diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 000000000..8b91a436d
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,19 @@
+name: docker
+
+on:
+  pull_request:
+    paths:
+      - Dockerfile
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      DOCKER_BUILDKIT: "1"
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
+      - run: docker build . --build-arg PROXY_UNOPTIMIZED=1
diff --git a/Dockerfile b/Dockerfile
index aa18facda..e370b9511 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -61,16 +61,7 @@ RUN --mount=type=cache,target=target \
 ## Install the proxy binary into the base runtime image.
 FROM $RUNTIME_IMAGE as runtime
 
-# When set, causes the proxy to remove the identity wrapper responsible for
-# CSR and key generation.
-ARG SKIP_IDENTITY_WRAPPER
-
 WORKDIR /linkerd
 COPY --from=build /out/linkerd2-proxy /usr/lib/linkerd/linkerd2-proxy
 ENV LINKERD2_PROXY_LOG=warn,linkerd=info
-RUN \
-  if [ -n "$SKIP_IDENTITY_WRAPPER" ] ; then \
-    rm -f /usr/bin/linkerd2-proxy-run && \
-    ln /usr/lib/linkerd/linkerd2-proxy /usr/bin/linkerd2-proxy-run ; \
-  fi
 # Inherits the ENTRYPOINT from the runtime image.