diff --git a/modules/amqp-ping/Dockerfile b/modules/amqp-ping/Dockerfile
index 8072911..7814b0e 100644
--- a/modules/amqp-ping/Dockerfile
+++ b/modules/amqp-ping/Dockerfile
@@ -5,14 +5,16 @@
 # other artifact. That is what makes this buildable by the mesh from a repository and a path
 # (novox/hq ADR 0069) rather than only on a workstation that happens to have the siblings.
 #
-# Named, not pinned. The mesh answers this with the copy of the runtime it holds, because a
-# fingerprint written here would name one particular copy — the one on whichever machine the person
-# typing it was using — and on any other mesh that copy has never existed (novox/hq issue 044).
-# Declared in module.json's `build.on`; there is deliberately no default, so a build nobody told
-# stops here rather than on a reference that resolves to nothing.
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
 ARG RUNTIME_BASE
 
-FROM ${RUNTIME_BASE} AS build
+FROM ${BUILD_BASE} AS build
 # Compiled under /app/modules, so resolving `@novox/mesh-sdk` walks up to the base's own
 # node_modules — the module is compiled against exactly the sdk it will run against.
 WORKDIR /app/modules/amqp-ping
diff --git a/modules/amqp-ping/module.json b/modules/amqp-ping/module.json
index f50d554..73a69ba 100644
--- a/modules/amqp-ping/module.json
+++ b/modules/amqp-ping/module.json
@@ -59,6 +59,11 @@
   ],
   "build": {
     "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
       {
         "arg": "RUNTIME_BASE",
         "module": "mesh-tools",
diff --git a/modules/mesh-catalog/Dockerfile b/modules/mesh-catalog/Dockerfile
index 9f1bd60..f470101 100644
--- a/modules/mesh-catalog/Dockerfile
+++ b/modules/mesh-catalog/Dockerfile
@@ -5,14 +5,16 @@
 # nothing is copied out of a neighbouring checkout — which is what lets the mesh build this from a
 # repository and a path (novox/hq ADR 0069) rather than only on a workstation with the siblings.
 #
-# Named, not pinned. The mesh answers this with the copy of the runtime it holds, because a
-# fingerprint written here would name one particular copy — the one on whichever machine the person
-# typing it was using — and on any other mesh that copy has never existed (novox/hq issue 044).
-# Declared in module.json's `build.on`; there is deliberately no default, so a build nobody told
-# stops here rather than on a reference that resolves to nothing.
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
 ARG RUNTIME_BASE
 
-FROM ${RUNTIME_BASE} AS build
+FROM ${BUILD_BASE} AS build
 # Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
 # node_modules — the module is compiled against exactly the sdk it will run against.
 WORKDIR /app/modules/mesh-catalog
diff --git a/modules/mesh-catalog/module.json b/modules/mesh-catalog/module.json
index b6f0047..ca6f283 100644
--- a/modules/mesh-catalog/module.json
+++ b/modules/mesh-catalog/module.json
@@ -79,6 +79,11 @@
   ],
   "build": {
     "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
       {
         "arg": "RUNTIME_BASE",
         "module": "mesh-tools",
diff --git a/modules/postgres/Dockerfile b/modules/postgres/Dockerfile
index 5851eed..c8a2e36 100644
--- a/modules/postgres/Dockerfile
+++ b/modules/postgres/Dockerfile
@@ -6,14 +6,16 @@
 # repository and a path (novox/hq ADR 0069) rather than only on a workstation that happens to have
 # the siblings.
 #
-# Named, not pinned. The mesh answers this with the copy of the runtime it holds, because a
-# fingerprint written here would name one particular copy — the one on whichever machine the person
-# typing it was using — and on any other mesh that copy has never existed (novox/hq issue 044).
-# Declared in module.json's `build.on`; there is deliberately no default, so a build nobody told
-# stops here rather than on a reference that resolves to nothing.
+# Two bases, named rather than pinned: the image this is COMPILED in, and the image it RUNS in.
+# They are different images on purpose — the first carries a compiler and the second must not, or
+# every running container would carry one it never invokes. The mesh answers both with the copies it
+# holds, because a fingerprint written here would name one particular copy and no other mesh has it
+# (novox/hq issue 044). Declared in module.json's `build.on`; deliberately no defaults, so a build
+# nobody told stops here and says which module to build first.
+ARG BUILD_BASE
 ARG RUNTIME_BASE
 
-FROM ${RUNTIME_BASE} AS build
+FROM ${BUILD_BASE} AS build
 # Compiled under /app/modules so `@novox/mesh-sdk` resolves upward into the base's own
 # node_modules — the module is compiled against exactly the sdk it will run against.
 WORKDIR /app/modules/postgres
diff --git a/modules/postgres/module.json b/modules/postgres/module.json
index 20ec55f..74402c3 100644
--- a/modules/postgres/module.json
+++ b/modules/postgres/module.json
@@ -123,6 +123,11 @@
   ],
   "build": {
     "on": [
+      {
+        "arg": "BUILD_BASE",
+        "module": "mesh-tools",
+        "artifact": "build"
+      },
       {
         "arg": "RUNTIME_BASE",
         "module": "mesh-tools",