diff --git a/modules/only-office/manifest_test.go b/modules/only-office/manifest_test.go
new file mode 100644
index 00000000..cbaec2b4
--- /dev/null
+++ b/modules/only-office/manifest_test.go
@@ -0,0 +1,63 @@
+package office
+
+import (
+	"os"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+// 1830/AC1 (unit: manifest check)
+// Given the catalogue, when only-office's manifest is parsed, then it offers document-server with
+// credential own jwt, jwt says taken at-start, and serves document-server on port 9070 with a
+// public-root.
+func TestManifestOffersDocumentServer(t *testing.T) {
+	raw, err := os.ReadFile("module.json")
+	if err != nil {
+		t.Fatalf("reading module.json: %v", err)
+	}
+
+	m, err := catalogue.ParseManifest(raw)
+	if err != nil {
+		t.Fatalf("parsing module.json: %v", err)
+	}
+
+	var offer *catalogue.Offer
+	for i := range m.Provides {
+		if m.Provides[i].Name == "document-server" {
+			offer = &m.Provides[i]
+			break
+		}
+	}
+	if offer == nil {
+		t.Fatal("manifest does not provide document-server")
+	}
+	if offer.Scope != catalogue.ScopeMesh {
+		t.Errorf("document-server scope = %q, want %q", offer.Scope, catalogue.ScopeMesh)
+	}
+	if offer.Credential == nil || offer.Credential.Own != "jwt" {
+		t.Errorf("document-server credential = %+v, want own jwt", offer.Credential)
+	}
+
+	own, ok := m.OwnSecrets["jwt"]
+	if !ok {
+		t.Fatal("manifest declares no own-secret jwt")
+	}
+	if own.Taken != catalogue.TakenAtStart {
+		t.Errorf("own-secrets.jwt.taken = %q, want %q", own.Taken, catalogue.TakenAtStart)
+	}
+
+	serve, ok := m.Serves["document-server"]
+	if !ok {
+		t.Fatal("manifest serves no document-server")
+	}
+	if scheme, _ := serve["scheme"].(string); scheme != "http" {
+		t.Errorf("serves.document-server.scheme = %q, want http", scheme)
+	}
+	if port, _ := serve["port"].(float64); port != 9070 {
+		t.Errorf("serves.document-server.port = %v, want 9070", serve["port"])
+	}
+	if root, _ := serve["public-root"].(string); root != "https://${bound:route:name}/" {
+		t.Errorf("serves.document-server.public-root = %q, want https://${bound:route:name}/", root)
+	}
+}
diff --git a/modules/only-office/module.json b/modules/only-office/module.json
index 03ed3cc0..157ca954 100644
--- a/modules/only-office/module.json
+++ b/modules/only-office/module.json
@@ -2,6 +2,22 @@
   "module": "only-office",
   "version": "1",
   "slug": "office",
+  "provides": [
+    {
+      "name": "document-server",
+      "scope": "mesh",
+      "credential": {
+        "own": "jwt"
+      }
+    }
+  ],
+  "serves": {
+    "document-server": {
+      "scheme": "http",
+      "port": 9070,
+      "public-root": "https://${bound:route:name}/"
+    }
+  },
   "capabilities": [
     "container-runtime"
   ],
@@ -57,7 +73,8 @@
   "own-secrets": {
     "jwt": {
       "path": "${dir:state}/jwt.secret",
-      "owner": "only-office-converter"
+      "owner": "only-office-converter",
+      "taken": "at-start"
     },
     "broker-converter": {
       "path": "${dir:state}/broker-converter.secret",