diff --git a/modules/lavinmq/Dockerfile b/modules/lavinmq/Dockerfile
new file mode 100644
index 0000000..2c022d9
--- /dev/null
+++ b/modules/lavinmq/Dockerfile
@@ -0,0 +1,41 @@
+# lavinmq's runtime: the tool runtime, carrying this module's compiled bootstrap, provisioner,
+# tools and event consumer.
+#
+# **Built from this module's own directory and nothing else.** The sdk is in the base image, so
+# nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
+# repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
+# the siblings.
+#
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
+ARG RUNTIME_BASE
+
+FROM ${BUILD_BASE} AS build
+# Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
+# node_modules — the module is compiled against exactly the sdk it will run against.
+WORKDIR /app/modules/lavinmq
+COPY . .
+# The compiler is invoked by its real path rather than through node_modules/.bin, whose entries are
+# symlinks to a launcher that requires its library relatively — resolved away when the base image
+# was assembled.
+#
+# Four entrypoints and a client, because this module is four things: a run-once bootstrap that
+# writes the broker's configuration before it first starts, a provisioner that grants consumers
+# their own vhost and user, a set of tools, and an event consumer.
+RUN node /app/node_modules/typescript/bin/tsc \
+      client.ts index.ts bootstrap/index.ts provisioner/index.ts tools/index.ts \
+      --module NodeNext --moduleResolution NodeNext --target ES2022 --outDir dist
+
+FROM ${RUNTIME_BASE}
+COPY --from=build /app/modules/lavinmq/dist /app/modules/lavinmq/dist
+# What a tool host should load from this module: its event consumer and its tools, which are
+# separate entrypoints because they are loaded by different things. The bootstrap and the
+# provisioner are not listed here — the declaration names each in its container's `args`, because
+# they are what this module's own containers run. One image, because they are one module and share
+# a client.
+ENV MESH_TOOL_MODULES=/app/modules/lavinmq/dist/index.js,/app/modules/lavinmq/dist/tools/index.js
diff --git a/modules/lavinmq/module.json b/modules/lavinmq/module.json
index ad94b4d..7a533aa 100644
--- a/modules/lavinmq/module.json
+++ b/modules/lavinmq/module.json
@@ -75,7 +75,7 @@
       "id": "bootstrap",
       "type": "container",
       "name": "lavinmq-bootstrap",
-      "image": "mesh-runtime-lavinmq@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "artifact": "runtime",
       "run-once": true,
       "volumes": [
         "/var/lib/lavinmq-module:/var/lib/lavinmq-module",
@@ -114,7 +114,7 @@
       "id": "runtime",
       "type": "container",
       "name": "mesh-lavinmq",
-      "image": "mesh-runtime-lavinmq@sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "artifact": "runtime",
       "network": "lavinmq",
       "volumes": [
         "/var/lib/mesh/lavinmq/broker:/run/secrets/broker:ro",
@@ -129,5 +129,26 @@
         "MESH_PROVISION_PASSWORD_FILE": "/run/secrets/default"
       }
     }
-  ]
+  ],
+  "build": {
+    "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
+      {
+        "arg": "RUNTIME_BASE",
+        "module": "mesh-tools",
+        "artifact": "runtime"
+      }
+    ],
+    "artifacts": [
+      {
+        "name": "runtime",
+        "kind": "image",
+        "from": "Dockerfile"
+      }
+    ]
+  }
 }