diff --git a/.build.yml b/.build.yml
new file mode 100644
index 0000000000000000000000000000000000000000..4f3af820fd7e8856da75ad5143be50260145e5d9
--- /dev/null
+++ b/.build.yml
@@ -0,0 +1,82 @@
+image: alpine/edge
+packages:
+  - abuild
+  - go
+  - git
+  - rclone
+  - sassc
+  - minify
+secrets:
+  # File secret `apk-ci-s3`, installed at ~/.apk-ci.env, containing
+  # APK_CI_S3_ACCESS_KEY / APK_CI_S3_SECRET_KEY for the Garage `repo` bucket.
+  - apk-ci-s3
+sources:
+  - https://git.srht.bigb.es/~bigbes/sr-ht-dolt
+environment:
+  REPO: sr-ht-dolt
+  APK_REPO: alpine/v3.22/bigbes/x86_64
+  S3_BUCKET: repo
+  S3_ENDPOINT: https://s3.bigb.es
+  # Must track the srht deployment's SRHT_CORE_VER, or this service's theme
+  # drifts from the rest of the instance. BOOTSTRAP_REV is the submodule commit
+  # core.sr.ht pins at that tag; bump the two together.
+  CORE_VER: "0.83.8"
+  BOOTSTRAP_REV: 779ad9f174ea5ab7e755f6df0ec9e5912d67dd16
+submitter:
+  git.sr.ht:
+    allow-refs:
+      - refs/heads/master
+tasks:
+  - scss: |
+      # No apk ships the shared sourcehut SCSS partials, so assemble them the
+      # way core.sr.ht's `make install-scss` would: its own scss/ plus the
+      # Bootstrap 4 submodule. `make css` runs sassc -I against this tree.
+      git clone --depth 1 --branch "$CORE_VER" \
+        https://git.sr.ht/~sircmpwn/core.sr.ht /tmp/core
+      sudo mkdir -p /usr/share/sourcehut/scss/bootstrap
+      sudo cp /tmp/core/scss/*.scss /tmp/core/scss/*.css /usr/share/sourcehut/scss/
+      git init -q /tmp/bootstrap
+      git -C /tmp/bootstrap remote add origin https://github.com/twbs/bootstrap
+      git -C /tmp/bootstrap fetch -q --depth 1 origin "$BOOTSTRAP_REV"
+      git -C /tmp/bootstrap checkout -q FETCH_HEAD
+      sudo cp -r /tmp/bootstrap/scss /usr/share/sourcehut/scss/bootstrap/scss
+  - keygen: |
+      # abuild insists on signing what it builds, but this key is deliberately
+      # throwaway: generated per build, dies with the VM, trusted by nothing.
+      # Clients verify against the index instead, which is rebuilt and signed on
+      # phoebe by the garage stack's apk-mirror service — it indexes this repo
+      # with --allow-untrusted precisely because of this.
+      #
+      # -i installs the public half into /etc/apk/keys. Without it abuild's own
+      # final "update the local repository index" step dies with UNTRUSTED
+      # signature, after having built the package perfectly well.
+      SUDO=sudo abuild-keygen -a -n -i -q
+  - version: |
+      cd "$REPO"
+      ver="0.0.$(git rev-list --count HEAD)"
+      sed -i "s/^pkgver=.*/pkgver=$ver/" APKBUILD
+      echo "export PKGVER=$ver" >> ~/.buildenv
+      echo "building $ver"
+  - build: |
+      cd "$REPO"
+      # -d: makedepends are already installed via `packages:` above.
+      REPODEST=$HOME/packages abuild -d
+      find "$HOME/packages" -name '*.apk'
+  - publish: |
+      set +x   # never echo the S3 credentials into the build log
+      . ~/.apk-ci.env
+      export RCLONE_CONFIG_GARAGE_TYPE=s3
+      export RCLONE_CONFIG_GARAGE_PROVIDER=Other
+      export RCLONE_CONFIG_GARAGE_ENDPOINT="$S3_ENDPOINT"
+      export RCLONE_CONFIG_GARAGE_REGION=garage
+      export RCLONE_CONFIG_GARAGE_FORCE_PATH_STYLE=true
+      export RCLONE_CONFIG_GARAGE_ACCESS_KEY_ID="$APK_CI_S3_ACCESS_KEY"
+      export RCLONE_CONFIG_GARAGE_SECRET_ACCESS_KEY="$APK_CI_S3_SECRET_KEY"
+      set -x
+      # Upload only; never delete. Old versions stay so a pinned deployment can
+      # always be rebuilt — the same reason the upstream mirror is append-only.
