diff --git a/bascule-gateway/Dockerfile b/bascule-gateway/Dockerfile
new file mode 100644
index 0000000..450f856
--- /dev/null
+++ b/bascule-gateway/Dockerfile
@@ -0,0 +1,45 @@
+# Bascule gateway — F.4 production image.
+#
+# BUILD CONTEXT: substrate-project repo root (two levels above bascule-workspace/).
+# Rationale: bascule-gateway's Cargo.toml has cross-workspace path
+# dependencies reaching:
+#   - ../../guildhouse/services/accord-core
+#   - ../../guildhouse/services/accord-opa
+#   - ../../guildhouse/services/qm-core
+#   - ../../guildhouse/services/guildhouse-proto
+#   - ../../substrate/crates/governance-types
+#   - (transitively) ../../guildhouse/sdk/guildhouse-mq, guildhouse-tower
+#   - bascule-workspace siblings (bascule-core, bascule-proto)
+#
+# Invocation:
+#   docker build -t git.guildhouse.dev/tking/bascule-gateway:v0.1.0 \
+#     -f bascule-workspace/bascule-gateway/Dockerfile \
+#     <substrate-project root>
+
+FROM rust:bookworm AS builder
+WORKDIR /app
+RUN apt-get update && apt-get install -y protobuf-compiler && rm -rf /var/lib/apt/lists/*
+
+# Cross-workspace path deps (change rarely). substrate is copied as a
+# whole because its crates inherit `edition.workspace = true` from the
+# substrate workspace root Cargo.toml — copying just substrate/crates
+# orphans the inheritance chain. Workspace members that live outside
+# substrate/crates/ (metakernel/, shell/loader, shellstream/) need to be
+# present for `cargo build` to load the workspace metadata, even though
+# bascule's actual dep tree only reaches into substrate/crates/.
+COPY substrate ./substrate
+COPY guildhouse/sdk ./guildhouse/sdk
+COPY guildhouse/services ./guildhouse/services
+
+# bascule-workspace itself (includes bascule-core, bascule-proto,
+# and all sibling crates the workspace Cargo.toml references).
+COPY bascule-workspace ./bascule-workspace
+
+WORKDIR /app/bascule-workspace
+RUN cargo build --release --bin bascule-gateway
+
+FROM debian:bookworm-slim AS runtime
+RUN apt-get update && apt-get install -y libssl3 ca-certificates && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /app/bascule-workspace/target/release/bascule-gateway /usr/local/bin/
+EXPOSE 50052
+CMD ["bascule-gateway"]