diff --git a/config/jobs/image-pushing/k8s-staging-gmsa-webhook.yaml b/config/jobs/image-pushing/k8s-staging-gmsa-webhook.yaml
new file mode 100644
index 0000000000000..d0b1caeaab889
--- /dev/null
+++ b/config/jobs/image-pushing/k8s-staging-gmsa-webhook.yaml
@@ -0,0 +1,28 @@
+postsubmits:
+  kubernetes-sigs/windows-gmsa:
+    # The name should be changed to match the repo name above
+    - name: post-gmsa-webhook-push-images
+      cluster: k8s-infra-prow-build-trusted
+      annotations:
+        testgrid-dashboards: sig-windows-push-images
+        testgrid-tab-name: post-gmsa-webhook-push-images
+      decorate: true
+      # this causes the job to only run on the master branch. Remove it if your
+      # job makes sense on every branch (unless it's setting a `latest` tag it
+      # probably does).
+      branches:
+        - ^master$
+      spec:
+        serviceAccountName: gcb-builder
+        containers:
+          - image: gcr.io/k8s-staging-test-infra/image-builder:v20211014-7ca1952a94
+            command:
+              - /run.sh
+            args:
+              # this is the project GCB will run in, which is the same as the GCR
+              # images are pushed to.
+              - --project=k8s-staging-gmsa-webhook
+              # This is the same as above, but with -gcb appended.
+              - --scratch-bucket=gs://k8s-staging-gmsa-webhook-gcb
+              - --env-passthrough=PULL_BASE_REF
+              - .
\ No newline at end of file