diff --git a/Dockerfile b/Dockerfile
index 92659baf74..206895b7ac 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,6 @@
 # syntax=docker/dockerfile:1
 
+ARG ALPINE_VERSION=3.19
 ARG GO_VERSION=1.21
 ARG HTMLTEST_VERSION=0.17.0
 
@@ -76,5 +77,11 @@ COPY --from=build-upstream /out ./public
 ADD .htmltest.yml .htmltest.yml
 RUN htmltest
 
+FROM alpine:${ALPINE_VERSION} AS unused-media
+RUN apk add --no-cache fd ripgrep
+WORKDIR /test
+RUN --mount=type=bind,target=. \
+    ./scripts/test_unused_media.sh
+
 FROM scratch AS release
 COPY --from=build /out /
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 71036457da..0905e1cc9c 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -27,7 +27,7 @@ target "release" {
 }
 
 group "validate" {
-  targets = ["lint", "test"]
+  targets = ["lint", "test", "unused-media"]
 }
 
 target "test" {
@@ -40,6 +40,11 @@ target "lint" {
   output = ["type=cacheonly"]
 }
 
+target "unused-media" {
+  target = "unused-media"
+  output = ["type=cacheonly"]
+}
+
 #
 # releaser targets are defined in _releaser/Dockerfile
 # and are used for Netlify and AWS S3 deployment