diff --git a/Containerfile.init b/Containerfile.init
index e82be70..917a479 100644
--- a/Containerfile.init
+++ b/Containerfile.init
@@ -11,6 +11,7 @@ WORKDIR /build
 COPY go.mod go.sum ./
 COPY cmd/policy-ebpfd ./cmd/policy-ebpfd
 COPY cmd/vminit-wrapper ./cmd/vminit-wrapper
+COPY internal/audit ./internal/audit
 RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o policy-ebpfd ./cmd/policy-ebpfd \
     && CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o vminit-wrapper ./cmd/vminit-wrapper
 
diff --git a/internal/ci/images_workflow_test.go b/internal/ci/images_workflow_test.go
index 934a901..8223331 100644
--- a/internal/ci/images_workflow_test.go
+++ b/internal/ci/images_workflow_test.go
@@ -60,14 +60,26 @@ func TestPublishImagesWorkflowUsesSupportedPlatforms(t *testing.T) {
 	}
 }
 
+func TestStrictInitContainerfileCopiesAuditPackage(t *testing.T) {
+	containerfile := string(readRepoFile(t, "Containerfile.init"))
+	if !strings.Contains(containerfile, "COPY internal/audit ./internal/audit") {
+		t.Fatal("Containerfile.init must copy internal/audit for the policy-ebpfd build")
+	}
+}
+
 func readWorkflow(t *testing.T) []byte {
+	t.Helper()
+	return readRepoFile(t, ".github", "workflows", "images.yml")
+}
+
+func readRepoFile(t *testing.T, path ...string) []byte {
 	t.Helper()
 	_, file, _, ok := runtime.Caller(0)
 	if !ok {
 		t.Fatal("resolve test path")
 	}
 	root := filepath.Clean(filepath.Join(filepath.Dir(file), "..", ".."))
-	data, err := os.ReadFile(filepath.Join(root, ".github", "workflows", "images.yml"))
+	data, err := os.ReadFile(filepath.Join(append([]string{root}, path...)...))
 	if err != nil {
 		t.Fatal(err)
 	}