diff --git a/deploy/Dockerfile b/deploy/Dockerfile
new file mode 100644
index 0000000..81204e9
--- /dev/null
+++ b/deploy/Dockerfile
@@ -0,0 +1,38 @@
+# Prometheus service image.
+#
+# Built for the standalone docker-compose at deploy/docker-compose.yml, which
+# attaches to the hephaestus_default network so Hephaestus's Caddy can route
+# prometheus.x → prometheus:3700 without either side knowing about the other.
+#
+# node:22-alpine keeps the image small (~55 MB with deps) and gives us
+# node:sqlite (stable in 22+). We copy package files first so a code change
+# that leaves deps alone reuses the npm layer.
+
+FROM node:22-alpine
+
+RUN apk add --no-cache tini
+
+WORKDIR /opt/prometheus
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
+
+COPY service/   ./service/
+COPY public/    ./public/
+COPY scripts/   ./scripts/
+
+# /data holds everything that must survive a container rebuild: the SQLite
+# DB, the service's own ed25519 key, uploaded binaries and (for the snapshot
+# timer) the rendered static mirror.
+ENV PROMETHEUS_DB=/data/db.sqlite \
+    PROMETHEUS_KEY_DIR=/data/keys \
+    PROMETHEUS_UPLOAD_DIR=/data/uploads \
+    BIND=0.0.0.0 \
+    PORT=3700
+RUN mkdir -p /data/keys /data/uploads && chown -R node:node /data /opt/prometheus
+USER node
+
+EXPOSE 3700
+
+ENTRYPOINT ["/sbin/tini", "--"]
+CMD ["node", "service/server.js"]
diff --git a/deploy/docker-compose.yml b/deploy/docker-compose.yml
new file mode 100644
index 0000000..e02cdf0
--- /dev/null
+++ b/deploy/docker-compose.yml
@@ -0,0 +1,49 @@
+# Standalone compose for prometheus.x on the Hephaestus VPS.
+#
+# The service attaches to Hephaestus's existing docker network
+# (hephaestus_default), so Hephaestus's Caddy can route prometheus.x to
+# `prometheus:3700` with no changes to Hephaestus itself other than one new
+# block in its Caddyfile.
+#
+# One volume (`data`) holds the SQLite DB, the service's ed25519 signing
+# key, uploads that passed scan, and the snapshot build output. Env lives
+# in an .env file alongside this one; the ones below are the defaults and
+# can be overridden.
+
+name: prometheus
+
+services:
+  prometheus:
+    build:
+      context: ..
+      dockerfile: deploy/Dockerfile
+    image: prometheus:latest
+    restart: unless-stopped
+    environment:
+      BNS_NETWORK: chipnet
+      ADMIN_PUBLISHER: ${ADMIN_PUBLISHER:-}
+      VIRUSTOTAL_API_KEY: ${VIRUSTOTAL_API_KEY:-}
+      PAYMENT_REQUIRED: ${PAYMENT_REQUIRED:-}
+      PROMETHEUS_PAYMENT_ADDRESS: ${PROMETHEUS_PAYMENT_ADDRESS:-}
+      PROMETHEUS_LISTING_FEE_USD: ${PROMETHEUS_LISTING_FEE_USD:-1}
+      BNS_GATEWAY: ${BNS_GATEWAY:-}
+    volumes:
+      - data:/data
+    networks:
+      - hephaestus
+    expose:
+      - "3700"
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--spider", "http://127.0.0.1:3700/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 10s
+
+volumes:
+  data:
+
+networks:
+  hephaestus:
+    external: true
+    name: hephaestus_default