diff --git a/docker-compose.yml b/docker-compose.yml
index d626dc1..741deed 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -72,6 +72,21 @@ services:
       # the actual security boundary here) — it exists purely to satisfy
       # this image's login gate for local/homelab use.
       CLICKHOUSE_PASSWORD: "sentry-dev-only"
+      # Phase 4's per-tenant provisioning (enterprise/internal/tenantprovision)
+      # runs CREATE USER/GRANT against this connection as the ClickHouse
+      # admin -- the official image's default user doesn't have
+      # access_management rights unless this is set, confirmed the hard
+      # way: -provision-tenant failed with "Not enough privileges... grant
+      # CREATE USER ON *.*" the first time this ran against a real
+      # ClickHouse container, since every prior verification of
+      # tenantprovision had been Docker-free (fakes) or never actually
+      # exercised the admin connection this env var gates. The variable is
+      # genuinely named CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT, not
+      # CLICKHOUSE_ACCESS_MANAGEMENT -- confirmed by reading the image's
+      # own /entrypoint.sh after the more obvious name silently did
+      # nothing (no error, just left access_management="0" in the
+      # generated users.d/default-user.xml).
+      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: "1"
     volumes:
       - clickhouse-data:/var/lib/clickhouse
     ulimits:
@@ -296,8 +311,8 @@ services:
   # manual testing (mint a service token, set the two env vars, restart).
   enterprise-auth:
     build:
-      context: enterprise
-      dockerfile: Dockerfile
+      context: . # needs api/, ingest/, proto/, and enterprise/ itself -- see enterprise/Dockerfile's doc comment
+      dockerfile: enterprise/Dockerfile
     container_name: sentry-enterprise-auth
     depends_on:
       metadata-migrate:
diff --git a/enterprise/Dockerfile b/enterprise/Dockerfile
index bc64eae..ef0376b 100644
--- a/enterprise/Dockerfile
+++ b/enterprise/Dockerfile
@@ -1,10 +1,23 @@
-# Commercial-license module, built the same way as every other Go
-# service here -- no /proto dependency, context is enterprise/ itself,
-# same shape as cli/Dockerfile and alerting/Dockerfile.
-#   docker build -f enterprise/Dockerfile -t sentry-enterprise-auth enterprise/
+# Commercial-license module, built like every other Go service here --
+# context must be the repo root, not enterprise/ alone. enterprise/go.mod
+# has replace directives for api/, ingest/, and proto/ (all resolved as
+# sibling directories, e.g. ../api), and enterprise-auth needs api/
+# specifically for two real reasons: cmd/enterprise-auth/main.go imports
+# api/httpserver directly (WithCredentialedCORS, for the tenant-picker's
+# credentialed cross-origin requests), and internal/rbacstore's
+# DashboardPermissions adapter imports api/dashboards transitively.
+# Go's module resolution needs the whole module's go.mod satisfied to
+# build any one package in it, so this was never actually optional the
+# way the old enterprise/-only context assumed -- confirmed broken the
+# first time this was built with real Docker access after those two
+# imports existed; the repo-root context below is the same shape
+# enterprise-api's and enterprise-ingest's Dockerfiles already use for
+# the identical reason.
+#   docker build -f enterprise/Dockerfile -t sentry-enterprise-auth .
 FROM golang:1.25-alpine AS builder
 WORKDIR /src
 COPY . .
+WORKDIR /src/enterprise
 RUN CGO_ENABLED=0 GOOS=linux go build -o /out/enterprise-auth ./cmd/enterprise-auth
 
 FROM gcr.io/distroless/static-debian12