diff --git a/deployment/idunn/recipe.toml b/deployment/idunn/recipe.toml
new file mode 100644
index 00000000..53bf33f5
--- /dev/null
+++ b/deployment/idunn/recipe.toml
@@ -0,0 +1,34 @@
+schema = "gamecult.idunn.target_declaration.v1"
+target = "ratatoskr"
+# Idunn stamps the source commit into the build environment under this name. The release is not built from source: the
+# dist tarball below is built by scripts the release owner runs (build-prod-dist.sh) and enters pinned by sha256, so
+# each release is a recipe commit whose pin is its provenance. The stamp the served index carries is the commit the
+# tarball was built from, which is not this commit.
+source_stamp_environment = "RATATOSKR_BUILD_COMMIT"
+
+# Release dist 934f82386d612c3e056f851555c7c9dfd2bdf5db: the output of build-prod-dist.sh (ALLOW_CONFIG_DRIFT=1), packed
+# as dist/ at the top of one gzip tar. The tree carries the repo's own config.json; what is served is the operator's
+# carried file, which Idunn copies beside dist/ and the vhost aliases over the tree's (a vhost without that alias would
+# serve the repo config).
+[[external_inputs]]
+id = "dist-tarball"
+url = "https://eureka.gamecult.org/forge/GameCult/Ratatoskr/releases/download/dist-934f8238/ratatoskr-934f8238-dist.tar.gz"
+sha256 = "55e7be0622a4eddb81008bc0132e3d476bdb3c453e278599d5a0259a76d00c5b"
+runner = "unpack"
+destination = "release/dist.tar.gz"
+
+[[steps]]
+id = "unpack-dist"
+phase = "prepare"
+runner = "unpack"
+argv = ["tar", "-xzf", "release/dist.tar.gz", "-C", "release"]
+
+[[artifacts]]
+id = "dist"
+source_kind = "runner-output"
+runner = "unpack"
+source = "release/dist"
+destination = "dist"
+
+[static_release]
+artifact = "dist"