diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b1a612f..c83d1ea 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -1,6 +1,6 @@
 # Auto-generated by ContainerHive
 # Do not edit - regenerate with: ch --project github template ci --provider github --output .github/workflows/main.yml --image-name ghcr.io/containerhive/containerhive
-# tag_ranges resolved to 10 shard unit(s) - regenerate if this changes.
+# tag_ranges resolved to 11 shard unit(s) - regenerate if this changes.
 
 name: Build Images
 
@@ -370,6 +370,113 @@ jobs:
           comment: 'true'
           updateComment: 'true'
           include_passed: 'true'
+  # === DETERMINISTIC-ZIP ===
+
+  build-deterministic-zip-amd64:
+    runs-on: ubuntu-24.04
+    needs:
+      - generate
+      - lint
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+        with:
+          lfs: true
+      - name: Download generated files
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: generated
+          path: github/dist/
+      - name: Prepare temp directory
+        run: mkdir -p "$RUNNER_TEMP/ch"
+      - name: Create Docker network
+        run: docker network create ch-net
+      - name: Start BuildKit daemon
+        run: docker run -d --name buildkitd --privileged --network ch-net moby/buildkit:v0.31.0 --addr tcp://0.0.0.0:8372
+      - name: Login to registry
+        run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io"
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io
+      - name: Wait for BuildKit
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github wait --buildkitd
+      - name: Build image
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github build deterministic-zip --platform amd64 --build-id "$SNAPSHOT_ID"
+      - name: Generate SBOM
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e BUILDKIT_HOST=tcp://buildkitd:8372 $CH_IMAGE ch -p github sbom deterministic-zip --platform amd64 --build-id "$SNAPSHOT_ID"
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: deterministic-zip-amd64-sbom
+          path: github/dist/*/*/*/cyclonedx.json
+          retention-days: 30
+
+
+  manifest-deterministic-zip:
+    runs-on: ubuntu-latest
+    needs:
+      - test-deterministic-zip
+      - build-deterministic-zip-amd64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+        with:
+          lfs: true
+      - name: Download generated files
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: generated
+          path: github/dist/
+      - name: Prepare temp directory
+        run: mkdir -p "$RUNNER_TEMP/ch"
+      - name: Login to registry
+        run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io"
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io
+      - name: Finalize manifest
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" $CH_IMAGE ch -p github finalize deterministic-zip --build-id "$SNAPSHOT_ID"
+
+  test-deterministic-zip:
+    runs-on: ubuntu-latest
+    needs:
+      - build-deterministic-zip-amd64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v7.0.1
+        with:
+          lfs: true
+      - name: Download generated files
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: generated
+          path: github/dist/
+      - name: Prepare temp directory
+        run: mkdir -p "$RUNNER_TEMP/ch"
+      - name: Setup QEMU
+        run: docker run --rm --privileged multiarch/qemu-user-static --reset -p yes
+      - name: Create Docker network
+        run: docker network create ch-net
+      - name: Start Docker-in-Docker
+        run: docker run -d --name dind --privileged --network ch-net -e DOCKER_TLS_CERTDIR="" docker:dind
+      - name: Login to registry
+        run: echo "${{ secrets.CONTAINER_HIVE_REGISTRY_PASSWORD }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github login -u "${{ secrets.CONTAINER_HIVE_REGISTRY_USERNAME }}" --password-stdin "ghcr.io"
+      - name: Login to GHCR
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -i -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github login -u "${{ github.actor }}" --password-stdin ghcr.io
+      - name: Wait for Docker socket
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github wait --docker-socket
+      - name: Run container tests
+        run: docker run --rm --entrypoint="" -u "$(id -u):$(id -g)" -e CI=1 -e HOME="$RUNNER_TEMP/ch" -v "$RUNNER_TEMP/ch:$RUNNER_TEMP/ch" -v "$GITHUB_WORKSPACE:$GITHUB_WORKSPACE" -w "$GITHUB_WORKSPACE" --network ch-net -e DOCKER_HOST=tcp://dind:2375 $CH_IMAGE ch -p github test deterministic-zip --build-id "$SNAPSHOT_ID"
+      - name: Publish Test Report
+        id: test-report
+        uses: mikepenz/action-junit-report@v6.5.0
+        if: success() || failure()
+        with:
+          check_name: "Container Structure Tests - deterministic-zip"
+          report_paths: 'github/dist/**/*-cst-report.xml'
+          require_tests: 'false'
+          detailed_summary: 'true'
+          comment: 'true'
+          updateComment: 'true'
+          include_passed: 'true'
   # === GOLANG ===
 
