diff --git a/.buildkite/dockerfiles/docker-compose.yml b/.buildkite/dockerfiles/docker-compose.yml
new file mode 100644
index 0000000000000..339d92fe9dde1
--- /dev/null
+++ b/.buildkite/dockerfiles/docker-compose.yml
@@ -0,0 +1,12 @@
+version: '3'
+services:
+  windows-env:
+    build:
+      context: ../../
+      dockerfile: ./.buildkite/dockerfiles/windows-env.Dockerfile
+  windows-test:
+    build:
+      context: ../../
+      dockerfile: ./.buildkite/dockerfiles/windows-test.Dockerfile
+      args:
+        COMMIT_SHA: "${BUILDKITE_COMMIT}"
diff --git a/.buildkite/fix-msys64.cmd b/.buildkite/dockerfiles/fix-msys64.cmd
similarity index 100%
rename from .buildkite/fix-msys64.cmd
rename to .buildkite/dockerfiles/fix-msys64.cmd
diff --git a/.buildkite/Dockerfile b/.buildkite/dockerfiles/windows-env.Dockerfile
similarity index 100%
rename from .buildkite/Dockerfile
rename to .buildkite/dockerfiles/windows-env.Dockerfile
diff --git a/.buildkite/dockerfiles/windows-test.Dockerfile b/.buildkite/dockerfiles/windows-test.Dockerfile
new file mode 100644
index 0000000000000..cd639cbf7c327
--- /dev/null
+++ b/.buildkite/dockerfiles/windows-test.Dockerfile
@@ -0,0 +1,21 @@
+# Use the a previous image as source.
+# gcr.io/internal-200822 is the Google Cloud container registry for Angular tooling.
+FROM gcr.io/internal-200822/angular-windows:master
+WORKDIR /src
+
+# Copy package.json and yarn.lock before the other files.
+# This allows docker to cache these steps even if source files change.
+COPY ./package.json /src/package.json
+COPY ./yarn.lock /src/yarn.lock
+RUN yarn install --frozen-lockfile --non-interactive --network-timeout 100000
+
+# Update image git repo.
+ARG COMMIT_SHA
+RUN git fetch -v origin %COMMIT_SHA%
+RUN git checkout -f %COMMIT_SHA%
+
+# Setup.
+COPY .circleci/bazel.rc /etc/bazel.bazelrc
+
+# Run tests.
+RUN yarn bazel test //tools/ts-api-guardian:all --noshow_progress
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 58dd597bc493b..dfea61324ea1f 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -1,10 +1,17 @@
 steps:
   - label: windows-test
-    commands:
-      - "yarn install --frozen-lockfile --non-interactive --network-timeout 100000"
-      - "yarn bazel test //tools/ts-api-guardian:all --noshow_progress"
     plugins:
-      - docker#v2.1.0:
-          image: "filipesilva/node-bazel-windows:0.0.2"
+      - docker-compose#v2.6.0:
+          build: windows-test
+          config: .buildkite/dockerfiles/docker-compose.yml
+    agents:
+      windows: true
+  - wait
+  - label: windows-update-image
+    branches: master
+    plugins:
+      - docker-compose#v2.6.0:
+          push: windows-test:gcr.io/internal-200822/angular-windows:master
+          config: .buildkite/dockerfiles/docker-compose.yml
     agents:
       windows: true
diff --git a/.buildkite/provision-windows-buildkite.ps1 b/.buildkite/provision/provision-windows-buildkite.ps1
similarity index 85%
rename from .buildkite/provision-windows-buildkite.ps1
rename to .buildkite/provision/provision-windows-buildkite.ps1
index d8b647491b894..ec59223c3589c 100644
--- a/.buildkite/provision-windows-buildkite.ps1
+++ b/.buildkite/provision/provision-windows-buildkite.ps1
@@ -8,6 +8,8 @@
 # We recommend machine type n1-standard-16 (16 vCPUs, 60 GB memory).
 # Use a recent windows boot disk with container support such as
 # "Windows Server version 1803 Datacenter Core for Containers", and add a 128GB disk.
+# Give it push access to the Container Registry by clicking "Set access for each API" and
+# setting "Storage" to "Read Write".
 # Give it a name, then click "Create".
 
 # VM setup:
@@ -58,6 +60,15 @@ Add-Path "C:\git\bin"
 Start-Sleep -s 15
 Remove-Item git.exe
 
+# Install Docker Compose 1.23.2
+# https://docs.docker.com/compose/install/#install-compose
+Invoke-WebRequest "https://github.com/docker/compose/releases/download/1.23.2/docker-compose-Windows-x86_64.exe" -UseBasicParsing -OutFile $Env:ProgramFiles\docker\docker-compose.exe
+
+# Add the gcloud Docker credential helper to the local system account (used by NSSM)
+# https://cloud.google.com/container-registry/docs/advanced-authentication
+gcloud auth configure-docker --quiet
+Copy-Item C:\Users\angular\.docker -Destination C:\Windows\System32\config\systemprofile\ -Recurse
+
 # Download NSSM (https://nssm.cc/) to run the BuildKite agent as a service.
 Write-Host "Downloading NSSM."
 Invoke-WebRequest -Uri https://nssm.cc/ci/nssm-2.24-101-g897c7ad.zip -OutFile nssm.zip