diff --git a/.github/workflows/Dockerfile.qa b/.github/workflows/Dockerfile.qa
new file mode 100644
index 00000000..94abb0e2
--- /dev/null
+++ b/.github/workflows/Dockerfile.qa
@@ -0,0 +1,38 @@
+# Adjust DOTNET_OS_VERSION as desired
+ARG DOTNET_OS_VERSION="-alpine"
+ARG DOTNET_SDK_VERSION=9.0
+
+FROM mcr.microsoft.com/dotnet/sdk:${DOTNET_SDK_VERSION}${DOTNET_OS_VERSION} AS build
+WORKDIR /src
+
+# copy everything
+COPY . ./
+
+# === THIS SECTION IS MODIFIED FOR QA STEP ===
+# Copy the dev firewall package
+COPY Aikido.Zen.*.nupkg ./local-feed/
+
+COPY NuGet.Config .
+
+# Remove existing Aikido.Zen reference
+RUN dotnet remove package Aikido.Zen.DotNetCore || true
+
+# Add the local package with version
+RUN dotnet add package Aikido.Zen.DotNetCore --version 0.0.0-qa
+
+# Restore dependencies
+RUN dotnet restore
+
+# Build and publish a release
+RUN dotnet publish -c Release -o /app
+# === END OF MODIFIED SECTION ===
+
+# final stage/image
+FROM mcr.microsoft.com/dotnet/aspnet:${DOTNET_SDK_VERSION}
+ENV ASPNETCORE_URLS http://+:8080
+ENV ASPNETCORE_ENVIRONMENT Production
+ENV AIKIDO_BLOCK true
+EXPOSE 8080
+WORKDIR /app
+COPY --from=build /app .
+ENTRYPOINT [ "dotnet", "zen-demo-dotnet.dll" ]
diff --git a/.github/workflows/NuGet.Config b/.github/workflows/NuGet.Config
new file mode 100644
index 00000000..70f81d0b
--- /dev/null
+++ b/.github/workflows/NuGet.Config
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+    <packageSources>
+        <add key="local-feed" value="/src/local-feed" />
+        <add key="nuget" value="https://api.nuget.org/v3/index.json" />
+    </packageSources>
+</configuration>
diff --git a/.github/workflows/qa-tests.yml b/.github/workflows/qa-tests.yml
new file mode 100644
index 00000000..06326f35
--- /dev/null
+++ b/.github/workflows/qa-tests.yml
@@ -0,0 +1,78 @@
+name: 🧪 QA Tests
+permissions:
+  contents: read
+on:
+  push: {}
+  workflow_call: {}
+
+jobs:
+  build-package:
+    runs-on: windows-2022
+    timeout-minutes: 30
+    steps:
+      - name: Checkout firewall-dotnet
+        uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '9.0.x'
+
+      - name: Add msbuild to PATH
+        uses: microsoft/setup-msbuild@v2
+        with:
+          vs-version: "[17.2,19.0)"
+
+      - name: Install Cake Tool
+        run: dotnet tool install --global Cake.Tool
+
+      - name: Build and pack firewall-dotnet
+        run: |
+          # Install dependencies
+          dotnet tool restore
+          dotnet restore
+
+          # Run Cake Script to Build and Pack
+          dotnet cake build.cake --target=CreatePackages --configuration=Release --libVersion=0.0.0-qa
+
+      - name: Upload NuGet package artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: nuget-package
+          path: ./artifacts/*.nupkg
+
+  qa-tests:
+    needs: build-package
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - name: Checkout zen-demo-dotnet-core
+        uses: actions/checkout@v4
+        with:
+          repository: Aikido-demo-apps/zen-demo-dotnet-core
+          ref: qa-endpoints
+          path: zen-demo-dotnet-core
+          submodules: true
+
+      - name: Checkout firewall-dotnet (for Dockerfile.qa)
+        uses: actions/checkout@v4
+        with:
+          path: firewall-dotnet
+
+      - name: Download NuGet package artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: nuget-package
+          path: zen-demo-dotnet-core/local-feed
+
+      - name: Replace Dockerfile with QA version
+        run: |
+          cp firewall-dotnet/.github/workflows/NuGet.Config zen-demo-dotnet-core/NuGet.Config
+          cp firewall-dotnet/.github/workflows/Dockerfile.qa zen-demo-dotnet-core/Dockerfile
+
+      - name: Run Firewall QA Tests
+        uses: AikidoSec/firewall-tester-action@releases/v1
+        with:
+          dockerfile_path: ./zen-demo-dotnet-core/Dockerfile
+          app_port: 8080
+          sleep_before_test: 10