diff --git a/docker-compose.komodo.yml b/docker-compose.komodo.yml
new file mode 100644
index 0000000..d5693ce
--- /dev/null
+++ b/docker-compose.komodo.yml
@@ -0,0 +1,33 @@
+# Courtside as managed by Komodo.
+#
+# Difference from docker-compose.yml: no bundled cloudflared. This deployment
+# sits behind an existing shared Cloudflare Tunnel that routes the public
+# hostname straight to the published host port below, so there is no second
+# tunnel or tunnel token to manage here.
+#
+# ADMIN_PASSWORD and SESSION_SECRET come from the Komodo stack's environment,
+# never from a file in this repo.
+services:
+  app:
+    build: .
+    image: courtside:latest
+    restart: unless-stopped
+    ports:
+      - "${HOST_PORT:-8090}:3000"
+    environment:
+      PORT: "3000"
+      DB_PATH: /data/courtside.sqlite
+      ADMIN_PASSWORD: ${ADMIN_PASSWORD}
+      SESSION_SECRET: ${SESSION_SECRET}
+      TRUST_CF_ACCESS: "${TRUST_CF_ACCESS:-false}"
+    volumes:
+      - courtside-data:/data
+    mem_limit: 512m
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:3000/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+volumes:
+  courtside-data: