diff --git a/manifests/automation/n8n.yaml b/manifests/automation/n8n.yaml
new file mode 100644
index 0000000..feb72e6
--- /dev/null
+++ b/manifests/automation/n8n.yaml
@@ -0,0 +1,83 @@
+# n8n workflow automation. Public (own auth, webhook URLs are secret-tokened)
+# — intentionally NOT behind the Authelia SSO gate, so external services
+# can trigger webhook automations.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: automation
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-data
+  namespace: automation
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: nfs-synology
+  resources:
+    requests: {storage: 10Gi}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n
+  namespace: automation
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels: {app: n8n}
+  template:
+    metadata:
+      labels: {app: n8n}
+    spec:
+      containers:
+        - name: n8n
+          image: n8nio/n8n:latest
+          env:
+            - {name: N8N_HOST, value: n8n.carr.pub}
+            - {name: N8N_PROTOCOL, value: https}
+            - {name: WEBHOOK_URL, value: "https://n8n.carr.pub/"}
+            - {name: GENERIC_TIMEZONE, value: America/Los_Angeles}
+            - {name: N8N_SECURE_COOKIE, value: "false"}
+          ports: [{containerPort: 5678}]
+          resources:
+            requests: {cpu: 100m, memory: 256Mi}
+            limits: {memory: 1Gi}
+          volumeMounts:
+            - {name: data, mountPath: /home/node/.n8n}
+      volumes:
+        - name: data
+          persistentVolumeClaim: {claimName: n8n-data}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: n8n
+  namespace: automation
+spec:
+  selector: {app: n8n}
+  ports:
+    - port: 5678
+      targetPort: 5678
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: n8n
+  namespace: automation
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+spec:
+  tls:
+    - hosts: [n8n.carr.pub]
+      secretName: n8n-carr-pub-tls
+  rules:
+    - host: n8n.carr.pub
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service: {name: n8n, port: {number: 5678}}