diff --git a/.github/workflows/docker-hub-publish.yml b/.github/workflows/docker-hub-publish.yml
new file mode 100644
index 0000000000..80f46aad18
--- /dev/null
+++ b/.github/workflows/docker-hub-publish.yml
@@ -0,0 +1,75 @@
+name: Publish Testing Image to Docker Hub
+
+# Builds the Fleet testing image (enterprise features unlocked) and pushes to Docker Hub.
+# This is used for the Render staging deployment to test all enterprise features.
+
+on:
+  push:
+    branches:
+      - "main"
+      - "staging"
+      - "staging-*"
+    paths:
+      # Only rebuild when Go source, Dockerfile, or build config changes
+      - "server/**"
+      - "cmd/**"
+      - "pkg/**"
+      - "orbit/**"
+      - "ee/**"
+      - "go.mod"
+      - "go.sum"
+      - "Dockerfile.testing"
+      - "render.yaml"
+      - ".github/workflows/docker-hub-publish.yml"
+  workflow_dispatch: # Manual trigger
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        with:
+          fetch-depth: 0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.5.0
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }}
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
+        with:
+          images: ${{ secrets.DOCKERHUB_USERNAME }}/fleet
+          tags: |
+            type=ref,event=branch
+            type=sha,prefix=commit-
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@0565240e2d4ab88bba5387d71956528024203009 # v5.3.0
+        with:
+          context: .
+          file: ./tools/fleet-docker/Dockerfile
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          platforms: linux/amd64