diff --git a/azure-cron.yml b/azure-cron.yml
index 59dff0dd9f..96d721caf0 100644
--- a/azure-cron.yml
+++ b/azure-cron.yml
@@ -223,7 +223,7 @@ jobs:
           set -euo pipefail
           git fetch
           git checkout origin/main
-          ci/build-canton-3x.sh
+          ci/build-canton-3x.sh HEAD
         env:
           GITHUB_TOKEN: $(CANTON_READONLY_TOKEN)
       - template: ci/tell-slack-failed.yml
diff --git a/canton-3x/canton-3x-sha b/canton-3x/canton-3x-sha
new file mode 100644
index 0000000000..199c073cce
--- /dev/null
+++ b/canton-3x/canton-3x-sha
@@ -0,0 +1 @@
+c47319c9
\ No newline at end of file
diff --git a/ci/build-canton-3x.sh b/ci/build-canton-3x.sh
index 191efa7c46..11a9af0130 100755
--- a/ci/build-canton-3x.sh
+++ b/ci/build-canton-3x.sh
@@ -6,6 +6,8 @@ set -euo pipefail
 
 eval "$(./dev-env/bin/dade-assist)"
 
+DIR="$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+
 tmp=$(mktemp -d)
 trap 'rm -rf ${tmp}' EXIT
 
@@ -15,9 +17,11 @@ else
   repo_url="https://$GITHUB_TOKEN@github.com/DACH-NY/canton"
 fi
 
-git clone --depth 1 --branch main $repo_url $tmp
-head=$(git -C $tmp rev-parse HEAD)
-echo "cloned at revision $head"
+commitish=${1:-$(cat "$DIR"/../canton-3x/canton-3x-sha)}
+
+git clone $repo_url $tmp
+git -C $tmp reset --hard $commitish
+echo "cloned at revision $commitish"
 
 daml_common_staging_src="$tmp/daml-common-staging"
 community_src="$tmp/community"
diff --git a/ci/build.yml b/ci/build.yml
index f13bcd1b88..ccd1ba07a2 100644
--- a/ci/build.yml
+++ b/ci/build.yml
@@ -251,6 +251,33 @@ jobs:
         trigger_sha: '$(trigger_sha)'
     - template: report-end.yml
 
+- job: build_canton_3x_with_bazel
+  dependsOn:
+    - check_for_release
+    - build_canton
+  variables:
+    - name: release_sha
+      value: $[ dependencies.check_for_release.outputs['out.release_sha'] ]
+    - template: job-variables.yml
+  timeoutInMinutes: 60
+  pool:
+    name: 'ubuntu_20_04'
+    demands: assignment -equals default
+  steps:
+    - template: report-start.yml
+    - checkout: self
+    - bash: |
+        set -euo pipefail
+        git checkout $(release_sha)
+        if [ -x ci/build-canton-3x.sh ]; then
+          ci/build-canton-3x.sh
+        fi
+      env:
+        GITHUB_TOKEN: $(CANTON_READONLY_TOKEN)
+      name: build_canton_3x
+    - template: report-end.yml
+
+
 - job: platform_independence_test
   condition: and(succeeded(),
                  eq(dependencies.check_for_release.outputs['out.is_release'], 'false'))
diff --git a/ci/cron/daily-compat.yml b/ci/cron/daily-compat.yml
index 429305b4a4..f27b46d67f 100644
--- a/ci/cron/daily-compat.yml
+++ b/ci/cron/daily-compat.yml
@@ -193,18 +193,40 @@ jobs:
         git fetch
         git checkout origin/main
 
+        get_canton_version_for_major_version() {
+          major=$1
+          curl -u $AUTH \
+               --fail \
+               --location \
+               --silent \
+               https://digitalasset.jfrog.io/artifactory/api/storage/assembly/canton \
+          | jq -r '.children[].uri' \
+          | sed -e 's/^\///' \
+          | grep -P "^${major}\.\d+\.\d+" \
+          | sort -V \
+          | tail -1
+        }
+
+        canton_version_to_commitish() {
+          canton_version=$1
+          STABLE_REGEX="\d+\.\d+\.\d+"
+          SNAPSHOT_REGEX="^${STABLE_REGEX}-snapshot\.\d{8}\.\d+(\.\d+)?\.v[0-9a-f]{8}$"
+          if (echo "$1" | grep -q -P "${SNAPSHOT_REGEX}"); then
+            # Extracting commit (short) sha from snapshot version
+            echo "${canton_version: -8}"
+          else
+            # relying on stable version tag
+            echo "v$canton_version"
+          fi
+        }
+
+        ### bump canton 3.x sha ###
+
+        canton_version_to_commitish $(get_canton_version_for_major_version 3) > canton-3x/canton-3x-sha
+
         ### update binaries ###
 
-        canton_version=$(curl -u $AUTH \
-                              --fail \
-                              --location \
-                              --silent \
-                              https://digitalasset.jfrog.io/artifactory/api/storage/assembly/canton \
-                         | jq -r '.children[].uri' \
-                         | sed -e 's/^\///' \
-                         | grep -P '^2\.\d+\.\d+' \
-                         | sort -V \
-                         | tail -1)
+        canton_version=$(get_canton_version_for_major_version 2)
 
         ee_url="https://digitalasset.jfrog.io/artifactory/assembly/canton/$canton_version/canton-enterprise-$canton_version.tar.gz"
         ee_tmp=$(mktemp)
@@ -231,13 +253,7 @@ jobs:
 
         ### code drop ###
 
-        STABLE_REGEX="\d+\.\d+\.\d+"
-        SNAPSHOT_REGEX="^${STABLE_REGEX}-snapshot\.\d{8}\.\d+(\.\d+)?\.v[0-9a-f]{8}$"
-        if (echo "$canton_version" | grep -q -P "${SNAPSHOT_REGEX}"); then
-          commitish=${canton_version: -8}
-        else
-          commitish=v$canton_version
-        fi
+        commitish=$(canton_version_to_commitish $canton_version)
         tmp=$(mktemp -d)
         trap "rm -rf ${tmp}" EXIT