diff --git a/modules/ske/ske-starterkit/e2e/main.tf b/modules/ske/ske-starterkit/e2e/main.tf
index ed65d69d..afef4dd5 100644
--- a/modules/ske/ske-starterkit/e2e/main.tf
+++ b/modules/ske/ske-starterkit/e2e/main.tf
@@ -1,56 +1,79 @@
 variable "test_context" {
   type = object({
-    hub_git_ref          = string
-    workspace            = string
-    name_suffix          = string
-    forgejo_base_url     = string
-    forgejo_organization = string
-    dns_zone_name        = string
+    hub_git_ref = string
+    workspace   = string
+    name_suffix = string
+
+    # Mode discriminator: set in foundation mode to order an already-deployed BBD version;
+    # null in build-from-source mode, which builds the BBD from hub source.
+    bbd_version_ref = optional(object({
+      uuid = string
+    }))
+
+    # Build-from-source only: the starter kit BBD is composed from an ephemeral meshPlatform, a
+    # git-repository and a forgejo-connector this module stands up first. A foundation already
+    # deployed all of them, so it supplies none of these.
+    forgejo_base_url     = optional(string)
+    forgejo_organization = optional(string)
+    dns_zone_name        = optional(string)
   })
   nullable = false
 }
 
+# Secrets for the ephemeral backplane. Foundation mode builds no backplane and omits them.
 variable "stackit_git_forgejo_token" {
   type      = string
   sensitive = true
-  nullable  = false
+  default   = null
 }
 
 variable "ske_kubeconfig" {
   type        = string
   sensitive   = true
-  nullable    = false
+  default     = null
   description = "Kubeconfig for the SKE cluster (YAML or JSON), used by the Forgejo Connector building block."
 }
 
 variable "harbor_push_username" {
   type      = string
   sensitive = true
-  nullable  = false
+  default   = null
 }
 
 variable "harbor_push_password" {
   type      = string
   sensitive = true
-  nullable  = false
+  default   = null
 }
 
 variable "harbor_pull_username" {
   type      = string
   sensitive = true
-  nullable  = false
+  default   = null
 }
 
 variable "harbor_pull_password" {
   type      = string
   sensitive = true
-  nullable  = false
+  default   = null
 }
 
 locals {
+  build_from_source = var.test_context.bbd_version_ref == null
+
   # yamldecode parses both YAML (the ICF-published Vault value) and JSON (a superset), so it is
   # robust regardless of the format the kubeconfig secret is provided in.
-  ske_kubeconfig = yamldecode(var.ske_kubeconfig)
+  ske_kubeconfig = var.ske_kubeconfig != null ? yamldecode(var.ske_kubeconfig) : null
+}
+
+# Declared here rather than in a provider.tf: a foundation e2e unit generates its meshstack provider
+# into `provider.tf`, which would overwrite a file of that name shipped by this module. In foundation
+# mode nothing is created on the cluster, so an unconfigured provider is correct.
+provider "kubernetes" {
+  host                   = try(local.ske_kubeconfig["clusters"][0]["cluster"]["server"], null)
+  cluster_ca_certificate = try(base64decode(local.ske_kubeconfig["clusters"][0]["cluster"]["certificate-authority-data"]), null)
+  client_certificate     = try(base64decode(local.ske_kubeconfig["users"][0]["user"]["client-certificate-data"]), null)
+  client_key             = try(base64decode(local.ske_kubeconfig["users"][0]["user"]["client-key-data"]), null)
 }
 
 resource "random_string" "suffix" {
@@ -61,6 +84,7 @@ resource "random_string" "suffix" {
 }
 
 module "meshstack_kubernetes_platform" {
+  count  = local.build_from_source ? 1 : 0
   source = "./meshstack_kubernetes_platform"
 
   kube_host   = local.ske_kubeconfig["clusters"][0]["cluster"]["server"]
@@ -69,6 +93,7 @@ module "meshstack_kubernetes_platform" {
 }
 
 module "stackit_git_repository" {
+  count  = local.build_from_source ? 1 : 0
   source = "../../../stackit/git-repository"
   meshstack = {
     owning_workspace_identifier = var.test_context.workspace
@@ -96,6 +121,7 @@ module "stackit_git_repository" {
 }
 
