diff --git a/infrastructure/inventory/hosts.ini b/infrastructure/inventory/hosts.ini
index 69d7177..4b71c07 100644
--- a/infrastructure/inventory/hosts.ini
+++ b/infrastructure/inventory/hosts.ini
@@ -24,6 +24,11 @@ gandalf.prole.org
 k3s_servers
 k3s_agents
 
+# arm64 docker build host(s) for the native daily knoe-db image lane (→ registry.knoe.dev).
+# gandalf is also a k3s_agent; the docker_build_host role keeps FORWARD=ACCEPT so k3s is safe.
+[build_hosts]
+gandalf.prole.org
+
 [linux_hosts]
 pi.prole.org
 raspberry.prole.org
diff --git a/infrastructure/playbooks/docker_build_host.yml b/infrastructure/playbooks/docker_build_host.yml
new file mode 100644
index 0000000..44d6902
--- /dev/null
+++ b/infrastructure/playbooks/docker_build_host.yml
@@ -0,0 +1,10 @@
+---
+# Provision docker on the arm64 build host(s) — the native arm64 daily-image lane.
+#   ansible-playbook infrastructure/playbooks/docker_build_host.yml
+# Targets the [build_hosts] inventory group (gandalf). Idempotent: re-running re-asserts
+# docker + the FORWARD-policy guard, so the build host survives re-imaging.
+- name: Provision docker on arm64 build hosts
+  hosts: build_hosts
+  become: true
+  roles:
+    - docker_build_host
diff --git a/infrastructure/roles/docker_build_host/tasks/main.yml b/infrastructure/roles/docker_build_host/tasks/main.yml
new file mode 100644
index 0000000..cab9bd0
--- /dev/null
+++ b/infrastructure/roles/docker_build_host/tasks/main.yml
@@ -0,0 +1,35 @@
+---
+# docker_build_host — provision the docker engine on an arm64 build host (e.g. gandalf)
+# for the native arm64 daily knoe-db image build (push → registry.knoe.dev). Builds run
+# in a remote buildx builder (buildkit container) on this host; the dev workstation only
+# orchestrates over ssh.
+#
+# These hosts double as k3s agents, so docker's own containerd coexists with k3s's
+# embedded containerd (separate sockets: /run/containerd vs /run/k3s/containerd). The one
+# real hazard is docker flipping the iptables FORWARD policy to DROP, which would sever
+# k3s pod networking — so we hold it at ACCEPT. We deliberately let docker manage its own
+# NAT/iptables otherwise, because the buildkit container needs outbound for registry pulls.
+
+- name: Install docker engine (docker.io)
+  ansible.builtin.apt:
+    name: docker.io
+    state: present
+    update_cache: true
+
+- name: Add the ansible user to the docker group (so buildx can drive docker over ssh)
+  ansible.builtin.user:
+    name: "{{ ansible_user | default('ansible') }}"
+    groups: docker
+    append: true
+
+- name: Ensure docker is enabled and running
+  ansible.builtin.service:
+    name: docker
+    enabled: true
+    state: started
+
+- name: Hold the iptables FORWARD policy at ACCEPT (protect k3s pod networking from docker)
+  ansible.builtin.iptables:
+    chain: FORWARD
+    policy: ACCEPT
+  when: "'k3s_agents' in group_names or 'k3s_servers' in group_names"