diff --git a/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml
new file mode 100644
index 0000000000..4dd714a5f2
--- /dev/null
+++ b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/deploy.yaml
@@ -0,0 +1,43 @@
+helmChartPath: charts/chat2db
+
+image:
+  repository: ghcr.io/hazyforge/chat2db
+  tag: sha-ffc6a41
+  digest: sha256:1f7d6beeddbb3a25cb463ce507f1c13f2fb6aeb821239032e0efa66678b13a57
+  pullPolicy: IfNotPresent
+
+imagePullSecrets:
+  - name: ghcr-creds
+
+persistence:
+  storageClassName: observability-local
+  accessModes:
+    - ReadWriteOnce
+  size: 10Gi
+
+encryptionKey:
+  existingSecret: chat2db-encryption-key
+  secretKey: encryption.key
+  mountPath: /run/secrets/chat2db-community-encryption.key
+
+cors:
+  allowedOrigin: https://chat2db.hazyforge.io
+
+resources:
+  requests:
+    cpu: 500m
+    memory: 1Gi
+  limits:
+    cpu: "2"
+    memory: 4Gi
+
+nodeSelector:
+  kubernetes.io/hostname: z400
+
+networkPolicy:
+  enabled: true
+  allowedIngress:
+    namespace: oauth2-proxy
+    podLabels:
+      app.kubernetes.io/name: oauth2-proxy
+      app.kubernetes.io/instance: chat2db
diff --git a/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/encryption-key-external-secret.yaml b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/encryption-key-external-secret.yaml
new file mode 100644
index 0000000000..904a7eff4c
--- /dev/null
+++ b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/encryption-key-external-secret.yaml
@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: chat2db-encryption-key
+  namespace: chat2db
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: azurekv-cluster-secret-store
+  target:
+    name: chat2db-encryption-key
+    creationPolicy: Owner
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        encryption.key: "{{ .encryptionKey }}"
+  data:
+    - secretKey: encryptionKey
+      remoteRef:
+        key: secret/chat2db-community-encryption-key
diff --git a/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/ghcr-creds-external-secret.yaml b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/ghcr-creds-external-secret.yaml
new file mode 100644
index 0000000000..1209cc8014
--- /dev/null
+++ b/.hazyforge/clusters/anvil-primaris/namespace/chat2db/manifests/ghcr-creds-external-secret.yaml
@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ghcr-creds
+  namespace: chat2db
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: azurekv-cluster-secret-store
+  target:
+    name: ghcr-creds
+    creationPolicy: Owner
+    template:
+      type: kubernetes.io/dockerconfigjson
+      data:
+        .dockerconfigjson: '{"auths":{"ghcr.io":{"username":"hazyforge","password":"{{ .pat }}","auth":"{{ printf "%s:%s" "hazyforge" .pat | b64enc }}"}}}'
+  data:
+    - secretKey: pat
+      remoteRef:
+        key: secret/anvil-primaris-ghcr-read-pat