 module "forgejo_connector" {
+  count  = local.build_from_source ? 1 : 0
   source = "../../forgejo-connector"
   meshstack = {
     owning_workspace_identifier = var.test_context.workspace
@@ -109,7 +135,7 @@ module "forgejo_connector" {
   kubeconfig                   = local.ske_kubeconfig
   forgejo_host                 = var.test_context.forgejo_base_url
   forgejo_api_token            = var.stackit_git_forgejo_token
-  forgejo_repo_definition_uuid = module.stackit_git_repository.building_block_definition.uuid
+  forgejo_repo_definition_uuid = module.stackit_git_repository[0].building_block_definition.uuid
   harbor_username              = var.harbor_push_username
   harbor_password              = var.harbor_push_password
 
@@ -128,6 +154,7 @@ module "forgejo_connector" {
 }
 
 module "ske_starterkit" {
+  count  = local.build_from_source ? 1 : 0
   source = "../"
   meshstack = {
     owning_workspace_identifier = var.test_context.workspace
@@ -138,15 +165,15 @@ module "ske_starterkit" {
     bbd_draft = true
   }
 
-  platform_ref           = module.meshstack_kubernetes_platform.platform_ref
-  landing_zone_refs      = module.meshstack_kubernetes_platform.landing_zone_refs
+  platform_ref           = module.meshstack_kubernetes_platform[0].platform_ref
+  landing_zone_refs      = module.meshstack_kubernetes_platform[0].landing_zone_refs
   repo_clone_addr        = "https://github.com/likvid-bank/starterkit-template-stackit-ai-summarizer.git"
   dns_zone_name          = var.test_context.dns_zone_name
   add_random_name_suffix = false
 
   building_block_definition_version_refs = {
-    "git-repository"    = module.stackit_git_repository.building_block_definition.version_ref
-    "forgejo-connector" = module.forgejo_connector.building_block_definition.version_ref
+    "git-repository"    = module.stackit_git_repository[0].building_block_definition.version_ref
+    "forgejo-connector" = module.forgejo_connector[0].building_block_definition.version_ref
   }
 
   project_tags = {
@@ -161,10 +188,24 @@ module "ske_starterkit" {
   }
 }
 
+locals {
+  version_ref = local.build_from_source ? module.ske_starterkit[0].building_block_definition.version_ref : var.test_context.bbd_version_ref
+}
+
 resource "meshstack_building_block" "this" {
+  # The building block (and its delete run) must be fully destroyed before the backplane it ran
+  # against is torn down — otherwise OpenTofu is free to remove the meshPlatform, the child
+  # definitions or the cluster credentials while the delete run still needs them.
+  depends_on = [
+    module.meshstack_kubernetes_platform,
+    module.stackit_git_repository,
+    module.forgejo_connector,
+    module.ske_starterkit,
+  ]
+
   wait_for_completion = true
   spec = {
-    building_block_definition_version_ref = module.ske_starterkit.building_block_definition.version_ref
+    building_block_definition_version_ref = { uuid = local.version_ref.uuid }
 
     display_name = "smoke-test-ske-starterkit-hub-${var.test_context.name_suffix}"
     target_ref = {
@@ -176,8 +217,6 @@ resource "meshstack_building_block" "this" {
       name = { value = jsonencode("smoke-test-${var.test_context.name_suffix}") }
     }
   }
-
-  depends_on = [module.meshstack_kubernetes_platform]
 }
 
 # Probe the deployed dev + prod app endpoints: reaching SUCCEEDED means the app was deployed, but
diff --git a/modules/ske/ske-starterkit/e2e/provider.tf b/modules/ske/ske-starterkit/e2e/provider.tf
deleted file mode 100644
index 42541712..00000000
--- a/modules/ske/ske-starterkit/e2e/provider.tf
+++ /dev/null
@@ -1,6 +0,0 @@
-provider "kubernetes" {
-  host                   = yamldecode(var.ske_kubeconfig)["clusters"][0]["cluster"]["server"]
-  cluster_ca_certificate = base64decode(yamldecode(var.ske_kubeconfig)["clusters"][0]["cluster"]["certificate-authority-data"])
-  client_certificate     = base64decode(yamldecode(var.ske_kubeconfig)["users"][0]["user"]["client-certificate-data"])
-  client_key             = base64decode(yamldecode(var.ske_kubeconfig)["users"][0]["user"]["client-key-data"])
-}
\ No newline at end of file