diff --git a/k8s-ng/core-state/values.yaml b/k8s-ng/core-state/values.yaml
index 66ca5b5..9030be6 100644
--- a/k8s-ng/core-state/values.yaml
+++ b/k8s-ng/core-state/values.yaml
@@ -53,6 +53,11 @@ apps:
     namespace: keycloak
     wave: 3
     skipDryRunOnMissingResource: true # ExternalSecret/Certificate CRDs come from earlier waves
+  - name: furumi
+    path: k8s-ng/core/furumi
+    namespace: furumi
+    wave: 5 # pinned to the music node; must not hold back the other waves
+    skipDryRunOnMissingResource: true
   - name: secret-stores
     path: k8s-ng/core/secret-stores
     namespace: external-secrets
diff --git a/k8s-ng/core/furumi/deployment.yaml b/k8s-ng/core/furumi/deployment.yaml
new file mode 100644
index 0000000..34c6730
--- /dev/null
+++ b/k8s-ng/core/furumi/deployment.yaml
@@ -0,0 +1,50 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-player
+  labels:
+    app: furumi-player
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate # the library is a hostPath on a single node
+  selector:
+    matchLabels:
+      app: furumi-player
+  template:
+    metadata:
+      labels:
+        app: furumi-player
+      annotations:
+        reloader.stakater.com/auto: "true"
+    spec:
+      # The music library lives on this node's /data (LVM raid, not replicated).
+      nodeSelector:
+        kubernetes.io/hostname: music
+      containers:
+        - name: furumi-player
+          image: ultradesu/furumusic:latest
+          imagePullPolicy: Always
+          env:
+            - name: FURU_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-creds
+                  key: PG_STRING
+          ports:
+            - name: http
+              containerPort: 8000
+          volumeMounts:
+            - name: library
+              mountPath: /media
+            - name: inbox
+              mountPath: /inbox
+      volumes:
+        - name: library
+          hostPath:
+            path: /data/furumi/library
+            type: Directory
+        - name: inbox
+          hostPath:
+            path: /data/furumi/inbox
+            type: Directory
diff --git a/k8s-ng/core/furumi/ingress.yaml b/k8s-ng/core/furumi/ingress.yaml
new file mode 100644
index 0000000..d888eda
--- /dev/null
+++ b/k8s-ng/core/furumi/ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: music.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-player
+                port:
+                  number: 8000
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - music.hexor.cy
diff --git a/k8s-ng/core/furumi/kustomization.yaml b/k8s-ng/core/furumi/kustomization.yaml
new file mode 100644
index 0000000..267f514
--- /dev/null
+++ b/k8s-ng/core/furumi/kustomization.yaml
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - secrets.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
diff --git a/k8s-ng/core/furumi/secrets.yaml b/k8s-ng/core/furumi/secrets.yaml
new file mode 100644
index 0000000..019f17a
--- /dev/null
+++ b/k8s-ng/core/furumi/secrets.yaml
@@ -0,0 +1,47 @@
+# Read-only access to the furumi-db Secret in the psql namespace
+# (see postgresql/databases/furumi.yaml for the other half).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: db-credentials-reader
+---
+apiVersion: external-secrets.io/v1
+kind: SecretStore
+metadata:
+  name: psql-credentials
+spec:
+  provider:
+    kubernetes:
+      remoteNamespace: psql
+      server:
+        caProvider:
+          type: ConfigMap
+          name: kube-root-ca.crt
+          key: ca.crt
+      auth:
+        serviceAccount:
+          name: db-credentials-reader
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: furumi-creds
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: SecretStore
+    name: psql-credentials
+  target:
+    name: furumi-creds
+    template:
+      data:
+        PG_STRING: "postgresql://{{ .username }}:{{ .password }}@main-rw.psql.svc:5432/furumi"
+  data:
+    - secretKey: username
+      remoteRef:
+        key: furumi-db
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: furumi-db
+        property: password
diff --git a/k8s-ng/core/furumi/service.yaml b/k8s-ng/core/furumi/service.yaml
new file mode 100644
index 0000000..4fa4873
--- /dev/null
+++ b/k8s-ng/core/furumi/service.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-player
+  labels:
+    app: furumi-player
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-player
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8000
+      targetPort: 8000