diff --git a/services/vault/scripts/vault_k8s_auth_configure.sh b/services/vault/scripts/vault_k8s_auth_configure.sh
index 9c9e89c55..b41163473 100644
--- a/services/vault/scripts/vault_k8s_auth_configure.sh
+++ b/services/vault/scripts/vault_k8s_auth_configure.sh
@@ -253,7 +253,7 @@ write_policy_and_role "health" "health" "health-vault-sync" \
   "health/*" ""
 write_policy_and_role "game-stream" "game-stream" "game-stream-vault" \
   "game-stream/*" ""
-write_policy_and_role "veles" "veles" "veles-backend,veles-postgres,veles-vault-sync" \
+write_policy_and_role "veles" "veles" "veles-backend,veles-generator,veles-postgres,veles-vault-sync" \
   "veles/* shared/harbor-pull shared/postmark-relay" ""
 write_policy_and_role "veles-sim" "veles" "veles-sim" \
   "veles/codex-cli" ""
diff --git a/services/veles/backend-deployment.yaml b/services/veles/backend-deployment.yaml
index 4084897e6..3c30088b0 100644
--- a/services/veles/backend-deployment.yaml
+++ b/services/veles/backend-deployment.yaml
@@ -22,7 +22,7 @@ spec:
       labels:
         app: veles-backend
       annotations:
-        veles.bstein.dev/redeploy: "2026-07-23-0.7.64-source-hygiene"
+        veles.bstein.dev/redeploy: "2026-07-24-0.7.65-hygiene-generator-worker"
         vault.hashicorp.com/agent-inject: "true"
         vault.hashicorp.com/agent-init-first: "true"
         vault.hashicorp.com/agent-pre-populate-only: "true"
@@ -63,7 +63,7 @@ spec:
           type: RuntimeDefault
       initContainers:
         - name: database-init
-          image: registry.bstein.dev/veles/veles-backend:0.7.64 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.7.65 # {"$imagepolicy": "veles:veles-backend"}
           imagePullPolicy: Always
           command: ["/bin/sh", "-c"]
           args:
@@ -85,7 +85,7 @@ spec:
               memory: 512Mi
       containers:
         - name: backend
-          image: registry.bstein.dev/veles/veles-backend:0.7.64 # {"$imagepolicy": "veles:veles-backend"}
+          image: registry.bstein.dev/veles/veles-backend:0.7.65 # {"$imagepolicy": "veles:veles-backend"}
           imagePullPolicy: Always
           command: ["/bin/sh", "-c"]
           args:
diff --git a/services/veles/oneoffs/veles-secrets-ensure-job.yaml b/services/veles/bootstrap-jobs/veles-secrets-ensure-job.yaml
similarity index 99%
rename from services/veles/oneoffs/veles-secrets-ensure-job.yaml
rename to services/veles/bootstrap-jobs/veles-secrets-ensure-job.yaml
index 92221bc40..f22da3236 100644
--- a/services/veles/oneoffs/veles-secrets-ensure-job.yaml
+++ b/services/veles/bootstrap-jobs/veles-secrets-ensure-job.yaml
@@ -1,4 +1,4 @@
-# services/veles/oneoffs/veles-secrets-ensure-job.yaml
+# services/veles/bootstrap-jobs/veles-secrets-ensure-job.yaml
 # One-off job for veles/veles-secrets-ensure-2.
 # Purpose: seed Veles Vault paths before app/Postgres pods are scaled up.
 # Keep suspended until the veles Vault role has reconciled, then unsuspend once.
diff --git a/services/veles/configmap.yaml b/services/veles/configmap.yaml
index 81a59ccc6..1b8b6251d 100644
--- a/services/veles/configmap.yaml
+++ b/services/veles/configmap.yaml
@@ -18,8 +18,9 @@ data:
   VELES_OIDC_REQUIRED_GROUPS: alpha,veles-tester,admin
   VELES_OIDC_ADMIN_GROUPS: admin
   VELES_NAMESPACE: veles
-  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.7.64 # {"$imagepolicy": "veles:veles-sim-worker"}
-  VELES_SIM_WORKER_VERSION: "0.7.64"
+  VELES_SIM_IMAGE: registry.bstein.dev/veles/veles-sim-worker:0.7.65 # {"$imagepolicy": "veles:veles-sim-worker"}
+  VELES_SIM_WORKER_VERSION: "0.7.65"
+  VELES_GENERATOR_WORKER_VERSION: "0.7.65"
   VELES_SIM_SERVICE_ACCOUNT: veles-sim
   VELES_SIM_PRIORITY_CLASS: veles-sim
   VELES_SIM_NODE_SELECTOR: veles.bstein.dev/node-pool=oceanus,kubernetes.io/arch=amd64
diff --git a/services/veles/frontend-deployment.yaml b/services/veles/frontend-deployment.yaml
index b8a00256b..5b1aec44b 100644
--- a/services/veles/frontend-deployment.yaml
+++ b/services/veles/frontend-deployment.yaml
@@ -48,7 +48,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: frontend
-          image: registry.bstein.dev/veles/veles-frontend:0.7.64 # {"$imagepolicy": "veles:veles-frontend"}
+          image: registry.bstein.dev/veles/veles-frontend:0.7.65 # {"$imagepolicy": "veles:veles-frontend"}
           imagePullPolicy: Always
           ports:
             - name: http
diff --git a/services/veles/generator-deployment.yaml b/services/veles/generator-deployment.yaml
new file mode 100644
index 000000000..8aab002f2
--- /dev/null
+++ b/services/veles/generator-deployment.yaml
@@ -0,0 +1,84 @@
+# services/veles/generator-deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: veles-generator-worker
+  namespace: veles
+  labels:
+    app: veles-generator-worker
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: veles-generator-worker
+  template:
+    metadata:
