diff --git a/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/.terraform.lock.hcl b/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/.terraform.lock.hcl
new file mode 100644
index 0000000..881c006
--- /dev/null
+++ b/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/.terraform.lock.hcl
@@ -0,0 +1,20 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/meshcloud/meshstack" {
+  version     = "0.25.1"
+  constraints = ">= 0.24.0"
+  hashes = [
+    "h1:APu9seA9rU0BTQN4FB/5FUI6rKQmoVWaQUR3L1d7i/A=",
+    "h1:VEHUb/J/VvxmRjaXTgRJ/lNvJnpfC6MLHj4JYyJiEyU=",
+    "h1:leFJuSNvRJH9VN4tBd+/6EUm/wA9sWlmEshtps0z8Lk=",
+    "h1:sa27psDP1BfYSAUKBjmtQB4OHiiskGtCR9cQlwIQw0w=",
+    "h1:zC7zwqgv+gmxw4nF3rf4nXuuqoO681EtxbgYdez9wYg=",
+    "zh:02a49f005a7ad45e1ceb4d67bef4f1567a0350edd241b28eb5ee0febcecdf952",
+    "zh:0d1c25cffd7eb5910b32294e089d9f6e6af9ae49e9bf2f49947a33ace993d16a",
+    "zh:6b32cce5008c658d38e6e24e304e99467e14be150744b45a5180fe7da713fe6b",
+    "zh:6db1ef40bae68a5a5375f79773270a16f4fccd3d3155eddaa1ff174c270146c4",
+    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
+    "zh:c39b50ca6dbe717b8fb0b2747874d7be21b09461917b3bce95302edaf6173818",
+  ]
+}
diff --git a/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/main.tf b/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/main.tf
new file mode 100644
index 0000000..a156b27
--- /dev/null
+++ b/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/main.tf
@@ -0,0 +1,63 @@
+# Owns every resource the workspace-starterkit building block creates or deletes on the
+# admin-scoped provider it authenticates with (see modules/meshstack/workspace-starterkit).
+# Created here instead of injected from the environment so no admin credential needs to be
+# provisioned or rotated by hand.
+resource "meshstack_api_key" "workspace_starterkit_admin" {
+  metadata = {
+    owned_by_workspace = "meshcloud"
+  }
+
+  spec = {
+    display_name = "workspace-starterkit-admin"
+    permissions = [
+      "ADM_WORKSPACE_SAVE", "ADM_WORKSPACE_LIST", "ADM_WORKSPACE_DELETE",
+      "ADM_PAYMENTMETHOD_SAVE", "ADM_PAYMENTMETHOD_LIST", "ADM_PAYMENTMETHOD_DELETE",
+      "ADM_PROJECT_SAVE", "ADM_PROJECT_LIST", "ADM_PROJECT_DELETE",
+      "ADM_TENANT_SAVE", "ADM_TENANT_LIST", "ADM_TENANT_DELETE",
+      "ADM_WORKSPACEPRINCIPALBINDING_SAVE", "ADM_WORKSPACEPRINCIPALBINDING_LIST", "ADM_WORKSPACEPRINCIPALBINDING_DELETE",
+      "ADM_PROJECTPRINCIPALROLE_SAVE", "ADM_PROJECTPRINCIPALROLE_LIST", "ADM_PROJECTPRINCIPALROLE_DELETE",
+    ]
+  }
+}
+
+locals {
+  hub = {
+    git_ref = "e7ce957b33283b257e073d6b81f0e95d0f5fd546"
+    # Vital: keeps this BBD in draft. A draft BBD is only orderable from its owning workspace
+    # (meshcloud), never published to the marketplace — we want this hidden, not offered generally.
+    bbd_draft = true
+  }
+}
+
+module "workspace_starterkit" {
+  source = "github.com/meshcloud/meshstack-hub//modules/meshstack/workspace-starterkit?ref=${local.hub.git_ref}"
+
+  meshstack = {
+    owning_workspace_identifier = "meshcloud"
+    tags = {
+      # Required: meshStack's "Restrict BuildingBlockDefinitions by Company" policy
+      # requires this BBD's Company tag to intersect with its owning workspace's (meshcloud's)
+      # Company=stackit-university tag, or creating the BBD fails outright. This is unrelated to
+      # ordering visibility, which bbd_draft above is what actually controls (kept hidden).
+      building_block = { Company = ["stackit-university"] }
+      # The STACKIT Sandbox landing zone is itself tagged Company=stackit-university and enforces
+      # a "Restrict LandingZones by Company" policy: any workspace placing a tenant there must share
+      # that tag. Every workspace this building block creates needs it to be able to order a tenant
+      # on that landing zone.
+      workspace      = { Company = ["stackit-university"] }
+      payment_method = {}
+      project        = {}
+    }
+  }
+
+  hub = local.hub
+
+  # STACKIT University sandbox: every onboarded team gets a project+tenant here.
+  platform_uuid     = "b66e3542-5887-4d48-9f06-968dbc98d97c"
+  landing_zone_name = "stackit-sandbox-default"
+
+  meshstack_admin_api_key    = meshstack_api_key.workspace_starterkit_admin.status.client_id
+  meshstack_admin_api_secret = meshstack_api_key.workspace_starterkit_admin.status.client_secret
+
+  workspace_expiry_tag_key = "TrialEnd"
+}
diff --git a/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/terragrunt.hcl b/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/terragrunt.hcl
new file mode 100644
index 0000000..72d588c
--- /dev/null
+++ b/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/terragrunt.hcl
@@ -0,0 +1,15 @@
+include "common" {
+  path = find_in_parent_folders("common.hcl")
+}
+
+generate "provider" {
+  path      = "provider.tf"
+  if_exists = "overwrite"
+  contents  = <<EOF
+provider "meshstack" {
+  endpoint  = "https://api.try.meshstack.io"
+  apikey    = "a17b9ad7-14c8-44cc-94ef-cb6b4db7ac8a"
+  apisecret = "${get_env("MESHSTACK_API_SECRET_AKS_IDP")}"
+}
+EOF
+}
diff --git a/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/versions.tf b/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/versions.tf
new file mode 100644
index 0000000..c34e998
--- /dev/null
+++ b/foundations/meshstack-trial/platforms/stackit/buildingblocks/workspace-starterkit/versions.tf
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.12.0"
+
+  required_providers {
+    meshstack = {
+      source  = "meshcloud/meshstack"
+      version = ">= 0.24.0"
+    }
+  }
+}