diff --git a/clusters/atlas/flux-system/applications/ci-demo/image-automation.yaml b/clusters/atlas/flux-system/applications/ci-demo/image-automation.yaml
new file mode 100644
index 0000000..0050a88
--- /dev/null
+++ b/clusters/atlas/flux-system/applications/ci-demo/image-automation.yaml
@@ -0,0 +1,27 @@
+# clusters/atlas/flux-system/applications/ci-demo/image-automation.yaml
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageUpdateAutomation
+metadata:
+  name: ci-demo
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  git:
+    checkout:
+      ref:
+        branch: feature/ci-gitops
+    commit:
+      author:
+        email: ops@bstein.dev
+        name: flux-bot
+      messageTemplate: "chore(ci-demo): update image to {{range .Updated.Images}}{{.}}{{end}}"
+    push:
+      branch: feature/ci-gitops
+  update:
+    strategy: Setters
+    path: ./services/ci-demo
+
diff --git a/clusters/atlas/flux-system/applications/ci-demo/kustomization.yaml b/clusters/atlas/flux-system/applications/ci-demo/kustomization.yaml
new file mode 100644
index 0000000..eb6903f
--- /dev/null
+++ b/clusters/atlas/flux-system/applications/ci-demo/kustomization.yaml
@@ -0,0 +1,19 @@
+# clusters/atlas/flux-system/applications/ci-demo/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: ci-demo
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/ci-demo
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: ci-demo
+  dependsOn:
+    - name: core
+  wait: false
+
diff --git a/clusters/atlas/flux-system/applications/kustomization.yaml b/clusters/atlas/flux-system/applications/kustomization.yaml
index 50ca611..62caed7 100644
--- a/clusters/atlas/flux-system/applications/kustomization.yaml
+++ b/clusters/atlas/flux-system/applications/kustomization.yaml
@@ -18,3 +18,5 @@ resources:
   - oauth2-proxy/kustomization.yaml
   - mailu/kustomization.yaml
   - jenkins/kustomization.yaml
+  - ci-demo/kustomization.yaml
+  - ci-demo/image-automation.yaml
diff --git a/scripts/crypto_wallet_monero_setup.fish b/scripts/crypto_wallet_monero_setup.fish
index 7a4c96b..0b1f43a 100644
--- a/scripts/crypto_wallet_monero_setup.fish
+++ b/scripts/crypto_wallet_monero_setup.fish
@@ -371,7 +371,7 @@ function xmrwallet_bootstrap --description "Interactive setup of monero-wallet-r
     echo "Skipping daemon probe due to xmrwallet_SKIP_DAEMON_CHECK=1"
   end
 
-  # Use your private image by default (in Zot)
+  # Use your private image by default (in Harbor)
   read -P "Container image for wallet RPC [registry.bstein.dev/crypto/monero-wallet-rpc:0.18.4.1]: " image
   if test -z "$image"; set image registry.bstein.dev/crypto/monero-wallet-rpc:0.18.4.1; end
   _require "Container image" $image; or return 1
diff --git a/services/ci-demo/deployment.yaml b/services/ci-demo/deployment.yaml
new file mode 100644
index 0000000..df882f5
--- /dev/null
+++ b/services/ci-demo/deployment.yaml
@@ -0,0 +1,31 @@
+# services/ci-demo/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ci-demo
+  namespace: ci-demo
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: ci-demo
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: ci-demo
+    spec:
+      nodeSelector:
+        hardware: rpi4
+      containers:
+        - name: ci-demo
+          image: registry.bstein.dev/infra/ci-demo:latest
+          ports:
+            - name: http
+              containerPort: 8080
+          readinessProbe:
+            httpGet:
+              path: /
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 5
+
diff --git a/services/ci-demo/image.yaml b/services/ci-demo/image.yaml
new file mode 100644
index 0000000..aa2db71
--- /dev/null
+++ b/services/ci-demo/image.yaml
@@ -0,0 +1,25 @@
+# services/ci-demo/image.yaml
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImageRepository
+metadata:
+  name: ci-demo
+  namespace: ci-demo
+spec:
+  image: registry.bstein.dev/infra/ci-demo
+  interval: 1m0s
+---
+apiVersion: image.toolkit.fluxcd.io/v1beta2
+kind: ImagePolicy
+metadata:
+  name: ci-demo
+  namespace: ci-demo
+spec:
+  imageRepositoryRef:
+    name: ci-demo
+  filterTags:
+    pattern: '^v(?P<version>0\\.0\\.0-\\d+)$'
+    extract: '$version'
+  policy:
+    semver:
+      range: ">=0.0.0-0"
+
diff --git a/services/ci-demo/kustomization.yaml b/services/ci-demo/kustomization.yaml
new file mode 100644
index 0000000..5a34b1d
--- /dev/null
+++ b/services/ci-demo/kustomization.yaml
@@ -0,0 +1,11 @@
+# services/ci-demo/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - image.yaml
+  - deployment.yaml
+  - service.yaml
+images:
+  - name: registry.bstein.dev/infra/ci-demo
+    newTag: v0.0.0-0 # {"$imagepolicy": "ci-demo:ci-demo:tag"}
diff --git a/services/ci-demo/namespace.yaml b/services/ci-demo/namespace.yaml
new file mode 100644
index 0000000..e661fc1
--- /dev/null
+++ b/services/ci-demo/namespace.yaml
@@ -0,0 +1,6 @@
+# services/ci-demo/namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ci-demo
+
diff --git a/services/ci-demo/service.yaml b/services/ci-demo/service.yaml
new file mode 100644
index 0000000..c094387
--- /dev/null
+++ b/services/ci-demo/service.yaml
@@ -0,0 +1,14 @@
+# services/ci-demo/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: ci-demo
+  namespace: ci-demo
+spec:
+  selector:
+    app.kubernetes.io/name: ci-demo
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
+