diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 77a9e9bd5d7c..e7f34fb7507d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -243,6 +243,7 @@ jobs:
       matrix:
         os:
           - freebsd
+          - netbsd
           - openbsd
     steps:
       -
diff --git a/Dockerfile b/Dockerfile
index 3121b099d9d5..4b48557180cb 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -102,6 +102,7 @@ COPY --link --from=buildx-build /usr/bin/docker-buildx /buildx
 FROM binaries-unix AS binaries-darwin
 FROM binaries-unix AS binaries-freebsd
 FROM binaries-unix AS binaries-linux
+FROM binaries-unix AS binaries-netbsd
 FROM binaries-unix AS binaries-openbsd
 
 FROM scratch AS binaries-windows
diff --git a/docker-bake.hcl b/docker-bake.hcl
index ef01212ae351..a65973faf444 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -48,6 +48,8 @@ target "lint" {
     "linux/s390x",
     "linux/ppc64le",
     "linux/riscv64",
+    "netbsd/amd64",
+    "netbsd/arm64",
     "openbsd/amd64",
     "openbsd/arm64",
     "windows/amd64",
@@ -167,6 +169,8 @@ target "binaries-cross" {
     "linux/ppc64le",
     "linux/riscv64",
     "linux/s390x",
+    "netbsd/amd64",
+    "netbsd/arm64",
     "openbsd/amd64",
     "openbsd/arm64",
     "windows/amd64",
diff --git a/hack/Vagrantfile.freebsd b/hack/Vagrantfile.freebsd
index f86df6135c87..0d87f0912f63 100644
--- a/hack/Vagrantfile.freebsd
+++ b/hack/Vagrantfile.freebsd
@@ -4,6 +4,7 @@
 Vagrant.configure("2") do |config|
   config.vm.box = "generic/freebsd14"
   config.vm.boot_timeout = 900
+  config.vm.box_check_update = false
   config.vm.synced_folder ".", "/vagrant", type: "rsync"
   config.ssh.keep_alive = true
 
diff --git a/hack/Vagrantfile.netbsd b/hack/Vagrantfile.netbsd
new file mode 100644
index 000000000000..932630bc254d
--- /dev/null
+++ b/hack/Vagrantfile.netbsd
@@ -0,0 +1,21 @@
+# -*- mode: ruby -*-
+# vi: set ft=ruby :
+
+Vagrant.configure("2") do |config|
+  config.vm.box = "generic/netbsd9"
+  config.vm.boot_timeout = 900
+  config.vm.box_check_update = false
+  config.vm.synced_folder ".", "/vagrant", type: "rsync"
+  config.ssh.keep_alive = true
+
+  config.vm.provision "init", type: "shell", run: "once" do |sh|
+    sh.inline = <<~SHELL
+      pkgin -y install git mozilla-rootcerts
+      mozilla-rootcerts install
+
+      ftp https://go.dev/dl/go1.23.3.netbsd-amd64.tar.gz
+      tar -C /tmp -xzf go1.23.3.netbsd-amd64.tar.gz
+      ln -s /tmp/go/bin/go /usr/bin/go
+    SHELL
+  end
+end
diff --git a/hack/Vagrantfile.openbsd b/hack/Vagrantfile.openbsd
index adab6b275380..06ecaf8fc3ef 100644
--- a/hack/Vagrantfile.openbsd
+++ b/hack/Vagrantfile.openbsd
@@ -5,6 +5,7 @@ Vagrant.configure("2") do |config|
   config.vm.box = "pygolo/openbsd7"
   config.vm.box_version = "7.5"
   config.vm.boot_timeout = 900
+  config.vm.box_check_update = false
   config.vm.synced_folder ".", "/vagrant", type: "rsync"
   config.ssh.keep_alive = true