diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2992d7d..cf8685e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,6 +63,78 @@ jobs:
         run: |
           go test -race ./...
 
+  moby-integration:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      -
+        name: Checkout extensions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          path: extensions
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      -
+        name: Checkout Moby
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: moby/moby
+          ref: master
+          path: moby
+      -
+        name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: moby/go.mod
+          cache-dependency-path: |
+            moby/go.sum
+            extensions/go.sum
+      -
+        name: Prepare Moby dependencies
+        working-directory: moby
+        run: |
+          go mod edit -replace=github.com/moby/extensions="${GITHUB_WORKSPACE}/extensions"
+          go mod tidy
+          go mod vendor
+      -
+        name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      -
+        name: Regenerate Moby generated files
+        working-directory: moby
+        run: |
+          make generate-files
+          # Same paths Moby's generate-files target exports; skips vendoring changes.
+          # List them first because git add rejects pathspecs that match nothing.
+          git ls-files -z -m -o --exclude-standard -- ':!vendor' 'profiles/seccomp/default.json' '**/*.pb.go' |
+            git add --pathspec-from-file=- --pathspec-file-nul
+          {
+            echo '### Moby generated-file diff'
+            if git diff --cached --quiet; then
+              echo 'Regeneration produced no changes.'
+            else
+              echo '```diff'
+              git diff --cached
+              echo '```'
+            fi
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+      -
+        name: Build Moby development image
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        with:
+          source: ./moby
+          targets: dev
+          load: true
+          set: |
+            dev.cache-from=type=gha,scope=moby-dev-amd64
+            dev.cache-to=type=gha,scope=moby-dev-amd64,mode=max
+      -
+        name: Run Moby extension integration tests
+        working-directory: moby
+        env:
+          TEST_INTEGRATION_DIR: ./integration/extension
+          TEST_SKIP_INTEGRATION_CLI: "1"
+        run: make -o build test-integration
+
   success:
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -70,6 +142,7 @@ jobs:
       - validate
       - lint
       - test
+      - moby-integration
     if: always()
     steps:
       -