diff --git a/.github/workflows/verify-site-env-publish.yml b/.github/workflows/verify-site-env-publish.yml
new file mode 100644
index 0000000000..a55c5f222c
--- /dev/null
+++ b/.github/workflows/verify-site-env-publish.yml
@@ -0,0 +1,52 @@
+name: Verify site-env publish
+
+on:
+  push:
+    branches:
+      - ci/verify-site-env-publish
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  AWS_REGION: us-east-1
+
+jobs:
+  publish:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Checkout Repo
+        uses: supabase/postgres/.github/actions/shared-checkout@HEAD
+
+      - name: GitHub OIDC Auth
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        with:
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::279559813984:role/supabase-github-oidc-role
+          role-session-name: shared-services-jump
+
+      - name: Assume destination role
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+        with:
+          aws-region: us-east-1
+          role-to-assume: arn:aws:iam::279559813984:role/supabase-nix-catalog-artifacts-role-6387512
+          role-skip-session-tagging: true
+          role-session-name: upload-assets
+          role-chaining: true
+
+      - name: Install nix
+        uses: ./.github/actions/nix-install-ephemeral
+
+      - name: Publish site-env store path
+        run: |
+          GIT_SHA="${{ github.sha }}"
+          SYSTEM=$(nix eval --impure --raw --expr 'builtins.currentSystem')
+          SITE_ENV_NAME="site-env-17"
+          SITE_ENV_PATH=$(nix eval --raw ".#${SITE_ENV_NAME}.outPath")
+          PREFIX="s3://supabase-public-artifacts-bucket/nix-catalog/ci-test/${GITHUB_RUN_ID}"
+
+          aws s3 cp - "${PREFIX}-${GIT_SHA}-${SITE_ENV_NAME}-${SYSTEM}" <<< "$SITE_ENV_PATH"
+
+          echo "published:"
+          aws s3 cp "${PREFIX}-${GIT_SHA}-${SITE_ENV_NAME}-${SYSTEM}" -