diff --git a/tooling/build-stack.sh b/tooling/build-stack.sh
index 30e2d8a..7fce11b 100755
--- a/tooling/build-stack.sh
+++ b/tooling/build-stack.sh
@@ -72,6 +72,17 @@ prep() {
   have_script fetch-launcher.sh
   tooling/fetch-launcher.sh
 
+  log "fetch authlib-injector.jar (server JVM agent → drasl)"
+  if [ -f runtime/authlib-injector.jar ]; then
+    echo "  runtime/authlib-injector.jar present — skipping"
+  else
+    ai_url="$(curl -fsSL https://api.github.com/repos/yushijinhun/authlib-injector/releases/latest \
+      | jq -r '.assets[] | select(.name|test("authlib-injector-[0-9].*\\.jar$")) | .browser_download_url' | head -1)"
+    [ -n "$ai_url" ] && [ "$ai_url" != "null" ] || die "could not resolve authlib-injector release asset"
+    curl -fSL --retry 3 -o runtime/authlib-injector.jar "$ai_url"
+    echo "  downloaded $(basename "$ai_url")"
+  fi
+
   log "pre-bake server volume (TYPE=NEOFORGE install, one-shot, online)"
   # Bring minecraft up once so itzg installs NeoForge + mods into the volume,
   # then stop it. The party then runs offline against the baked volume.