diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8ca947b88..050c13d77 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -173,6 +173,13 @@ workflows:
             - publish-oci-images
           context:
             - skupper-org
+      - publish-source-image:
+          <<: *run_for_numeric_tags
+          image_tag: << pipeline.git.tag >>
+          requires:
+            - publish-oci-images
+          context:
+            - skupper-org
   build:
     jobs:
       - build-all:
@@ -376,6 +383,19 @@ jobs:
           command: docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
       - run: make docker-build-must-gather IMAGE_TAG="<< parameters.image_tag >>"
       - run: make docker-push-must-gather IMAGE_TAG="<< parameters.image_tag >>"
+  publish-source-image:
+    executor:
+      name: go_cimg
+    parameters:
+      image_tag:
+        type: string
+    steps:
+      - checkout
+      - setup_remote_docker
+      - run:
+          name: Docker login
+          command: docker login quay.io -u ${QUAY_LOGIN} -p ${QUAY_PASSWORD}
+      - run: make docker-push-source IMAGE_TAG="<< parameters.image_tag >>"
   generate-operator-bundle:
     executor:
       name: go_cimg
diff --git a/.dockerignore b/.dockerignore
index f3bfc2862..28feaa9ea 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -2,6 +2,8 @@
 .circleci
 .github
 .codespellrc
+.git/
+vendor/
 
 # Documentation
 README.md
diff --git a/Dockerfile.source b/Dockerfile.source
new file mode 100644
index 000000000..da92c90a6
--- /dev/null
+++ b/Dockerfile.source
@@ -0,0 +1,21 @@
+# OCI image that packages the Skupper source tree for reproducible downstream builds.
+# Not intended to be run; publish to quay.io/skupper/skupper-source:<version> and
+# consume via build context / additional build contexts instead of git clone.
+ARG GO_IMAGE_BASE_TAG=1.25
+FROM golang:${GO_IMAGE_BASE_TAG} AS vendor
+
+WORKDIR /go/src/app
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod \
+    go mod download
+COPY . .
+RUN go mod vendor
+
+FROM scratch
+
+LABEL \
+  org.opencontainers.image.title="Skupper source" \
+  org.opencontainers.image.description="Skupper source tree at a fixed release for downstream container builds"
+
+# Match upstream Dockerfile.* builder layout (WORKDIR /go/src/app).
+COPY --from=vendor /go/src/app /go/src/app
diff --git a/Makefile b/Makefile
index e7f1ddfc0..7f671cb0b 100644
--- a/Makefile
+++ b/Makefile
@@ -6,6 +6,7 @@ GOARCH ?= amd64
 
 REGISTRY := quay.io/skupper
 IMAGE_TAG := v2-dev
+SOURCE_IMAGE := skupper-source
 ROUTER_IMAGE_TAG := main
 PLATFORMS ?= linux/amd64,linux/arm64
 CONTAINERFILES := Dockerfile.cli Dockerfile.kube-adaptor Dockerfile.controller Dockerfile.network-observer Dockerfile.system-controller
@@ -120,6 +121,19 @@ podman-build-must-gather:
 podman-push-must-gather:
 	${PODMAN} push "${REGISTRY}/skupper-must-gather:${IMAGE_TAG}"
 
+## Source tree OCI image for downstream build contexts (see Dockerfile.source).
+docker-build-source:
+	${DOCKER} build --build-arg GO_IMAGE_BASE_TAG=$(GO_IMAGE_BASE_TAG) $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .
+
+docker-push-source: docker-build-source
+	${DOCKER} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}"
+
+podman-build-source:
+	${PODMAN} build --build-arg GO_IMAGE_BASE_TAG=$(GO_IMAGE_BASE_TAG) $(SHARED_IMAGE_LABELS) -t "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}" -f Dockerfile.source .
+
+podman-push-source: podman-build-source
+	${PODMAN} push "${REGISTRY}/${SOURCE_IMAGE}:${IMAGE_TAG}"
+
 ## Print fully qualified image names by arch
 describe-multiarch-oci:
 	@scripts/oci-index-archive-info.sh amd64 arm64