diff --git a/workspace-server/Dockerfile.tenant b/workspace-server/Dockerfile.tenant
index f0982b971..4bac86db0 100644
--- a/workspace-server/Dockerfile.tenant
+++ b/workspace-server/Dockerfile.tenant
@@ -74,6 +74,21 @@ RUN CGO_ENABLED=0 GOOS=linux go build \
     -ldflags "-s -w -X github.com/Molecule-AI/molecule-monorepo/platform/internal/buildinfo.GitSHA=${GIT_SHA}" \
     -o /memory-plugin ./cmd/memory-plugin-postgres
 
+# Memory v1→v2 backfill CLI (issue #1791 Phase A2). Bundled so an
+# operator can migrate the historical agent_memories rows into the v2
+# plugin via:
+#
+#     docker exec molecule-tenant /memory-backfill -dry-run
+#     docker exec molecule-tenant /memory-backfill -apply
+#
+# Idempotent (UUID upsert in the plugin); safe to re-run. See the
+# tool's main.go for full usage. Stays inert until invoked — does not
+# run automatically on boot.
+RUN CGO_ENABLED=0 GOOS=linux go build \
+    -trimpath \
+    -ldflags "-s -w -X github.com/Molecule-AI/molecule-monorepo/platform/internal/buildinfo.GitSHA=${GIT_SHA}" \
+    -o /memory-backfill ./cmd/memory-backfill
+
 # ── Stage 2: Canvas Next.js standalone ────────────────────────────────
 FROM node:20-alpine@sha256:afdf98210b07b586eb71fa22ba2e432e058e4cd1304d31ed60888755b8c865fb AS canvas-builder
 WORKDIR /canvas
@@ -106,9 +121,10 @@ RUN deluser --remove-home node 2>/dev/null || true; \
     delgroup node 2>/dev/null || true; \
     addgroup -g 1000 canvas && adduser -u 1000 -G canvas -s /bin/sh -D canvas
 
-# Go platform binary + Memory v2 sidecar
+# Go platform binary + Memory v2 sidecar + v1→v2 backfill CLI
 COPY --from=go-builder /platform /platform
 COPY --from=go-builder /memory-plugin /memory-plugin
+COPY --from=go-builder /memory-backfill /memory-backfill
 COPY workspace-server/migrations /migrations
 
 # Templates + plugins (pre-cloned by scripts/clone-manifest.sh in the
@@ -135,7 +151,7 @@ COPY workspace-server/entrypoint-tenant.sh /entrypoint.sh
 # !external (e.g. molecule-dev → dev-lead). Caught on staging-cplead-2
 # 2026-05-10 — see internal incident debrief.
 RUN chmod +x /entrypoint.sh && \
-    chown -R canvas:canvas /canvas /platform /memory-plugin /migrations /org-templates
+    chown -R canvas:canvas /canvas /platform /memory-plugin /memory-backfill /migrations /org-templates
 
 EXPOSE 8080
 # entrypoint.sh starts as root to fix volume perms, then drops to