   build-golang-amd64:
@@ -806,6 +913,7 @@ jobs:
       - build-base-ci-arm64
       - build-base-deployment-amd64
       - build-base-deployment-arm64
+      - build-deterministic-zip-amd64
       - build-golang-amd64
       - build-node-amd64
       - build-dotnet-runtime-amd64
@@ -841,6 +949,11 @@ jobs:
         with:
           name: base-deployment-arm64-sbom
           path: github/dist/
+      - name: Download deterministic-zip-amd64 SBOM
+        uses: actions/download-artifact@v8.0.1
+        with:
+          name: deterministic-zip-amd64-sbom
+          path: github/dist/
       - name: Download golang-amd64 SBOM
         uses: actions/download-artifact@v8.0.1
         with:
diff --git a/_base/images/deterministic-zip/Dockerfile b/_base/images/deterministic-zip/Dockerfile
new file mode 100644
index 0000000..cdff8f4
--- /dev/null
+++ b/_base/images/deterministic-zip/Dockerfile
@@ -0,0 +1,3 @@
+FROM scratch
+ARG DETERMINISTIC_ZIP_VERSION
+LABEL deterministic-zip.version="${DETERMINISTIC_ZIP_VERSION}"
diff --git a/_base/images/deterministic-zip/README.md b/_base/images/deterministic-zip/README.md
new file mode 100644
index 0000000..4624215
--- /dev/null
+++ b/_base/images/deterministic-zip/README.md
@@ -0,0 +1,13 @@
+# Deterministic Zip
+
+Demo image with no install steps, existing purely to verify that `tag_ranges` resolves
+the latest release of
+[timo-reymann/deterministic-zip](https://github.com/timo-reymann/deterministic-zip) via
+the GitHub releases source at discovery time, and threads it through as the
+`DETERMINISTIC_ZIP_VERSION` build arg.
+
+## Usage
+
+```dockerfile
+FROM __hive__/deterministic-zip:<resolved-version>
+```
diff --git a/_base/images/deterministic-zip/image.yml b/_base/images/deterministic-zip/image.yml
new file mode 100644
index 0000000..4553641
--- /dev/null
+++ b/_base/images/deterministic-zip/image.yml
@@ -0,0 +1,19 @@
+description: "Minimal image proving tag_ranges resolves the latest release from a GitHub repository."
+
+tag_ranges:
+  - tag_name: "{{.full}}"
+    source:
+      type: github
+      repo: timo-reymann/deterministic-zip
+    select:
+      major: { last: 1 }
+      minor: { last: 1 }
+      patch: { last: 1 }
+    versions:
+      deterministic-zip: "{{.full}}"
+
+report:
+  icon: "devicon-github-original"
+
+platforms:
+  - linux/amd64
diff --git a/gitlab/pipeline.gitlab-ci.yml b/gitlab/pipeline.gitlab-ci.yml
index dbe61be..a274042 100644
--- a/gitlab/pipeline.gitlab-ci.yml
+++ b/gitlab/pipeline.gitlab-ci.yml
@@ -1,6 +1,6 @@
 # Auto-generated by ContainerHive
 # Do not edit - regenerate with: ch --project gitlab template ci --provider gitlab --output gitlab/pipeline.gitlab-ci.yml --image-name ghcr.io/containerhive/containerhive
-# tag_ranges resolved to 10 shard unit(s) - regenerate if this changes.
+# tag_ranges resolved to 11 shard unit(s) - regenerate if this changes.
 
 workflow:
   auto_cancel:
@@ -18,6 +18,9 @@ stages:
   - build-base-deployment
   - test-base-deployment
   - manifest-base-deployment
+  - build-deterministic-zip
+  - test-deterministic-zip
+  - manifest-deterministic-zip
   - build-golang
   - test-golang
   - manifest-golang
@@ -239,6 +242,47 @@ test-base-deployment:
       - gitlab/dist/**/*-cst-report.xml
     reports:
       junit: gitlab/dist/**/*-cst-report.xml
+# === DETERMINISTIC-ZIP ===
+
+build-deterministic-zip-amd64:
+  extends: .build-amd64
+  stage: build-deterministic-zip
+  variables:
+    IMAGE_NAME: deterministic-zip
+    PLATFORM: amd64
+  needs:
+    - generate
+  artifacts:
+    paths:
+      - gitlab/dist/deterministic-zip/*/*/cyclonedx.json
+    reports:
+      cyclonedx: gitlab/dist/deterministic-zip/*/*/cyclonedx.json
+
+
+manifest-deterministic-zip:
+  extends: .manifest
+  stage: manifest-deterministic-zip
+  variables:
+    IMAGE_NAME: deterministic-zip
+  needs:
+    - generate
+    - test-deterministic-zip
+    - build-deterministic-zip-amd64
+
+test-deterministic-zip:
+  extends: .test
+  stage: test-deterministic-zip
+  variables:
+    IMAGE_NAME: deterministic-zip
+  needs:
+    - generate
+    - build-deterministic-zip-amd64
+  artifacts:
+    when: always
+    paths:
+      - gitlab/dist/**/*-cst-report.xml
+    reports:
+      junit: gitlab/dist/**/*-cst-report.xml
 # === GOLANG ===
 
 build-golang-amd64:
@@ -421,6 +465,7 @@ report:
     - build-base-ci-arm64
     - build-base-deployment-amd64
     - build-base-deployment-arm64
+    - build-deterministic-zip-amd64
     - build-golang-amd64
     - build-node-amd64
     - build-dotnet-runtime-amd64