diff --git a/bitbucket-pipelines.yml b/bitbucket-pipelines.yml
new file mode 100644
index 0000000..aac977e
--- /dev/null
+++ b/bitbucket-pipelines.yml
@@ -0,0 +1,67 @@
+# nullplatform CI for Bitbucket Pipelines.
+#
+# Contract:  np build start  ->  make build  ->  np asset push  ->  np build update
+# There is no deploy step here: nullplatform triggers deployments itself.
+#
+# Lambda-only template: no Dockerfile, no docker service, no kaniko.
+#
+# NOTE: this Makefile's `push` target is `aws s3 cp ... $(ASSET_TARGET_URL)` and relies
+# on the caller to supply that URL (the GitHub Action does, after creating the asset via
+# the API). Bitbucket has no such action, so we `make build` and then call `np asset push`
+# ourselves; np asset push creates the asset and uploads it in one shot.
+#
+# Asset name `main` and output `build/main.zip` match the defaults the GitHub path uses.
+#
+# The only secret is NULLPLATFORM_API_KEY. nullplatform creates it as a *secured*
+# repository variable when the application is created, and Bitbucket injects every
+# repository variable into the step environment, so it is not declared below.
+#
+# Requires Pipelines to be ENABLED on the repository (Repository settings ->
+# Pipelines -> Settings). It is off by default, even with this file present.
+
+image: node:18
+
+definitions:
+  steps:
+    - step: &nullplatform-build
+        name: nullplatform build
+        caches:
+          - node
+        script:
+          # The np CLI installs to $HOME/.local/bin and does not put itself on PATH
+          # for the current shell -- export it explicitly.
+          - curl -fsSL https://cli.nullplatform.com/install.sh | sh
+          - export PATH="$HOME/.local/bin:$PATH"
+          # `make package` needs zip, which node:18 does not ship.
+          - apt-get update && apt-get install -y --no-install-recommends zip
+          - np build start
+          # Build parameters: on GitHub the "Get build parameters" step
+          # (nullplatform/github-action-secrets-and-variables) exports this application's
+          # nullplatform parameters as env vars before the build. The registry ones
+          # (BUILD_AWS_*, BUILD_DOCKER_*) are fetched internally by `np asset push`, which
+          # already runs below, so they need no handling here. Any parameter the build
+          # itself reads from the environment (via `npm test`/compile) should be set as a
+          # SECURED repository variable on Bitbucket, the same way NULLPLATFORM_API_KEY is:
+          # Bitbucket injects every repository variable into the step env, and it flows
+          # through to `make` and its npm children below unchanged.
+          - make build
+            ASSET_WORKING_DIRECTORY=.
+            ASSET_OUTPUT_DIRECTORY=build
+            ASSET_NAME=main
+          - np asset push --type lambda --name main --source build/main.zip
+          - np build update --status=successful
+        after-script:
+          # after-script runs in the same container but in a NEW shell, so the PATH
+          # export above is gone. Re-export it before calling np.
+          - export PATH="$HOME/.local/bin:$PATH"
+          # Bitbucket has no `if: always()` and no `when: on_failure`.
+          # BITBUCKET_EXIT_CODE is defined ONLY in after-script, and after-script
+          # always runs -- this is the failure path.
+          - if [ "$BITBUCKET_EXIT_CODE" -ne 0 ]; then np build update --status=failed; fi
+
+pipelines:
+  branches:
+    main:
+      - step: *nullplatform-build
+    master:
+      - step: *nullplatform-build