diff --git a/build/Dockerfile b/build/Dockerfile
index 0dd6377..ea95dfa 100644
--- a/build/Dockerfile
+++ b/build/Dockerfile
@@ -16,6 +16,9 @@ RUN npm install -g pnpm@latest
 
 WORKDIR /app
 COPY --from=starting-point /src/ ./
+
+# after copying everything, cd to frontend and build the thing
+WORKDIR /app/frontend
 RUN pnpm install --frozen-lockfile && pnpm build
 
 # TODO: Switch to Alpine Linux-based builder image
@@ -58,7 +61,7 @@ FROM alpine:edge AS deploy
 WORKDIR /app
 
 COPY --from=builder /tmp/tranquil-pds /app/dist/tranquil-pds
-COPY --from=frontend --chown=65532:65532 /app/dist /app/dist/frontend
+COPY --from=frontend --chown=65532:65532 /app/frontend/dist /app/dist/frontend
 
 RUN mkdir -p /app/data/blobs && mkdir /app/data/store \
     && apk add --no-cache dumb-init
diff --git a/deploy/tranquil-pds.service b/deploy/tranquil-pds.service
new file mode 100644
index 0000000..244a002
--- /dev/null
+++ b/deploy/tranquil-pds.service
@@ -0,0 +1,14 @@
+# This is the systemd service file that we use to run Tranquil PDS outside of Docker containers in
+# a Uberspace 8 Asteroid, with dotenvx for decrypting our production secrets.
+[Unit]
+Description=Tranquil PDS service
+Documentation=https://tangled.org/tranquil.farm/tranquil-pds
+
+[Install]
+WantedBy=default.target
+
+[Service]
+# Update the binary paths for both dotenvx and the Tranquil PDS binary if you're going to do this outside
+# of Docker or NixOS. We assume that you have your .env.keys handy or authenticated against Dotenvx Armor
+# ahead of time.
+ExecStart=/home/ajhalili/bin/dotenvx run -f .env.production -- /home/ajhalili/infra/recaptime-dev/pds/dist/tranquil-pds