diff --git a/image-recipe/build-auto-installer-iso.sh b/image-recipe/build-auto-installer-iso.sh
index 5916aa70..a56124ca 100755
--- a/image-recipe/build-auto-installer-iso.sh
+++ b/image-recipe/build-auto-installer-iso.sh
@@ -260,7 +260,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \\
 RUN cargo install --locked cargo-deb
 RUN git clone --depth 1 https://github.com/jmcorgan/fips.git /src/fips
 WORKDIR /src/fips
-RUN cargo build --release
+# fips-gateway is in a separate workspace crate; plain --bins on the
+# root only builds root's bins. --workspace pulls every member crate's
+# bin target so cargo deb finds them all.
+RUN cargo build --release --workspace --bins
 RUN cargo deb --no-build
 RUN cp target/debian/fips_*_amd64.deb /tmp/fips.deb