+      labels:
+        app: veles-generator-worker
+      annotations:
+        veles.bstein.dev/redeploy: "2026-07-24-0.7.65-hygiene-generator-worker"
+        vault.hashicorp.com/agent-inject: "true"
+        vault.hashicorp.com/agent-init-first: "true"
+        vault.hashicorp.com/agent-pre-populate-only: "true"
+        vault.hashicorp.com/role: "veles"
+        vault.hashicorp.com/agent-inject-secret-veles-env.sh: "kv/data/atlas/veles/veles-db"
+        vault.hashicorp.com/agent-inject-template-veles-env.sh: |
+          {{- with secret "kv/data/atlas/veles/veles-db" }}
+          unset DATABASE_URL
+          export VELES_DATABASE_HOST="{{ .Data.data.POSTGRES_HOST }}"
+          export VELES_DATABASE_PORT="{{ .Data.data.POSTGRES_PORT }}"
+          export VELES_DATABASE_NAME="{{ .Data.data.POSTGRES_DB }}"
+          export VELES_DATABASE_USER="{{ .Data.data.POSTGRES_USER }}"
+          export VELES_DATABASE_PASSWORD="{{ .Data.data.POSTGRES_PASSWORD }}"
+          export VELES_DATABASE_SSLMODE="disable"
+          {{- end }}
+          {{- with secret "kv/data/atlas/veles/app-secrets" }}
+          export VELES_SESSION_SECRET="{{ .Data.data.VELES_SESSION_SECRET }}"
+          export VELES_BYOK_ENCRYPTION_KEY="{{ .Data.data.VELES_BYOK_ENCRYPTION_KEY }}"
+          {{- end }}
+    spec:
+      serviceAccountName: veles-generator
+      priorityClassName: veles-core
+      nodeSelector:
+        veles.bstein.dev/node-pool: oceanus
+        kubernetes.io/arch: amd64
+      tolerations:
+        - key: veles.bstein.dev/simulation
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
+      securityContext:
+        fsGroup: 10001
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: generator
+          image: registry.bstein.dev/veles/veles-generator-worker:0.7.65 # {"$imagepolicy": "veles:veles-generator-worker"}
+          imagePullPolicy: Always
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -eu
+              if [ -f /vault/secrets/veles-env.sh ]; then
+                . /vault/secrets/veles-env.sh
+              fi
+              exec veles-generation-worker --loop --idle-sleep-seconds 5
+          envFrom:
+            - configMapRef:
+                name: veles-config
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 2Gi
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 10001
+            runAsGroup: 10001
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: ["ALL"]
diff --git a/services/veles/image.yaml b/services/veles/image.yaml
index f038856aa..27efb87f7 100644
--- a/services/veles/image.yaml
+++ b/services/veles/image.yaml
@@ -47,6 +47,29 @@ spec:
 ---
 apiVersion: image.toolkit.fluxcd.io/v1
 kind: ImageRepository
+metadata:
+  name: veles-generator-worker
+  namespace: veles
+spec:
+  image: registry.bstein.dev/veles/veles-generator-worker
+  interval: 1m0s
+  secretRef:
+    name: harbor-regcred
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: veles-generator-worker
+  namespace: veles
+spec:
+  imageRepositoryRef:
+    name: veles-generator-worker
+  policy:
+    semver:
+      range: ">=0.1.0-0"
+---
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
 metadata:
   name: veles-sim-worker
   namespace: veles
diff --git a/services/veles/kustomization.yaml b/services/veles/kustomization.yaml
index 764438c1e..38db5252b 100644
--- a/services/veles/kustomization.yaml
+++ b/services/veles/kustomization.yaml
@@ -16,8 +16,9 @@ resources:
   - postgres-statefulset.yaml
   - services.yaml
   - backend-deployment.yaml
+  - generator-deployment.yaml
   - frontend-deployment.yaml
   - retention-cronjob.yaml
   - image.yaml
   - ingress.yaml
-  - oneoffs/veles-secrets-ensure-job.yaml
+  - bootstrap-jobs/veles-secrets-ensure-job.yaml
diff --git a/services/veles/retention-cronjob.yaml b/services/veles/retention-cronjob.yaml
index 0dbe0a35a..480dab9ac 100644
--- a/services/veles/retention-cronjob.yaml
+++ b/services/veles/retention-cronjob.yaml
@@ -37,7 +37,7 @@ spec:
               type: RuntimeDefault
           containers:
             - name: retention
-              image: registry.bstein.dev/veles/veles-backend:0.7.64 # {"$imagepolicy": "veles:veles-backend"}
+              image: registry.bstein.dev/veles/veles-backend:0.7.65 # {"$imagepolicy": "veles:veles-backend"}
               imagePullPolicy: IfNotPresent
               command: ["veles-hygiene"]
               args: ["--prune-artifacts"]
diff --git a/services/veles/serviceaccounts.yaml b/services/veles/serviceaccounts.yaml
index c14ff0f8d..313781ead 100644
--- a/services/veles/serviceaccounts.yaml
+++ b/services/veles/serviceaccounts.yaml
@@ -9,6 +9,14 @@ imagePullSecrets:
 ---
 apiVersion: v1
 kind: ServiceAccount
+metadata:
+  name: veles-generator
+  namespace: veles
+imagePullSecrets:
+  - name: harbor-regcred
+---
+apiVersion: v1
+kind: ServiceAccount
 metadata:
   name: veles-frontend
   namespace: veles