diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 00000000000..a16f4114bc4
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,35 @@
+name: build
+on:
+  push: {} # TODO: fix before merge
+  pull_request: {}
+concurrency: ${{ github.ref }}
+permissions:
+  contents: read
+  id-token: write
+
+jobs:
+  build:
+    runs-on: [gyg-gha-runner-32x128]
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Login to Docker Hub
+      uses: docker/login-action@v3
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+    - name: Build and push
+      uses: docker/build-push-action@v6
+      with:
+        pull: true
+        file: tools/router-check-tool/Dockerfile
+        context: .
+        platforms: linux/amd64
+        push: true
+        # push: ${{ github.ref_name == github.event.repository.default_branch && github.event_name == 'push'}}
+        tags: getyourguide/router-check-tool:release-1.22
diff --git a/BUILD b/BUILD
index afec159fdba..7dea78a96a7 100644
--- a/BUILD
+++ b/BUILD
@@ -1,6 +1,7 @@
 load(
     "@envoy//bazel:envoy_build_system.bzl",
     "envoy_cc_binary",
+    "envoy_cc_test_binary",
 )
 
 # Copyright 2016 Istio Authors. All Rights Reserved.
@@ -54,3 +55,18 @@ pkg_tar(
     package_dir = "/usr/local/bin/",
     tags = ["manual"],
 )
+
+envoy_cc_test_binary(
+    name = "router_check_tool",
+    repository = "@envoy",
+    srcs = [
+        "@envoy//test/tools/router_check:router_check.cc",
+    ],
+    deps = ISTIO_EXTENSIONS +  [
+        "@envoy//test/tools/router_check:router_check_main_lib",
+        "@envoy//source/extensions/retry/host/previous_hosts:config",
+        "@envoy//source/extensions/retry/host/omit_canary_hosts:config",
+        "@envoy//source/extensions/retry/host/omit_host_metadata:config",
+        "@envoy//source/extensions/filters/http/fault:config",
+    ],
+)
diff --git a/WORKSPACE b/WORKSPACE
index 130a8c12ef5..c98b1772667 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -38,6 +38,8 @@ http_archive(
     sha256 = ENVOY_SHA256,
     strip_prefix = ENVOY_REPO + "-" + ENVOY_SHA,
     url = "https://github.com/" + ENVOY_ORG + "/" + ENVOY_REPO + "/archive/" + ENVOY_SHA + ".tar.gz",
+    patches = ["router_check.patch"],
+    patch_args = ["-p1"],
 )
 
 load("@envoy//bazel:api_binding.bzl", "envoy_api_binding")
diff --git a/external/router_check.patch b/external/router_check.patch
new file mode 100644
index 00000000000..5fa9f89c5f9
--- /dev/null
+++ b/external/router_check.patch
@@ -0,0 +1,14 @@
+diff --git a/test/tools/router_check/router.cc b/test/tools/router_check/router.cc
+index 410caf6cc0..84c9670d77 100644
+--- a/test/tools/router_check/router.cc
++++ b/test/tools/router_check/router.cc
+@@ -137,6 +137,9 @@ RouterCheckTool RouterCheckTool::create(const std::string& router_config_file,
+   assignRuntimeFraction(route_config);
+   auto factory_context =
+       std::make_unique<NiceMock<Server::Configuration::MockServerFactoryContext>>();
++
++  Runtime::maybeSetDeprecatedInts("re2.max_program_size.error_level", 32768); // istio-proxy default
++
+   auto config = *Router::ConfigImpl::create(route_config, *factory_context,
+                                             ProtobufMessage::getNullValidationVisitor(), false);
+   if (!disable_deprecation_check) {
diff --git a/tools/router-check-tool/Dockerfile b/tools/router-check-tool/Dockerfile
new file mode 100644
index 00000000000..39c519ff0cc
--- /dev/null
+++ b/tools/router-check-tool/Dockerfile
@@ -0,0 +1,15 @@
+FROM gcr.io/istio-testing/build-tools-proxy:master-latest as builder
+
+WORKDIR /work/
+
+COPY . /work/
+
+RUN bazel build //:router_check_tool
+
+FROM ubuntu
+
+COPY --from=builder /work/bazel-bin/router_check_tool /usr/local/bin/
+
+USER nobody:nogroup
+
+ENTRYPOINT [ "/usr/local/bin/router_check_tool"]
diff --git a/tools/router-check-tool/README.md b/tools/router-check-tool/README.md
new file mode 100644
index 00000000000..c4c62de4a98
--- /dev/null
+++ b/tools/router-check-tool/README.md
@@ -0,0 +1,7 @@
+# Envoy Router Check Tool
+
+Istio compatible [Route Table Check Tool](https://www.envoyproxy.io/docs/envoy/latest/configuration/operations/tools/router_check).
+
+- [Patches](../../external/router_check.patch) needed to work with Istio.
+- [BUILD](../../BUILD) with configuration to build `router_check_tool` using Istio's filters.
+- [Dockerfile](./Dockerfile) to build the image.