diff --git a/.dockerignore b/.dockerignore
index b9fb09fc..7c6f0b12 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -38,11 +38,14 @@
 !scenarios/*/**
 
 # Re-include the integration harness suite for test/integration/Dockerfile. It is
-# entirely *_test.go (excluded above) behind the integration build tag, and its
-# fault/seiload manifests are //go:embed-ed *.tmpl (excluded by **). Without
-# these the `go test -c -tags integration ./test/integration/` build fails with
+# entirely *_test.go (excluded above) behind the integration build tag. Without
+# this the `go test -c -tags integration ./test/integration/` build fails with
 # "directory not found". These also enter the controller + seitask build contexts
 # (both COPY . .) but are inert there — neither build compiles ./test/integration
 # nor passes the integration tag.
 !test/integration/**/*_test.go
-!test/integration/**/*.tmpl
+
+# The importable fault catalog and seiload Job renderer (harness/faults,
+# harness/bench) //go:embed their *.yaml.tmpl manifests; the integration suite
+# imports both, so the harness build needs them in the context too.
+!harness/**/*.tmpl
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6862c663..5d54f9f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -107,6 +107,17 @@ jobs:
           platforms: linux/amd64
           cache-from: type=gha,scope=sidecar
           cache-to: type=gha,scope=sidecar,mode=max
+      # The test suite's //go:embed targets live outside the paths the other two
+      # images compile, so only this build catches a .dockerignore gap for them.
+      - name: Build integration-harness image
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: test/integration/Dockerfile
+          push: false
+          platforms: linux/amd64
+          cache-from: type=gha,scope=integration-harness
+          cache-to: type=gha,scope=integration-harness,mode=max
 
   test:
     runs-on: ubuntu-latest