diff --git a/argocd/apps/platform/appset.yaml b/argocd/apps/platform/appset.yaml
new file mode 100644
index 0000000..7a7e261
--- /dev/null
+++ b/argocd/apps/platform/appset.yaml
@@ -0,0 +1,53 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: platform
+  namespace: argocd
+spec:
+  goTemplate: true
+  generators:
+    - matrix:
+        generators:
+          - clusters:
+              selector:
+                matchLabels:
+                  purpose: platform
+          - list:
+              elements:
+                - app: kargo
+                  namespace: kargo
+                  wave: "0"
+                - app: kargo-pipelines
+                  namespace: kargo
+                  wave: "1"
+  template:
+    metadata:
+      name: "{{ .app }}-{{ .name }}"
+      annotations:
+        argocd.argoproj.io/sync-wave: "{{ .wave }}"
+    spec:
+      project: default
+      sources:
+        - repoURL: https://github.com/jonathandieu/dieubernetes
+          targetRevision: HEAD
+          ref: values
+        - repoURL: https://github.com/jonathandieu/dieubernetes
+          targetRevision: HEAD
+          path: "charts/platform/{{ .app }}"
+          helm:
+            releaseName: "{{ .app }}"
+            valueFiles:
+              - values.yaml
+              - "$values/clusters/{{ .name }}/overrides/{{ .app }}.yaml"
+            ignoreMissingValueFiles: true
+      destination:
+        server: "{{ .server }}"
+        namespace: "{{ .namespace }}"
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true
+          - ServerSideApply=true
+          - SkipDryRunOnMissingResource=true
diff --git a/charts/platform/kargo-pipelines/Chart.yaml b/charts/platform/kargo-pipelines/Chart.yaml
new file mode 100644
index 0000000..642823f
--- /dev/null
+++ b/charts/platform/kargo-pipelines/Chart.yaml
@@ -0,0 +1,4 @@
+apiVersion: v2
+name: kargo-pipelines
+description: Kargo Warehouses and Stages for all workload apps
+version: 0.1.0
diff --git a/charts/platform/kargo-pipelines/templates/stage.yaml b/charts/platform/kargo-pipelines/templates/stage.yaml
new file mode 100644
index 0000000..9d96c5e
--- /dev/null
+++ b/charts/platform/kargo-pipelines/templates/stage.yaml
@@ -0,0 +1,70 @@
+{{- range $envName, $env := .Values.environments }}
+{{- range $.Values.apps }}
+{{- $app := . }}
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Stage
+metadata:
+  name: {{ $app.name }}-{{ $envName }}
+  namespace: {{ $.Release.Namespace }}
+spec:
+  requestedFreight:
+    - origin:
+        kind: Warehouse
+        name: {{ $app.name }}
+      sources:
+        {{- if eq $envName "stage" }}
+        direct: true
+        {{- else }}
+        # prod only receives freight already verified in stage — one Stage
+        # per environment, not per cluster, so this is a single reference
+        # regardless of how many clusters are in the stage environment.
+        stages:
+          - {{ $app.name }}-stage
+        {{- end }}
+  promotionTemplate:
+    spec:
+      steps:
+        - uses: git-clone
+          config:
+            repoURL: {{ $.Values.git.repoURL }}
+            checkout:
+              - branch: {{ $.Values.git.branch }}
+                path: ./repo
+
+        # Update image tag in every cluster override file for this environment.
+        # When a new cluster is added to environments.{{ $envName }}.clusters,
+        # its override file is automatically included here on next ArgoCD sync.
