diff --git a/k8s/argocd/apps/00-strimzi-operator.yaml b/k8s/argocd/apps/00-strimzi-operator.yaml
new file mode 100644
index 0000000..48d92d5
--- /dev/null
+++ b/k8s/argocd/apps/00-strimzi-operator.yaml
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: strimzi-operator
+  namespace: cicd
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+spec:
+  project: kmsvc
+  source:
+    repoURL: https://strimzi.io/charts/
+    chart: strimzi-kafka-operator
+    targetRevision: 0.46.0
+    helm:
+      values: |
+        watchNamespaces: ["sqs"]
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sqs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/k8s/argocd/apps/01-kafka-cluster.yaml b/k8s/argocd/apps/01-kafka-cluster.yaml
new file mode 100644
index 0000000..a27d542
--- /dev/null
+++ b/k8s/argocd/apps/01-kafka-cluster.yaml
@@ -0,0 +1,31 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kafka-cluster
+  namespace: cicd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: kmsvc
+  source:
+    repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
+    targetRevision: main
+    path: k8s/charts/kafka-cluster
+    helm:
+      values: |
+        namespace: sqs
+        nodePool:
+          replicas: 3
+          storage:
+            class: longhorn
+            sizeGi: 50
+          resources:
+            memory: 5Gi
+            cpu: "2"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sqs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/k8s/argocd/apps/02-redis.yaml b/k8s/argocd/apps/02-redis.yaml
new file mode 100644
index 0000000..e1076a3
--- /dev/null
+++ b/k8s/argocd/apps/02-redis.yaml
@@ -0,0 +1,43 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kmsvc-redis
+  namespace: cicd
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: kmsvc
+  source:
+    repoURL: https://charts.bitnami.com/bitnami
+    chart: redis
+    targetRevision: 20.6.0
+    helm:
+      values: |
+        architecture: standalone
+        # docker.io/bitnami stopped publishing version-pinned tags; bitnamilegacy
+        # mirrors them for free. allowInsecureImages silences the chart's
+        # container-image allowlist check, which doesn't know about that mirror.
+        global:
+          security:
+            allowInsecureImages: true
+        image:
+          repository: bitnamilegacy/redis
+        auth:
+          enabled: false
+        master:
+          persistence:
+            enabled: true
+            storageClass: longhorn
+            size: 2Gi
+          resources:
+            limits:
+              memory: 1Gi
+            requests:
+              memory: 1Gi
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sqs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/k8s/argocd/apps/03-queue-crd.yaml b/k8s/argocd/apps/03-queue-crd.yaml
new file mode 100644
index 0000000..495d309
--- /dev/null
+++ b/k8s/argocd/apps/03-queue-crd.yaml
@@ -0,0 +1,30 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: queue-crd
+  namespace: cicd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: kmsvc
+  source:
+    repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
+    targetRevision: main
+    path: k8s/charts/queue-crd
+    helm:
+      values: |
+        namespace: sqs
+        kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
+        redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
+        image:
+          repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service-queue-operator
+          # CI (.forgejo/workflows/release.yaml) writes the released git tag
+          # here and pushes the commit -- ArgoCD picks it up on its next sync.
+          tag: latest
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sqs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/k8s/argocd/apps/04-management-service.yaml b/k8s/argocd/apps/04-management-service.yaml
new file mode 100644
index 0000000..3ffac2c
--- /dev/null
+++ b/k8s/argocd/apps/04-management-service.yaml
@@ -0,0 +1,37 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: management-service
+  namespace: cicd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: kmsvc
+  source:
+    repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
+    targetRevision: main
+    path: k8s/charts/management-service
+    helm:
+      values: |
+        namespace: sqs
+        image:
+          repository: forgejo.riotpiao.homelab.com/rock/kafka-management-service
+          # CI (.forgejo/workflows/release.yaml) writes the released git tag
+          # here and pushes the commit -- ArgoCD picks it up on its next sync.
+          tag: latest
+        env:
+          kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
+          redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
+          authentikIssuerURL: "https://authentik.riotpiao.homelab.com/application/o/kafaka/"
+          authentikAudience: "QI0gPtR99ar8VvhK8Tqox4SDkTKzbNU7lbgwBNSc"
+        ingress:
+          enabled: true
+          host: kmsvc.homelab.internal
+          clusterIssuer: homelab-ca
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sqs
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
diff --git a/k8s/argocd/project.yaml b/k8s/argocd/project.yaml
new file mode 100644
index 0000000..062b2d6
--- /dev/null
+++ b/k8s/argocd/project.yaml
@@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: kmsvc
+  namespace: cicd
+spec:
+  description: Kafka Management Service (design.md) -- Strimzi/Kafka, Redis, queue-operator, message-plane server
+  sourceRepos:
+    - https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
+    - https://strimzi.io/charts/
+    - https://charts.bitnami.com/bitnami
+  destinations:
+    - namespace: sqs
+      server: https://kubernetes.default.svc
+    - namespace: cicd
+      server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+    - group: "apiextensions.k8s.io"
+      kind: CustomResourceDefinition
+    - group: "rbac.authorization.k8s.io"
+      kind: ClusterRole
+    - group: "rbac.authorization.k8s.io"
+      kind: ClusterRoleBinding
diff --git a/k8s/argocd/root.yaml b/k8s/argocd/root.yaml
new file mode 100644
index 0000000..240b1b0
--- /dev/null
+++ b/k8s/argocd/root.yaml
@@ -0,0 +1,22 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kmsvc-root
+  namespace: cicd
+spec:
+  project: kmsvc
+  source:
+    repoURL: https://forgejo.riotpiao.homelab.com/rock/kafaka-management-service.git
+    targetRevision: main
+    path: k8s/argocd/apps
+    directory:
+      recurse: false
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cicd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true