diff --git a/bin/complement b/bin/complement
new file mode 100755
index 00000000..291953dd
--- /dev/null
+++ b/bin/complement
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# Path to Complement's source code
+COMPLEMENT_SRC="$1"
+
+# A `.jsonl` file to write test logs to
+LOG_FILE="$2"
+
+# A `.jsonl` file to write test results to
+RESULTS_FILE="$3"
+
+OCI_IMAGE="complement-conduit:dev"
+
+env \
+    -C "$(git rev-parse --show-toplevel)" \
+    docker build \
+        --tag "$OCI_IMAGE" \
+        --file complement/Dockerfile \
+        .
+
+# It's okay (likely, even) that `go test` exits nonzero
+set +o pipefail
+env \
+    -C "$COMPLEMENT_SRC" \
+    COMPLEMENT_BASE_IMAGE="$OCI_IMAGE" \
+    go test -json ./tests | tee "$LOG_FILE"
+set -o pipefail
+
+# Post-process the results into an easy-to-compare format
+cat "$LOG_FILE" | jq -c '
+    select(
+        (.Action == "pass" or .Action == "fail" or .Action == "skip")
+        and .Test != null
+    ) | {Action: .Action, Test: .Test}
+    ' | sort > "$RESULTS_FILE"
diff --git a/complement/Dockerfile b/complement/Dockerfile
index 50173a1c..813af10e 100644
--- a/complement/Dockerfile
+++ b/complement/Dockerfile
@@ -1,26 +1,30 @@
-# For use in our CI only. This requires a build artifact created by a previous run pipline stage to be placed in cached_target/release/conduit
-FROM registry.gitlab.com/jfowl/conduit-containers/rust-with-tools:commit-16a08e9b as builder
-#FROM rust:latest as builder
+FROM rust:1.75.0
 
 WORKDIR /workdir
 
-ARG RUSTC_WRAPPER
-ARG AWS_ACCESS_KEY_ID
-ARG AWS_SECRET_ACCESS_KEY
-ARG SCCACHE_BUCKET
-ARG SCCACHE_ENDPOINT
-ARG SCCACHE_S3_USE_SSL
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    libclang-dev
 
-COPY . .
-RUN mkdir -p target/release
-RUN test -e cached_target/release/conduit && cp cached_target/release/conduit target/release/conduit || cargo build --release
-
-## Actual image
-FROM debian:bullseye
-WORKDIR /workdir
+COPY Cargo.toml Cargo.toml
+COPY Cargo.lock Cargo.lock
+COPY src src
+RUN cargo build --release \
+    && mv target/release/conduit conduit \
+    && rm -rf target
 
 # Install caddy
-RUN apt-get update && apt-get install -y debian-keyring debian-archive-keyring apt-transport-https curl && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/testing/gpg.key' | gpg --dearmor -o /usr/share/keyrings/caddy-testing-archive-keyring.gpg && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/testing/debian.deb.txt' | tee /etc/apt/sources.list.d/caddy-testing.list && apt-get update && apt-get install -y caddy
+RUN apt-get update \
+    && apt-get install -y \
+    debian-keyring \
+    debian-archive-keyring \
+    apt-transport-https \
+    curl \
+    && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/testing/gpg.key' \
+    | gpg --dearmor -o /usr/share/keyrings/caddy-testing-archive-keyring.gpg \
+    && curl -1sLf 'https://dl.cloudsmith.io/public/caddy/testing/debian.deb.txt' \
+    | tee /etc/apt/sources.list.d/caddy-testing.list \
+    && apt-get update \
+    && apt-get install -y caddy
 
 COPY conduit-example.toml conduit.toml
 COPY complement/caddy.json caddy.json
@@ -29,16 +33,9 @@ ENV SERVER_NAME=localhost
 ENV CONDUIT_CONFIG=/workdir/conduit.toml
 
 RUN sed -i "s/port = 6167/port = 8008/g" conduit.toml
-RUN echo "allow_federation = true" >> conduit.toml
-RUN echo "allow_check_for_updates = true" >> conduit.toml
-RUN echo "allow_encryption = true" >> conduit.toml
-RUN echo "allow_registration = true" >> conduit.toml
 RUN echo "log = \"warn,_=off,sled=off\"" >> conduit.toml
 RUN sed -i "s/address = \"127.0.0.1\"/address = \"0.0.0.0\"/g" conduit.toml
 
-COPY --from=builder /workdir/target/release/conduit /workdir/conduit
-RUN chmod +x /workdir/conduit
-
 EXPOSE 8008 8448
 
 CMD uname -a && \
diff --git a/complement/README.md b/complement/README.md
index b86aab38..185b251a 100644
--- a/complement/README.md
+++ b/complement/README.md
@@ -1,13 +1,11 @@
-# Running Conduit on Complement
+# Complement
 
-This assumes that you're familiar with complement, if not, please readme
-[their readme](https://github.com/matrix-org/complement#running).
+## What's that?
 
-Complement works with "base images", this directory (and Dockerfile) helps build the conduit complement-ready docker
-image.
+Have a look at [its repository](https://github.com/matrix-org/complement).
 
-To build, `cd` to the base directory of the workspace, and run this:
+## How do I use it with Conduit?
 
-`docker build -t complement-conduit:dev -f complement/Dockerfile .`
-
-Then use `complement-conduit:dev` as a base image for running complement tests.
+The script at [`../bin/complement`](../bin/complement) has automation for this.
+It takes a few command line arguments, you can read the script to find out what
+those are.
diff --git a/flake.nix b/flake.nix
index 31a84131..bf50e584 100644
--- a/flake.nix
+++ b/flake.nix
@@ -234,6 +234,13 @@
           toolchain
         ] ++ (with pkgsHost; [
           engage
+
+          # Needed for Complement
+          go
+          olm
+
+          # Needed for our script for Complement
+          jq
         ]);
       };
     });