diff --git a/clusters/sarex-contour/kustomization.yaml b/clusters/sarex-contour/kustomization.yaml
index d757beb..0874b98 100644
--- a/clusters/sarex-contour/kustomization.yaml
+++ b/clusters/sarex-contour/kustomization.yaml
@@ -11,6 +11,7 @@ resources:
   - ../../infrastructure/vault/sarex-contour
   - ../../infrastructure/kafka/sarex-contour
   - ../../infrastructure/rabbitmq/sarex-contour
+  - ../../infrastructure/zitadel/sarex-contour
 
 # apps
   - ../../apps/control-interface/sarex-contour
diff --git a/infrastructure/zitadel/sarex-contour/kustomization.yaml b/infrastructure/zitadel/sarex-contour/kustomization.yaml
new file mode 100644
index 0000000..17fee7c
--- /dev/null
+++ b/infrastructure/zitadel/sarex-contour/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - path: zitadel.yaml
diff --git a/infrastructure/zitadel/sarex-contour/zitadel.yaml b/infrastructure/zitadel/sarex-contour/zitadel.yaml
new file mode 100644
index 0000000..89e4504
--- /dev/null
+++ b/infrastructure/zitadel/sarex-contour/zitadel.yaml
@@ -0,0 +1,158 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zitadel
+  namespace: zitadel
+spec:
+  interval: 5m
+  timeout: 10m
+  postRenderers:
+    # sarex-contour без выделенных нод — снимаем nodeSelector/tolerations
+    # с Deployment и обоих Job'ов (init/setup). Дефолтный vault-agent
+    # template не кладёт Admin.Password/FirstInstance.Org.Human.Password —
+    # подменяем на свой (по образцу overlay vad), читающий их из
+    # secrets/data/zitadel/postgresql (поля password/humanPassword).
+    - kustomize:
+        patches:
+          - target:
+              group: apps
+              version: v1
+              kind: Deployment
+              name: zitadel-idp-contour
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value: {}
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-init
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value: {}
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+          - target:
+              group: batch
+              version: v1
+              kind: Job
+              name: zitadel-idp-contour-setup
+            patch: |-
+              - op: add
+                path: /spec/template/spec/nodeSelector
+                value: {}
+              - op: add
+                path: /spec/template/spec/tolerations
+                value: []
+              - op: replace
+                path: /spec/template/metadata/annotations/vault.hashicorp.com~1agent-inject-template-zitadel-vault-config.yaml
+                value: |-
+                  {{- with secret "secrets/data/zitadel/postgresql" -}}
+                  Database:
+                    postgres:
+                      User:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                      Admin:
+                        Password: |-
+                          {{ index .Data.data "password" }}
+                  FirstInstance:
+                    Org:
+                      Human:
+                        Password: |-
+                          {{ index .Data.data "humanPassword" }}
+                  {{- end -}}
+  values:
+    zitadel:
+      configmapConfig:
+        # placeholder — istio-config/DNS для sarex-contour ещё не заведены,
+        # резолвиться прямо сейчас не обязан.
+        ExternalDomain: zitadel.sarex-contour.internal
+        ExternalSecure: true
+      debug:
+        enabled: false
+    postgresqlSecret:
+      create: false
+      vault:
+        enabled: true
+        role: zitadel
+        authPath: auth/kubernetes
+        secretPath: secrets/data/zitadel/postgresql
+        secretKey: password
+        kvVersion: 2
+        fileName: zitadel-vault-config.yaml
+    serviceAccount:
+      create: true
+      name: zitadel
+    replicaCount: 1
+    pdb:
+      enabled: false
+    env:
+      - name: ZITADEL_DEFAULTINSTANCE_FEATURES_LOGINV2_REQUIRED
+        value: "false"
+      - name: ZITADEL_SYSTEMDEFAULTS_PASSWORDHASHER_VERIFIERS
+        value: "bcrypt,pbkdf2"
+      - name: ZITADEL_MACHINE_IDENTIFICATION_HOSTNAME_ENABLED
+        value: "true"
+      - name: ZITADEL_DATABASE_POSTGRES_HOST
+        value: "111.88.255.180"
+      - name: ZITADEL_DATABASE_POSTGRES_PORT
+        value: "5432"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_EXISTINGDATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_USERNAME
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_DATABASE
+        value: "zitadel"
+      - name: ZITADEL_DATABASE_POSTGRES_USER_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DATABASE_POSTGRES_ADMIN_SSL_MODE
+        value: "disable"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_HUMAN_USERNAME
+        value: "zitadel-admin"
+      - name: ZITADEL_DEFAULTINSTANCE_ORG_NAME
+        value: "Sarex"