diff --git a/Dockerfile b/Dockerfile
index 21ceff2..4620787 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:latest
+FROM alpine:3.22.1 AS base
 
 RUN apk add --no-cache socat netcat-openbsd \
     && rm -rf /var/cache/apk/* /tmp/*
@@ -7,4 +7,20 @@ COPY entrypoint.sh VERSION /
 RUN mkdir -p /socket \
     && chmod +x /entrypoint.sh
 
-ENTRYPOINT ["/entrypoint.sh"]
\ No newline at end of file
+FROM base AS test
+
+RUN apk add --no-cache bats bash procps
+
+WORKDIR /app
+COPY entrypoint.sh VERSION /app/
+COPY tests/ /app/tests/
+
+FROM base AS lint
+
+RUN apk add --no-cache shellcheck
+RUN shellcheck --severity=error -s sh /entrypoint.sh
+
+# Kept as the last stage so `docker build .` (no --target) still produces
+# the lean prod image, not the `test`/`lint` stages above.
+FROM base
+ENTRYPOINT ["/entrypoint.sh"]