diff --git a/.github/workflows/build-buildboxes.yaml b/.github/workflows/build-buildboxes.yaml
new file mode 100644
index 0000000000000..fb804e0d98075
--- /dev/null
+++ b/.github/workflows/build-buildboxes.yaml
@@ -0,0 +1,64 @@
+name: Build buildbox images
+on:
+  push:
+     branches:
+       - master
+       - branch/**
+       - camh/**
+
+jobs:
+  build:
+    name: Build buildboxes
+    runs-on: ubuntu-22.04-32core
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Check changes
+        id: changes
+        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        with:
+          base: ${{ github.ref }}
+          filters: |
+            buildbox:
+              - 'build.assets/versions.mk'
+              - 'build.assets/images.mk'
+              - 'build.assets/buildbox/Dockerfile'
+              - 'build.assets/buildbox/clang-12.sh'
+            thirdparty:
+              - 'build.assets/images.mk'
+              - 'build.assets/buildbox/Dockerfile-thirdparty'
+              - 'build.assets/buildbox/build-buildbox.mk'
+              - 'build.assets/buildbox/buildbox-common.mk'
+              - 'build.assets/buildbox/cross-compile.mk'
+              - 'build.assets/buildbox/crosstoolng-configs/**'
+              - 'build.assets/buildbox/crosstoolng.mk'
+              - 'build.assets/buildbox/pkgconfg/**'
+              - 'build.assets/buildbox/thirdparty-libs.mk'
+
+      - name: Set up Docker Buildx
+        if: steps.changes.outputs.thirdparty || steps.changes.outputs.buildbox
+        uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
+        with:
+          driver: docker
+
+      - name: Login to registry
+        if: steps.changes.outputs.thirdparty || steps.changes.outputs.buildbox
+        uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build buildbox-thirdparty
+        if: steps.changes.outputs.thirdparty
+        run:
+          make -C build.assets buildbox-thirdparty PUSH=1
+
+      - name: Build buildbox-ng
+        if: steps.changes.outputs.thirdparty || steps.changes.outputs.buildbox
+        run:
+          make -C build.assets buildbox-ng PUSH=1
diff --git a/build.assets/Makefile b/build.assets/Makefile
index 84209f27924e6..a75782bc0c8c1 100644
--- a/build.assets/Makefile
+++ b/build.assets/Makefile
@@ -109,64 +109,7 @@ build-binaries-fips: buildbox-centos7-fips webassets
 	docker run $(DOCKERFLAGS) $(NOROOT) $(BUILDBOX_CENTOS7_FIPS) \
 		make -C $(SRCDIR)/e ADDFLAGS='$(ADDFLAGS)' VERSION=$(VERSION) GITTAG=v$(VERSION) PIV=$(PIV) FIPS=yes clean full
 
-#
-# Build the buildbox thirdparty components. This rarely needs to be rebuilt and is
-# slow to build, so it is done separately from the main buildbox
-#
-.PHONY: buildbox-thirdparty
-buildbox-thirdparty:
-	docker buildx build \
-		--cache-from $(BUILDBOX_THIRDPARTY) \
-		--cache-to type=inline \
-		$(if $(PUSH),--push,--load) \
-		--tag $(BUILDBOX_THIRDPARTY) \
-		-f buildbox/Dockerfile-thirdparty \
-		buildbox
-
-#
-# A generic build rule to build a stage of Dockerfile-thirdparty based
-# on the $(STAGE) variable. These stage builds are used for development
-# of the thirdparty buildbox, whether to configure crosstool-NG
-# (see config/buildbox-ng), or when adding additional third party
-# libraries using either the compilers stage or libs stage.
