diff --git a/.github/workflows/container-ignition.yml b/.github/workflows/container-ignition.yml
new file mode 100644
index 000000000..aeb88390a
--- /dev/null
+++ b/.github/workflows/container-ignition.yml
@@ -0,0 +1,55 @@
+# Build ignition container images for f43 and c9s
+
+name: Build Ignition Container Images
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# avoid races when pushing containers built from main
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+jobs:
+  build-container:
+    name: Build container image (${{ matrix.base-name }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - base-name: fedora
+            base-image: fedora:latest
+            image-suffix: -f43
+          - base-name: centos-stream-9
+            base-image: quay.io/centos/centos:stream9
+            image-suffix: -c9s
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v5
+        with:
+          # fetch tags too
+          # https://github.com/actions/checkout/issues/290
+          fetch-depth: 0
+      - name: Fix actions/checkout synthetic tag
+        run: git fetch --tags --force
+      - name: Generate tags
+        id: tags
+        run: |
+          DATE=$(date +%Y%m%d)
+          SHORT_SHA=$(git rev-parse --short=7 HEAD)
+          echo "tags=latest ${DATE}-${SHORT_SHA}" >> $GITHUB_OUTPUT
+      - name: Build and push container
+        uses: coreos/actions-lib/build-container@main
+        with:
+          credentials: ${{ secrets.QUAY_AUTH }}
+          file: Containerfile.ignition
+          push: ${{ github.event_name == 'push' && github.repository_owner == 'trusted-execution-clusters' && format('quay.io/trusted-execution-clusters/ignition{0}', matrix.image-suffix) || '' }}
+          arches: amd64
+          build-args: BASE=${{ matrix.base-image }}
+          tags: ${{ steps.tags.outputs.tags }}
diff --git a/Containerfile.ignition b/Containerfile.ignition
new file mode 100644
index 000000000..b87665eb3
--- /dev/null
+++ b/Containerfile.ignition
@@ -0,0 +1,13 @@
+ARG BASE=fedora:f43
+FROM $BASE AS builder
+
+RUN dnf install -y golang git-core libblkid-devel make
+
+WORKDIR /usr/src/ignition
+COPY . .
+
+RUN ./build
+
+FROM scratch
+COPY --from=builder /usr/src/ignition/bin/amd64/ignition /usr/bin/ignition
+
diff --git a/config/v3_5/translate/translate.go b/config/v3_5/translate/translate.go
index bc13973fc..5a04dc54e 100644
--- a/config/v3_5/translate/translate.go
+++ b/config/v3_5/translate/translate.go
@@ -54,6 +54,10 @@ func Translate(old old_types.Config) (ret types.Config) {
 	tr := translate.NewTranslator()
 	tr.AddCustomTranslator(translateIgnition)
 	tr.AddCustomTranslator(translateLuks)
-	tr.Translate(&old, &ret)
+	tr.Translate(&old.Ignition, &ret.Ignition)
+	tr.Translate(&old.KernelArguments, &ret.KernelArguments)
+	tr.Translate(&old.Passwd, &ret.Passwd)
+	tr.Translate(&old.Storage, &ret.Storage)
+	tr.Translate(&old.Systemd, &ret.Systemd)
 	return
 }
diff --git a/config/v3_5/types/schema.go b/config/v3_5/types/schema.go
index 6c8c42f57..0aaf5eb5b 100644
--- a/config/v3_5/types/schema.go
+++ b/config/v3_5/types/schema.go
@@ -25,6 +25,7 @@ type Config struct {
 	Passwd          Passwd          `json:"passwd,omitempty"`
 	Storage         Storage         `json:"storage,omitempty"`
 	Systemd         Systemd         `json:"systemd,omitempty"`
+	Attestation     Attestation     `json:"attestation,omitempty"`
 }
 
 type Device string
@@ -262,3 +263,16 @@ type Unit struct {
 type Verification struct {
 	Hash *string `json:"hash,omitempty"`
 }
+
+type Attestation struct {
+	AttestationKey AttestationKey `json:"attestation_key,omitempty"`
+}
+
+type AttestationKey struct {
+	Registration Registration `json:"registration,omitempty"`
+}
+
+type Registration struct {
+	Url         *string `json:"url,omitempty"`
+	Certificate *string `json:"certificat,omitempty"`
+}