diff --git a/modules/nats/Dockerfile b/modules/nats/Dockerfile
index b362d7c..79ad25a 100644
--- a/modules/nats/Dockerfile
+++ b/modules/nats/Dockerfile
@@ -9,8 +9,11 @@
 #
 # Unlike every other module's Dockerfile, this builds no TypeScript and uses no mesh base image:
 # the module's code is the server, which upstream already built. There is no BUILD_BASE here on
-# purpose — nothing is compiled.
-FROM nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927
+# purpose — nothing is compiled. The upstream image is declared in the manifest under build.on and
+# arrives as NATS_BASE, like every other base the mesh copies into its own store before a build
+# (novox/hq ADR 0097); the digest above is the index one for the reason given.
+ARG NATS_BASE
+FROM ${NATS_BASE}
 
 COPY entrypoint.sh /usr/local/bin/mesh-nats-entrypoint
 RUN chmod 0755 /usr/local/bin/mesh-nats-entrypoint
diff --git a/modules/nats/module.json b/modules/nats/module.json
index 5a0f695..ff80c00 100644
--- a/modules/nats/module.json
+++ b/modules/nats/module.json
@@ -73,6 +73,12 @@
     }
   ],
   "build": {
+    "on": [
+      {
+        "arg": "NATS_BASE",
+        "image": "nats@sha256:b83efabe3e7def1e0a4a31ec6e078999bb17c80363f881df35edc70fcb6bb927"
+      }
+    ],
     "artifacts": [
       {
         "name": "server",