src/pg-az/Dockerfile .
 
+build-gerrit:
+    docker build --platform linux/amd64 -t Patina-Network/gerrit -f src/gerrit/Dockerfile .
+
 install-pre-scripts:
     just install-pre-commit && just install-pre-push
 
diff --git a/src/gerrit/Dockerfile b/src/gerrit/Dockerfile
new file mode 100644
index 0000000..86e2f8f
--- /dev/null
+++ b/src/gerrit/Dockerfile
@@ -0,0 +1,14 @@
+# thin layer over `gerritcodereview/gerrit` that will install plugins as well.
+
+ARG GERRIT_VERSION=3.13.4
+FROM gerritcodereview/gerrit:${GERRIT_VERSION}
+
+# make sq happy
+USER gerrit
+
+# add plugins here
+
+ADD --chown=gerrit:gerrit \
+  https://github.com/davido/gerrit-oauth-provider/releases/download/v3.13.4/gerrit-oauth-provider.jar \
+  /var/gerrit/plugins/gerrit-oauth-provider.jar
+