diff --git a/roles/openshift-apps/waiverdb/files/buildconfig.yml b/roles/openshift-apps/waiverdb/files/buildconfig.yml
new file mode 100644
index 0000000000..8b3ed08c87
--- /dev/null
+++ b/roles/openshift-apps/waiverdb/files/buildconfig.yml
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: BuildConfig
+metadata:
+  name: "waiverdb-docker-build"
+  labels:
+    environment: "waiverdb"
+spec:
+  runPolicy: Serial
+  # This docker build exists only to layer some links ontop of the base waiverdb
+  # image from candidate-registry.fedoraproject.org
+  source:
+    dockerfile: |-
+      FROM waiverdb:latest
+      USER 0
+      RUN dnf -y install --setopt=tsflags=nodocs fedmsg && dnf -y clean all
+      # create a symlink for configuring fedmsg.
+      RUN ln -sfn /etc/fedmsg-waiverdb.d/waiverdb.py /etc/fedmsg.d/zz_waiverdb.py
+      # And another two for putting the certs in place.
+      RUN mkdir -p /etc/pki/fedmsg/
+      RUN ln -sf /etc/pki/fedmsg/key/fedmsg-waiverdb.key /etc/pki/fedmsg/waiverdb.key
+      RUN ln -sf /etc/pki/fedmsg/crt/fedmsg-waiverdb.crt /etc/pki/fedmsg/waiverdb.crt
+      # Make sure fedmsg can write its CRL.
+      RUN chmod 777 /var/run/fedmsg/
+      USER 1001
+  strategy:
+    type: Docker
+  output:
+    to:
+      kind: ImageStreamTag
+      name: waiverdb-deployment:latest
diff --git a/roles/openshift-apps/waiverdb/files/deploymentconfig.yml b/roles/openshift-apps/waiverdb/files/deploymentconfig.yml
index 4dd005fe4d..625dc6e788 100644
--- a/roles/openshift-apps/waiverdb/files/deploymentconfig.yml
+++ b/roles/openshift-apps/waiverdb/files/deploymentconfig.yml
@@ -19,7 +19,7 @@ spec:
     spec:
       containers:
       - name: web
-        image: waiverdb
+        image: waiverdb-deployment
         ports:
         - containerPort: 8080
         volumeMounts:
@@ -27,7 +27,7 @@ spec:
           mountPath: /etc/waiverdb
           readOnly: true
         - name: fedmsg-config-volume
-          mountPath: /etc/fedmsg.d
+          mountPath: /etc/fedmsg-waiverdb.d
           readOnly: true
         - name: secret-volume
           mountPath: /etc/secret
@@ -88,5 +88,5 @@ spec:
       - web
       from:
         kind: ImageStreamTag
-        name: waiverdb:latest
+        name: waiverdb-deployment:latest
   - type: ConfigChange