diff --git a/services/identity/Dockerfile b/services/identity/Dockerfile
--- a/services/identity/Dockerfile
+++ b/services/identity/Dockerfile
@@ -38,6 +38,10 @@
 COPY --from=builder /usr/local/cargo/bin/identity \
   /usr/local/bin/identity
 
+# For test/debug builds, optionally generate OPAQUE keypair file
+ARG generate_keypair
+RUN if [ "$generate_keypair" = "true" ]; then identity keygen; fi
+
 USER comm
 
 CMD ["identity", "server"]