diff --git a/Dockerfile.config-check b/Dockerfile.config-check
new file mode 100644
index 00000000..5a619d8e
--- /dev/null
+++ b/Dockerfile.config-check
@@ -0,0 +1,15 @@
+FROM golang:1.26.4@sha256:68cb6d68bed024785b69195b89af7ac7a444f27791435f98647edff595aa0479 AS build
+WORKDIR /ratelimit
+
+ENV GOPROXY=https://proxy.golang.org
+COPY go.mod go.sum /ratelimit/
+RUN go mod download
+
+COPY src src
+COPY script script
+
+RUN CGO_ENABLED=0 GOOS=linux go build -o /go/bin/ratelimit_config_check -ldflags="-w -s" -v github.com/envoyproxy/ratelimit/src/config_check_cmd
+
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:e8a4044e0b4ae4257efa45fc026c0bc30ad320d43bd4c1a7d5271bd241e386d0
+COPY --from=build /go/bin/ratelimit_config_check /bin/ratelimit_config_check
+ENTRYPOINT ["/bin/ratelimit_config_check"]
diff --git a/Makefile b/Makefile
index 342e2beb..67a407ff 100644
--- a/Makefile
+++ b/Makefile
@@ -137,6 +137,10 @@ docker_image: docker_tests
 docker_push: docker_image
 	docker push $(IMAGE):$(VERSION)
 
+.PHONY: docker_config_check_image
+docker_config_check_image:
+	docker build -f Dockerfile.config-check . -t $(IMAGE)-config-check:$(VERSION)	
+
 .PHONY: docker_multiarch_image
 docker_multiarch_image: docker_tests
 	docker buildx build -t $(IMAGE):$(VERSION) --platform $(BUILDX_PLATFORMS) .
@@ -145,6 +149,10 @@ docker_multiarch_image: docker_tests
 docker_multiarch_push: docker_multiarch_image
 	docker buildx build -t $(IMAGE):$(VERSION) --platform $(BUILDX_PLATFORMS) --push .
 
+.PHONY: docker_multiarch_config_check_image
+docker_multiarch_config_check_image: docker_config_check_image
+	docker buildx build -t $(IMAGE)-config-check:$(VERSION) --platform $(BUILDX_PLATFORMS) .
+
 .PHONY: integration_tests
 integration_tests:
 	$(DOCKER_COMPOSE) --project-directory $(PWD)  -f integration-test/docker-compose-integration-test.yml up --build  --exit-code-from tester