diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 77547c5ed..2d0b606ce 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -57,6 +57,36 @@ build-ci-builder:
       --dockerfile "${CI_PROJECT_DIR}/infra/docker/Dockerfile.ci-builder"
       --destination "${CI_BUILDER_IMAGE}"
 
+# --------------------------------------------------------------------------
+# Stage 0b: Build devcontainer image → push to internal GitLab registry
+# --------------------------------------------------------------------------
+build-devcontainer:
+  stage: prepare
+  image:
+    name: gcr.io/kaniko-project/executor:debug
+    entrypoint: [""]
+  tags:
+    - kapsule
+    - docker
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "push"
+      changes:
+        - .devcontainer/**
+      when: on_success
+    - when: manual
+      allow_failure: true
+  before_script:
+    - mkdir -p /kaniko/.docker
+    - |
+      echo "{\"auths\":{\"${INTERNAL_REGISTRY}\":{\"username\":\"${CI_REGISTRY_USER}\",\"password\":\"${CI_REGISTRY_PASSWORD}\"},\"rg.fr-par.scw.cloud\":{\"username\":\"nologin\",\"password\":\"${SCW_SECRET_KEY}\"}}}" > /kaniko/.docker/config.json
+  script:
+    - /kaniko/executor
+      --context "${CI_PROJECT_DIR}"
+      --dockerfile "${CI_PROJECT_DIR}/.devcontainer/Dockerfile"
+      --insecure-registry "${INTERNAL_REGISTRY}"
+      --destination "${REGISTRY}/devcontainer:${CI_COMMIT_SHA}"
+      --destination "${REGISTRY}/devcontainer:latest"
+
 # Base template for Rust jobs — pre-baked CI builder from Scaleway CR
 # Image pre-exists in SCR; rebuild via build-ci-builder when Dockerfile changes
 .rust-base: