diff --git a/docker/Dockerfile.cli.alpine.multiarch.rootless b/docker/Dockerfile.cli.alpine.multiarch.rootless
new file mode 100644
index 000000000..9a9fcf43f
--- /dev/null
+++ b/docker/Dockerfile.cli.alpine.multiarch.rootless
@@ -0,0 +1,25 @@
+FROM --platform=$BUILDPLATFORM docker.io/golang:1.23 AS build
+
+WORKDIR /src
+COPY . .
+ARG TARGETOS TARGETARCH CI_COMMIT_SHA CI_COMMIT_TAG CI_COMMIT_BRANCH
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg \
+    make build-cli
+
+FROM docker.io/alpine:3.21
+WORKDIR /woodpecker
+
+RUN apk add -U --no-cache ca-certificates
+
+ENV GODEBUG=netdns=go
+ENV WOODPECKER_DISABLE_UPDATE_CHECK=true
+
+COPY --from=build /src/dist/woodpecker-cli /bin/
+
+RUN addgroup -S woodpecker && adduser -S woodpecker -G woodpecker
+
+USER woodpecker
+
+HEALTHCHECK CMD ["/bin/woodpecker-cli", "ping"]
+ENTRYPOINT ["/bin/woodpecker-cli"]