diff --git a/README.md b/README.md
index 16f8957..4779e23 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,7 @@ Public container images for cloud work, built multi-arch and rootless with secur
 | `ghcr.io/cloudsnacks/dev-desktop` | Arch Linux dev workstation with Hyprland streamed over [Sunshine](https://github.com/LizardByte/Sunshine)/Moonlight, cloud tooling, and AI coding agents (`linux/amd64` only, needs `/dev/dri`) |
 | `ghcr.io/cloudsnacks/infisical-mcp` | Infisical MCP server (secrets management over MCP) |
 | `ghcr.io/cloudsnacks/kubectl` | Rootless kubectl CLI |
+| `ghcr.io/cloudsnacks/litellm` | LiteLLM proxy (non_root), our canonical build with mlflow added for the built-in mlflow logging callback |
 | `ghcr.io/cloudsnacks/rrda` | JSON REST API for DNS queries, wrapping a resolver over HTTP |
 | `ghcr.io/cloudsnacks/sandbox-agent` | Rootless base image for sandboxed coding agents (Node, Python, uv, git, gh, ripgrep) |
 
diff --git a/images/litellm/Dockerfile b/images/litellm/Dockerfile
new file mode 100644
index 0000000..49a1a85
--- /dev/null
+++ b/images/litellm/Dockerfile
@@ -0,0 +1,26 @@
+# renovate: datasource=docker depName=ghcr.io/astral-sh/uv
+FROM ghcr.io/astral-sh/uv:0.12.3@sha256:2d890623d310b57771ce840f0da5eed5fc6d657da05ffaa45d82797b53fa3abc AS uv
+
+# renovate: datasource=docker depName=ghcr.io/berriai/litellm-non_root
+FROM ghcr.io/berriai/litellm-non_root:v1.95.0@sha256:d5233c80ef7e28fd789b93c15e41fc0c86c6dfdf6ecbe1ef3f4c8ee2498f3827
+
+# renovate: datasource=pypi depName=mlflow
+ARG MLFLOW_VERSION=3.15.1
+
+USER root
+
+# Upstream's uv-managed /app/.venv ships no pip, so mlflow (needed for
+# litellm_settings.success_callback/failure_callback: ["mlflow"]) is added
+# with uv directly against that venv's interpreter. Re-chmod afterwards:
+# the base image keeps /app/.venv world-readable so it works under any
+# runAsUser, and installing as root would otherwise leave the new files
+# owner-only.
+COPY --from=uv /uv /usr/local/bin/uv
+RUN uv pip install --python /app/.venv/bin/python3 "mlflow==${MLFLOW_VERSION}" \
+    && rm /usr/local/bin/uv \
+    && chmod -R o+rX /app/.venv \
+    && /app/.venv/bin/python3 -c "import mlflow; print(mlflow.__version__)"
+
+USER 65534
+
+LABEL org.opencontainers.image.description="LiteLLM proxy (non_root), our canonical build with mlflow added for the built-in mlflow logging callback"
diff --git a/images/litellm/metadata.yaml b/images/litellm/metadata.yaml
new file mode 100644
index 0000000..e89bc59
--- /dev/null
+++ b/images/litellm/metadata.yaml
@@ -0,0 +1,8 @@
+---
+name: litellm
+description: LiteLLM proxy (non_root), our canonical build with mlflow added for the built-in mlflow logging callback
+version: 1.0.0
+platforms:
+  - linux/amd64
+  - linux/arm64
+test: python3 -c "import litellm, mlflow" && litellm --version && test "$(id -u)" != "0"