diff --git a/.pipelines/nightly.yaml b/.pipelines/nightly.yaml
new file mode 100644
index 000000000..98c23b361
--- /dev/null
+++ b/.pipelines/nightly.yaml
@@ -0,0 +1,47 @@
+trigger: none
+
+schedules:
+  - cron: "0 0 * * *"
+    always: true
+    displayName: "Nightly Test"
+    branches:
+      include:
+        - main
+
+pool: Upstream Pool
+
+jobs:
+  - job: scan_images
+    timeoutInMinutes: 10
+    workspace:
+      clean: all
+    steps:
+      - template: templates/publish-images.yaml
+        parameters:
+          publish: false
+  - job:
+    timeoutInMinutes: 40
+    dependsOn: scan_images
+    workspace:
+      clean: all
+    variables:
+      # we can enable actual tenant id for functional e2e
+      AZURE_TENANT_ID: "fake tenant id"
+      REGISTRY: upstreamk8sci.azurecr.io/aad-pod-managed-identity
+      SOAK_CLUSTER: "true"
+    strategy:
+      matrix:
+        soak_aks_windows_dockershim:
+          WINDOWS_CLUSTER: "true"
+          CLUSTER_NAME: "pmi-aks-win-dockershim"
+        soak_aks_windows_containerd:
+          WINDOWS_CLUSTER: "true"
+          CLUSTER_NAME: "pmi-aks-win-containerd"
+        soak_aks_linux:
+          CLUSTER_NAME: "pmi-aks-linux"
+        soak_arc:
+          ARC_CLUSTER: "true"
+          CLUSTER_NAME: "pmi-aks-arc"
+    steps:
+      - script: make test-e2e
+        displayName: Webhook E2E test suite