diff --git a/deploy/self-hosted/compose.smoke.yml b/deploy/self-hosted/compose.smoke.yml
index 9beb744..d7e8131 100644
--- a/deploy/self-hosted/compose.smoke.yml
+++ b/deploy/self-hosted/compose.smoke.yml
@@ -7,8 +7,17 @@ services:
   storage-init:
     build:
       context: ./minio
+  upload:
+    build:
+      context: ./tusd
+  clickhouse:
+    volumes:
+      - ./trust:/etc/mave-ca:ro
+      - ./trust/clickhouse.xml:/etc/clickhouse-server/config.d/public-trust.xml:ro
   caddy:
     ports: !reset []
+    volumes:
+      - ./trust:/etc/mave-ca:ro
 
 networks:
   default:
diff --git a/deploy/self-hosted/compose.yml b/deploy/self-hosted/compose.yml
index 0ec7808..14d99f8 100644
--- a/deploy/self-hosted/compose.yml
+++ b/deploy/self-hosted/compose.yml
@@ -160,8 +160,7 @@ services:
   upload:
     image: mave-tusd:local
     build:
-      context: ../..
-      dockerfile: deploy/tusd/Dockerfile
+      context: ../tusd
     command:
       - -port=1080
       - -behind-proxy=true
diff --git a/deploy/self-hosted/install.sh b/deploy/self-hosted/install.sh
index 7699c60..49d033d 100755
--- a/deploy/self-hosted/install.sh
+++ b/deploy/self-hosted/install.sh
@@ -271,8 +271,8 @@ compose() {
 
 compose config --quiet
 
-compose pull postgres clickhouse upload caddy
-compose build --pull minio storage-init
+compose pull postgres clickhouse caddy
+compose build --pull minio storage-init upload
 
 if ! docker image inspect "$core_image" >/dev/null 2>&1; then
   docker pull "$core_image"
diff --git a/deploy/self-hosted/smoke.sh b/deploy/self-hosted/smoke.sh
index 9dd6e1c..3935ebd 100755
--- a/deploy/self-hosted/smoke.sh
+++ b/deploy/self-hosted/smoke.sh
@@ -53,6 +53,8 @@ network_created=false
 stack_started=false
 cp "$script_dir/compose.yml" "$script_dir/compose.smoke.yml" "$script_dir/Caddyfile" "$smoke_dir/"
 cp -R "$script_dir/../minio" "$smoke_dir/minio"
+cp -R "$script_dir/../tusd" "$smoke_dir/tusd"
+cp -R "$script_dir/../trust" "$smoke_dir/trust"
 
 # Explicit files/project override any COMPOSE_* settings in the caller's shell.
 # The subshell also excludes inherited application credentials and feature flags.