diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 57a205233e..b34b40d0a7 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -308,6 +308,68 @@ jobs:
             alerts.yaml:application/prometheus-alerts+yaml
         working-directory: monitoring
 
+  build-kms:
+    # BNaaS D1 epic only. Federation pins scality-kms at the CloudServer
+    # version, and an epic tag retags CI images instead of running the
+    # release workflow, so each epic head needs its own scality-kms image.
+    # It is built on top of the federation image of the build job. The
+    # build log stays quiet: this repository is public, scality-kms is not.
+    needs: build
+    if: github.ref == 'refs/heads/epic/S3C-10971-bnaas-d1' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Generate GitHub App Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ vars.ACTIONS_APP_ID }}
+          private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: scality-kms
+          permission-contents: read
+
+      - name: Checkout scality-kms
+        id: kms-checkout
+        uses: actions/checkout@v4
+        with:
+          repository: scality/scality-kms
+          ref: main
+          token: ${{ steps.app-token.outputs.token }}
+          path: scality-kms
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to GitHub Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ github.token }}
+
+      - name: Build and push scality-kms image
+        uses: docker/build-push-action@v5
+        env:
+          BUILDKIT_PROGRESS: quiet
+          DOCKER_BUILD_SUMMARY: false
+          DOCKER_BUILD_RECORD_UPLOAD: false
+        with:
+          push: true
+          context: scality-kms
+          provenance: false
+          build-args: |
+            CLOUDSERVER_TAG=${{ github.sha }}-federation
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/scality-kms:${{ github.sha }}-federation
+          labels: |
+            git.repository=${{ github.repository }}
+            git.commit-sha=${{ github.sha }}
+            scality-kms.commit-sha=${{ steps.kms-checkout.outputs.commit }}
+
   multiple-backend:
     runs-on: ubuntu-24.04
     needs: build