+      find "$HOME/packages" -name '*.apk' -print | while read -r f; do
+        rclone copyto "$f" "garage:$S3_BUCKET/$APK_REPO/$(basename "$f")"
+        echo "uploaded $(basename "$f")"
+      done
+      echo "published; apk-mirror on phoebe re-indexes within 15 minutes"
diff --git a/.sourcecraft/webhooks.yaml b/.sourcecraft/webhooks.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..56f207f6ddcdf2aa82d3d79b7353cd6fd6eecaca
--- /dev/null
+++ b/.sourcecraft/webhooks.yaml
@@ -0,0 +1,24 @@
+# Notifies the lab's gitsync service that this repo has moved, so the mirror on
+# our self-hosted sourcehut updates within seconds instead of waiting for its
+# hourly safety-net poll. That matters beyond the mirror itself: builds.sr.ht CI
+# (see .build.yml) only fires once the commit lands on the sourcehut side, so
+# this webhook is what makes push -> apk build feel immediate.
+#
+# The receiver verifies the HMAC-SHA256 in X-Src-Signature over the request
+# body. The signing key is generated by SourceCraft, is not part of this file,
+# and is read once from Автоматизации -> Вебхуки into the gitsync stack's .env.
+#
+# The slug is unique per repository, but the receiver serves all three repos and
+# maps slug -> signing key, so it must be unique ACROSS them too — hence the
+# suffix rather than a plain "gitsync".
+webhooks:
+  hooks:
+    - slug: gitsync-dolt
+      name: "gitsync mirror trigger"
+      description: "Triggers the phoebe gitsync service to mirror sr-ht-dolt to git.srht.bigb.es"
+      url: "https://gitsync.bigb.es/hook"
+      ssl_verification: true
+      active: true
+  on:
+    push:
+      - hooks: ["gitsync-dolt"]
diff --git a/APKBUILD b/APKBUILD
new file mode 100644
index 0000000000000000000000000000000000000000..8e3d04f3447b00df60c5e6d432c9d363a2b68740
--- /dev/null
+++ b/APKBUILD
@@ -0,0 +1,54 @@
+# Maintainer: bigbes <bigbes@gmail.com>
+#
+# Built by builds.sr.ht (.build.yml) and published to our own apk repo at
+# repo.bigb.es/alpine/v3.22/bigbes. The srht deployment installs it from there
+# instead of cloning and compiling this repo inside its Dockerfile.
+#
+# pkgver is rewritten by CI to 0.0.<commit count> before abuild runs — a
+# monotonic, unique-per-commit version that the deployment can pin.
+pkgname=dolt.sr.ht
+pkgver=0.0.0
+pkgrel=0
+pkgdesc="Dolt database hosting for a sourcehut instance"
+url="https://sourcecraft.dev/bigbes/sr-ht-dolt"
+arch="x86_64"
+license="MIT"
+# !check      — tests want a live Postgres and a chunk store
+# !tracedeps  — CGO_ENABLED=0 with -tags gms_pure_go, so the binaries are
+#               static: no ICU, no gozstd, nothing to trace
+options="!check !tracedeps"
+
+source=""
+builddir="$startdir"
+
+# The pure-Go build tag is what keeps this package free of cgo: it selects
+# go-mysql-server's stdlib regexp instead of go-icu-regex (the SQL engine is
+# never run here), and a replace directive backs gozstd with a klauspost shim.
+# Dropping it would pull in libicu and make the package arch/libc-specific.
+export GO_TAGS="gms_pure_go"
+
+build() {
+	cd "$builddir"
+	# `make all` is all-bin ONLY — this Makefile deliberately keeps the CSS off
+	# the default path because sassc/minify aren't always on a dev machine. So
+	# `css` has to be asked for by name; building `all` alone silently produces
+	# a package with no stylesheet.
+	CGO_ENABLED=0 make all-bin GO_TAGS="$GO_TAGS"
+	# Needs the shared sourcehut scss partials pre-assembled at ASSETS/scss (no
+	# apk ships them); CI does that before calling abuild.
+	make css ASSETS=/usr/share/sourcehut
+
+	# install-share copies static/*.css under `2>/dev/null || true`, so a
+	# stylesheet that never got built would ship as an unstyled service without
+	# failing anything. Assert it exists instead. The hashed copy is the one the
+	# service finds by globbing its static dir at startup.
+	ls static/main.min.*.css >/dev/null
+}
+
+package() {
+	cd "$builddir"
+	# This Makefile's install rules do not honour DESTDIR (they write to
+	# $(BINDIR)/$(SHAREDIR) directly), so the staging dir is passed as PREFIX.
+	# MIGRATIONDIR and STATICDIR are both derived from SHAREDIR, so they follow.
+	make install PREFIX="$pkgdir/usr"
+}