-#
-.PHONY: buildbox-thirdparty-stage
-buildbox-thirdparty-stage:
-	docker buildx build \
-		--load \
-		--tag buildbox-thirdparty-$(STAGE):$(BUILDBOX_VERSION) \
-		-f buildbox/Dockerfile-thirdparty \
-		--target $(STAGE) \
-		buildbox
-
-.PHONY: buildbox-thirdparty-crosstoolng
-buildbox-thirdparty-crosstoolng: STAGE=crosstoolng
-buildbox-thirdparty-crosstoolng: buildbox-thirdparty-stage
-
-.PHONY: buildbox-thirdparty-compilers
-buildbox-thirdparty-compilers: STAGE=compilers
-buildbox-thirdparty-compilers: buildbox-thirdparty-stage
-
-.PHONY: buildbox-thirdparty-libs
-buildbox-thirdparty-libs: STAGE=libs
-buildbox-thirdparty-libs: buildbox-thirdparty-stage
-
-#
-# Build the buildbox-ng using the pre-built third party components from the
-# buildbox-thirdparty image
-#
-.PHONY: buildbox-ng
-buildbox-ng:
-	docker buildx build \
-		--build-arg THIRDPARTY_IMAGE=$(BUILDBOX_THIRDPARTY) \
-		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
-		--build-arg RUST_VERSION=$(RUST_VERSION) \
-		--cache-from $(BUILDBOX_NG) \
-		--cache-to type=inline \
-		$(if $(PUSH),--push,--load) \
-		--tag $(BUILDBOX_NG) \
-		-f buildbox/Dockerfile \
-		buildbox
+include buildbox/build-buildbox.mk
 
 # Builds a Docker container which is used for building official Teleport binaries
 # If running in CI and there is no image with the buildbox name:tag combination present locally,
diff --git a/build.assets/buildbox/build-buildbox.mk b/build.assets/buildbox/build-buildbox.mk
new file mode 100644
index 0000000000000..1a1913508efa8
--- /dev/null
+++ b/build.assets/buildbox/build-buildbox.mk
@@ -0,0 +1,65 @@
+# This makefile fragment is included in build.assets/Makefile.
+# It depends on these already being included:
+#   * build.assets/version.mk (for GOLANG_VERSION AND RUST_VERSION)
+#   * build.assets/images.mk (for BUILDBOX_NG and BUILDBOX_THIRDPARTY)
+
+
+#
+# Build the buildbox-ng using the pre-built third party components from the
+# buildbox-thirdparty image
+#
+.PHONY: buildbox-ng
+buildbox-ng:
+	docker buildx build \
+		--build-arg THIRDPARTY_IMAGE=$(BUILDBOX_THIRDPARTY) \
+		--build-arg GOLANG_VERSION=$(GOLANG_VERSION) \
+		--build-arg RUST_VERSION=$(RUST_VERSION) \
+		--cache-from $(BUILDBOX_NG) \
+		--cache-to type=inline \
+		$(if $(PUSH),--push,--load) \
+		--tag $(BUILDBOX_NG) \
+		-f buildbox/Dockerfile \
+		buildbox
+
+#
+# Build the buildbox thirdparty components. This rarely needs to be rebuilt and is
+# slow to build, so it is done separately from the main buildbox
+#
+.PHONY: buildbox-thirdparty
+buildbox-thirdparty:
+	docker buildx build \
+		--cache-from $(BUILDBOX_THIRDPARTY) \
+		--cache-to type=inline \
+		$(if $(PUSH),--push,--load) \
+		--tag $(BUILDBOX_THIRDPARTY) \
+		-f buildbox/Dockerfile-thirdparty \
+		buildbox
+
+#
+# A generic build rule to build a stage of Dockerfile-thirdparty based
+# on the $(STAGE) variable. These stage builds are used for development
+# of the thirdparty buildbox, whether to configure crosstool-NG
+# (see config/buildbox-ng), or when adding additional third party
+# libraries using either the compilers stage or libs stage.
+#
+.PHONY: buildbox-thirdparty-stage
+buildbox-thirdparty-stage:
+	docker buildx build \
+		--load \
+		--tag buildbox-thirdparty-$(STAGE):$(BUILDBOX_VERSION) \
+		-f buildbox/Dockerfile-thirdparty \
+		--target $(STAGE) \
+		buildbox
+
+.PHONY: buildbox-thirdparty-crosstoolng
+buildbox-thirdparty-crosstoolng: STAGE=crosstoolng
+buildbox-thirdparty-crosstoolng: buildbox-thirdparty-stage
+
+.PHONY: buildbox-thirdparty-compilers
+buildbox-thirdparty-compilers: STAGE=compilers
+buildbox-thirdparty-compilers: buildbox-thirdparty-stage
+
+.PHONY: buildbox-thirdparty-libs
+buildbox-thirdparty-libs: STAGE=libs
+buildbox-thirdparty-libs: buildbox-thirdparty-stage
+