diff --git a/.github/workflows/services-execution.yml b/.github/workflows/services-execution.yml
index 930c060..201a545 100644
--- a/.github/workflows/services-execution.yml
+++ b/.github/workflows/services-execution.yml
@@ -46,3 +46,8 @@ jobs:
       - run: pnpm --filter matching-executor run check
       - run: pnpm --filter matching-executor run build
       - run: pnpm --filter matching-executor test
+      # Builds the deployable image. tsc above resolves workspace packages through the root
+      # node_modules and passes whatever the Dockerfile copies; the image only has what it COPYs
+      # and builds. That gap let @numo/kms-signer land green while making the image unbuildable,
+      # which is the kind of thing found at deploy time, when it is most expensive.
+      - run: docker build -f services/execution/Dockerfile -t numo-exchange/execution:ci .
diff --git a/scripts/verify.sh b/scripts/verify.sh
index 055e89f..cd1242f 100755
--- a/scripts/verify.sh
+++ b/scripts/verify.sh
@@ -74,6 +74,19 @@ step node . "matching-executor check" pnpm --filter matching-executor run check
 step node . "matching-executor build" pnpm --filter matching-executor run build
 step node . "matching-executor test" pnpm --filter matching-executor test
 
+# The image, not just the type check. tsc resolves workspace packages through the root
+# node_modules and passes whatever the Dockerfile copies; the image only has what it COPYs and
+# builds. Skipped rather than failed when docker is absent -- it is not needed to work on the
+# services, and a hard failure here would train people to ignore this script.
+execution_image() {
+  if ! docker info >/dev/null 2>&1; then
+    echo "docker not available; skipping the image build (CI still runs it)" >&2
+    return 0
+  fi
+  ( cd "$ROOT" && docker build -f services/execution/Dockerfile -t numo-exchange/execution:verify . )
+}
+step node . "execution image builds" execution_image
+
 # ---- services-rebalance.yml ------------------------------------------------------------
 step node . "cngn-rebalance check" pnpm --filter cngn-rebalance run check
 step node . "cngn-rebalance test" pnpm --filter cngn-rebalance test
diff --git a/services/execution/Dockerfile b/services/execution/Dockerfile
index 80997d5..86685d2 100644
--- a/services/execution/Dockerfile
+++ b/services/execution/Dockerfile
@@ -1,5 +1,5 @@
-# Build context is the REPOSITORY ROOT, not services/execution — this package
-# depends on @numo/abis through the pnpm workspace, so the build needs both:
+# Build context is the REPOSITORY ROOT, not services/execution — this package depends on
+# @numo/abis and @numo/kms-signer through the pnpm workspace, so the build needs all three:
 #
 #   docker build -f services/execution/Dockerfile .
 #
@@ -10,15 +10,21 @@ RUN corepack enable && corepack prepare pnpm@8.7.3 --activate
 
 # Manifests first: the install layer then survives any source-only change.
 COPY pnpm-lock.yaml pnpm-workspace.yaml package.json ./
-COPY packages/abis/package.json      packages/abis/
-COPY services/execution/package.json services/execution/
+COPY packages/abis/package.json       packages/abis/
+COPY packages/kms-signer/package.json packages/kms-signer/
+COPY services/execution/package.json  services/execution/
 RUN pnpm install --frozen-lockfile
 
-COPY packages/abis      packages/abis
-COPY services/execution services/execution
+COPY packages/abis       packages/abis
+COPY packages/kms-signer packages/kms-signer
+COPY services/execution  services/execution
 
-# @numo/abis must be compiled before the service that imports it.
+# Every workspace package the service imports must be COMPILED first: their main/types resolve to
+# dist/, which is gitignored, so a package that is copied but not built fails the service's tsc with
+# "Cannot find module". Add the build here whenever a new workspace dependency is added -- CI now
+# builds this image (services-execution.yml) so a missing one fails there rather than at deploy.
 RUN pnpm --filter @numo/abis build \
+ && pnpm --filter @numo/kms-signer build \
  && pnpm --filter matching-executor build
 
 # Resolves the workspace link into a self-contained tree with prod deps only.