diff --git a/deployment/cloud/Dockerfile b/deployment/cloud/Dockerfile
index 651c1a816..519b67447 100644
--- a/deployment/cloud/Dockerfile
+++ b/deployment/cloud/Dockerfile
@@ -7,6 +7,9 @@ FROM oven/bun:1-debian
 RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates curl unzip \
  && rm -rf /var/lib/apt/lists/*
 COPY --from=oauth2proxy /bin/oauth2-proxy /usr/local/bin/oauth2-proxy
+# Go, to build Rudder's local engine (backend/rudder-engine, go 1.22) when RUDDER_ENGINE=1.
+COPY --from=golang:1.22-bookworm /usr/local/go /usr/local/go
+ENV PATH="/usr/local/go/bin:${PATH}"
 # PocketBase, pinned and checked: the backend for plugins (a dev and a prod instance, see entry.sh).
 ARG PB_VERSION=0.40.4
 ARG PB_SHA256=9042ec818570e79c3628dadcd0a756c1496d9e1173918ec409d133c02f82e5fa
diff --git a/deployment/cloud/README.md b/deployment/cloud/README.md
index 6b6ea35ba..74736f8ea 100644
--- a/deployment/cloud/README.md
+++ b/deployment/cloud/README.md
@@ -67,7 +67,8 @@ there. Only then does it swap the new build in.
 | `PB_SUPERUSER_EMAIL`, `PB_SUPERUSER_PASSWORD` | PocketBase's superuser, set on start in both instances |
 | `PUBLIC_API_BASE` | the public API URL written into the build's `runtime-config.js` (e.g. `https://<host>/api-prod`) |
 | `BUILD_MAX_OLD_SPACE_MB` | Node heap cap for a build (default `1536`) |
+| `RUDDER_ENGINE` | `1` runs Rudder's voice-to-text engine here, fed by the browser's microphone (about 1 GB more; its model, ~742 MB, downloads once to `RUDDER_HOME`, default `/data/rudder`) |
 
 Mount a persistent volume at **`/data`** (PocketBase data and published builds). Memory measured on
 the running container: about 0.45 GB idle, up to about 1.5 GB more during a build, so give it
-**2.5 GB**.
+**2.5 GB** (**3.5 GB** with `RUDDER_ENGINE=1`).
diff --git a/deployment/cloud/entry.sh b/deployment/cloud/entry.sh
index a8bd2b0a7..1e9525db0 100755
--- a/deployment/cloud/entry.sh
+++ b/deployment/cloud/entry.sh
@@ -15,8 +15,14 @@ bun install --frozen-lockfile || bun install
     if git fetch -q --depth 1 origin "$BRANCH"; then
       NEW=$(git rev-parse FETCH_HEAD)
       if [ "$OLD" != "$NEW" ]; then
+        CHANGED=$(git diff --name-only "$OLD" "$NEW" 2>/dev/null)
         git reset -q --hard FETCH_HEAD
         echo "$(date -u +%FT%TZ) PULLED ${OLD:0:8} -> ${NEW:0:8}" >> /tmp/pull.log
+        # the engine binary is untracked, so rebuild it when its source changed (next start picks it up)
+        if [ "${RUDDER_ENGINE:-0}" = 1 ] && echo "$CHANGED" | grep -q '^backend/rudder-engine/'; then
+          (cd backend/rudder-engine && go build -o ../bin/rudder-engine .) >> /tmp/pull.log 2>&1 \
+            && echo "$(date -u +%FT%TZ) rudder-engine rebuilt" >> /tmp/pull.log
+        fi
       fi
     fi
   done
@@ -24,6 +30,16 @@ bun install --frozen-lockfile || bun install
 
 CONFIG=/app/repo/deployment/cloud/vite.cloud.config.mjs
 
+# Rudder (optional, RUDDER_ENGINE=1): its voice-to-text engine runs here, fed by the BROWSER's
+# microphone (no server mic). The runtime and the pinned model (~742 MB) go to RUDDER_HOME, which should
+# be on the persistent volume so they download once. Vite's backend plugin starts the engine and serves
+# /api/rudder, which stays behind the sign-in (it is not a public route). About 1 GB resident.
+if [ "${RUDDER_ENGINE:-0}" = 1 ]; then
+  export RUDDER_HOME="${RUDDER_HOME:-/data/rudder}" RUDDER_AUDIO=browser
+  bash /app/repo/backend/rudder-engine/setup-runtime.sh \
+    || echo "[rudder] setup failed: the widget will report the engine offline"
+fi
+
 if [ -z "${OIDC_ISSUER:-}" ]; then
   # Open, like a laptop: no sign-in.
   export VITE_HOST=0.0.0.0 VITE_PORT="$PORT"