+        {{- range $env.clusters }}
+        - uses: git-update-image
+          as: update-{{ . }}
+          config:
+            path: ./repo
+            images:
+              - image: {{ $app.imageRepo }}
+                fromFreight: true
+                updates:
+                  - file: clusters/{{ . }}/overrides/{{ $app.name }}.yaml
+                    key: "{{ $app.imageValueKey }}"
+        {{- end }}
+
+        - uses: git-commit
+          config:
+            path: ./repo
+            message: "chore(kargo): promote {{ $app.name }} to {{ $envName }}"
+
+        - uses: git-push
+          config:
+            path: ./repo
+
+        # Trigger ArgoCD sync for every cluster in this environment
+        {{- range $env.clusters }}
+        - uses: argocd-update
+          config:
+            apps:
+              - name: {{ $app.name }}-{{ . }}
+                sources:
+                  - desiredCommitFromStep: git-push
+        {{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/platform/kargo-pipelines/templates/warehouse.yaml b/charts/platform/kargo-pipelines/templates/warehouse.yaml
new file mode 100644
index 0000000..3ad6946
--- /dev/null
+++ b/charts/platform/kargo-pipelines/templates/warehouse.yaml
@@ -0,0 +1,15 @@
+{{- range .Values.apps }}
+---
+apiVersion: kargo.akuity.io/v1alpha1
+kind: Warehouse
+metadata:
+  name: {{ .name }}
+  namespace: {{ $.Release.Namespace }}
+spec:
+  interval: 5m0s
+  subscriptions:
+    - image:
+        repoURL: {{ .imageRepo }}
+        semverConstraint: ">=0.0.0"
+        discoveryLimit: 5
+{{- end }}
diff --git a/charts/platform/kargo-pipelines/values.yaml b/charts/platform/kargo-pipelines/values.yaml
new file mode 100644
index 0000000..7b973b8
--- /dev/null
+++ b/charts/platform/kargo-pipelines/values.yaml
@@ -0,0 +1,34 @@
+# environments lists which clusters belong to each Kargo Stage, using the
+# short cluster name ArgoCD's cluster secret uses (matches the
+# clusters/<name>/overrides/ directories the workloads appset reads from —
+# not the full dieubernetes-{tier}-{provider}-{region} workspace name).
+# `dieuctl cluster create --environment stage` appends to the stage list.
+# `dieuctl cluster destroy` removes the cluster from its environment list.
+# ArgoCD syncs the updated Kargo Stage definitions automatically.
+environments:
+  stage:
+    clusters:
+      - stage-do-atl1
+  prod:
+    clusters:
+      - prod-do-atl1
+
+# apps lists every workload app that goes through the Kargo pipeline — each
+# must have a real chart under charts/workloads/. imageValueKey is the path
+# to the image tag in that chart's own values (relative to the chart root,
+# since override files are merged directly as the chart's values) — it
+# varies for umbrella charts that wrap an aliased subchart.
+apps:
+  - name: mealie
+    imageRepo: ghcr.io/mealie-recipes/mealie
+    imageValueKey: image.tag
+  - name: plausible
+    imageRepo: ghcr.io/plausible/community-edition
+    imageValueKey: plausible-analytics.image.tag
+  - name: changedetection
+    imageRepo: ghcr.io/dgtlmoon/changedetection.io
+    imageValueKey: image.tag
+
+git:
+  repoURL: https://github.com/jonathandieu/dieubernetes
+  branch: main
diff --git a/charts/platform/kargo/Chart.yaml b/charts/platform/kargo/Chart.yaml
new file mode 100644
index 0000000..17b099f
--- /dev/null
+++ b/charts/platform/kargo/Chart.yaml
@@ -0,0 +1,7 @@
+apiVersion: v2
+name: kargo
+version: 0.1.0
+dependencies:
+  - name: kargo
+    version: "1.10.7"
+    repository: oci://ghcr.io/akuity/kargo-charts
diff --git a/charts/platform/kargo/templates/kargo-admin-credentials.yaml b/charts/platform/kargo/templates/kargo-admin-credentials.yaml
new file mode 100644
index 0000000..5f7eb47
--- /dev/null
+++ b/charts/platform/kargo/templates/kargo-admin-credentials.yaml
@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: kargo-admin-credentials
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: onepassword
+    kind: ClusterSecretStore
+  target:
+    name: kargo-admin-credentials
+  data:
+    - secretKey: ADMIN_ACCOUNT_PASSWORD_HASH
+      remoteRef:
+        key: fhygr5davlgoiugn3oggxovcte/password_hash
+    - secretKey: ADMIN_ACCOUNT_TOKEN_SIGNING_KEY
+      remoteRef:
+        key: fhygr5davlgoiugn3oggxovcte/token_signing_key
diff --git a/charts/platform/kargo/values.yaml b/charts/platform/kargo/values.yaml
new file mode 100644
index 0000000..965039c
--- /dev/null
+++ b/charts/platform/kargo/values.yaml
@@ -0,0 +1,9 @@
+kargo:
+  api:
+    adminAccount:
+      enabled: true
+    secret:
+      name: kargo-admin-credentials  # created by templates/kargo-admin-credentials.yaml, sourced from the "Kargo Admin" 1Password item
+  argocd:
+    integrationEnabled: true
+    namespace: argocd