diff --git a/README.md b/README.md
index 8bb6fab99..5f82bdb15 100644
--- a/README.md
+++ b/README.md
@@ -106,6 +106,18 @@ ls output/
 apisix-runtime_1.0.0-0~ubuntu20.04_amd64.deb
 ```
 
+### ngx_http_ffi_client
+
+`ngx_http_ffi_client` is the C HTTP client the AI plugins use for outbound LLM
+requests. The version is pinned by `ngx_http_ffi_client_ver` in
+`build-apisix-runtime.sh`, as it is for every other module. Set it to build
+against a different tag or branch:
+
+```sh
+ngx_http_ffi_client_ver=v0.2.0 \
+  make package type=deb app=apisix-runtime version=1.0.0
+```
+
 ## Details
 
 - `Makefile` the entrance of the packager
diff --git a/build-apisix-runtime.sh b/build-apisix-runtime.sh
index fa231d529..c301711b1 100755
--- a/build-apisix-runtime.sh
+++ b/build-apisix-runtime.sh
@@ -36,6 +36,12 @@ fi
 wasm_nginx_module_ver="0.7.0"
 lua_var_nginx_module_ver="v0.5.3"
 lua_resty_events_ver="0.2.0"
+ngx_http_ffi_client_ver=${ngx_http_ffi_client_ver:-"v0.1.0"}
+if [[ ! "$ngx_http_ffi_client_ver" =~ ^[A-Za-z0-9._/-]+$ ]]; then
+    echo "ERROR: invalid ngx_http_ffi_client_ver: $ngx_http_ffi_client_ver" >&2
+    exit 1
+fi
+ngx_http_ffi_client_dir="ngx_http_ffi_client-${ngx_http_ffi_client_ver}"
 
 
 install_openssl_3(){
@@ -134,6 +140,14 @@ else
         lua-var-nginx-module-${lua_var_nginx_module_ver}
 fi
 
+if [ "$repo" == ngx_http_ffi_client ]; then
+    cp -r "$prev_workdir" "./$ngx_http_ffi_client_dir"
+else
+    git clone --depth=1 -b "$ngx_http_ffi_client_ver" \
+        https://github.com/api7/ngx_http_ffi_client.git \
+        "$ngx_http_ffi_client_dir"
+fi
+
 cd ngx_multi_upstream_module-${ngx_multi_upstream_module_ver} || exit 1
 ./patch.sh ../openresty-${OPENRESTY_VERSION}
 cd ..
@@ -165,6 +179,11 @@ else
 fi
 
 
+# ngx_http_ffi_client compiles against lua-nginx-module's public API, which it
+# reaches through the bundled copy rather than a separate checkout.
+ngx_lua_bundle_dir=$(find bundle -maxdepth 1 -type d -name 'ngx_lua-*' | head -n 1)
+export NGX_HTTP_LUA_MODULE_DIR="$PWD/$ngx_lua_bundle_dir"
+
 ./configure --prefix="$OR_PREFIX" \
     --with-cc-opt="-DAPISIX_RUNTIME_VER=$runtime_version $cc_opt" \
     --with-ld-opt="-Wl,-rpath,$OR_PREFIX/wasmtime-c-api/lib $ld_opt" \
@@ -177,6 +196,7 @@ fi
     --add-module=../wasm-nginx-module-${wasm_nginx_module_ver} \
     --add-module=../lua-var-nginx-module-${lua_var_nginx_module_ver} \
     --add-module=../lua-resty-events-${lua_resty_events_ver} \
+    --add-module=../${ngx_http_ffi_client_dir} \
     --with-poll_module \
     --with-pcre-jit \
     --without-http_rds_json_module \
@@ -220,6 +240,11 @@ sudo install -d "$OR_PREFIX"/lualib/resty/events/compat/
 sudo install -m 644 lualib/resty/events/compat/*.lua "$OR_PREFIX"/lualib/resty/events/compat/
 cd ..
 
+# the C module needs its FFI bindings on the runtime's lua_package_path
+sudo install -d "$OR_PREFIX"/lualib/resty/
+sudo install -m 644 "$ngx_http_ffi_client_dir"/lib/resty/ngx_http_ffi_client.lua \
+    "$OR_PREFIX"/lualib/resty/
+
 cd "apisix-nginx-module-${apisix_nginx_module_ver}" || exit 1
 sudo OPENRESTY_PREFIX="$OR_PREFIX" make install
 cd ..