diff --git a/app.py b/app.py
index d6bed00..3238ed3 100644
--- a/app.py
+++ b/app.py
@@ -1036,6 +1036,79 @@ async def vps_proxy_route(req: ProxyRouteRequest, _=Depends(_verify)):
     return {"status": "configured", "domain": domain, "upstream": upstream, "caddy": caddy, "dns": dns}
 
 
+class SpeedtestDeployRequest(BaseModel):
+    stats_password: str
+
+
+async def _fetch_forgejo_text(repo: str, path: str) -> str:
+    if repo != "sascha/speedtest" or path != "compose.yaml":
+        raise ValueError("unsupported Forgejo file")
+    cfg = SERVICES.get("forgejo", {})
+    base_url = cfg.get("url")
+    token = _get_key(cfg)
+    if not base_url or not token:
+        raise RuntimeError("Forgejo service configuration is unavailable")
+    url = f"{base_url}/api/v1/repos/{repo}/contents/{path}"
+    async with httpx.AsyncClient(timeout=30) as client:
+        response = await client.get(url, params={"ref": "main"}, headers={"Authorization": f"token {token}"})
+        response.raise_for_status()
+    return base64.b64decode(response.json()["content"]).decode()
+
+
+def _deploy_speedtest_compose(compose: str, password: str) -> dict:
+    required = [
+        "ghcr.io/librespeed/speedtest:latest",
+        '127.0.0.1:8080:8080',
+        'TELEMETRY: "true"',
+        '/app-config/speedtest/database:/database',
+        'PASSWORD: "${STATS_PASSWORD:',
+    ]
+    if any(item not in compose for item in required):
+        raise ValueError("speedtest compose is missing a required security or persistence setting")
+    if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", password):
+        raise ValueError("stats password must be 24-128 safe characters")
+    script = f"""from pathlib import Path
+import os
+stack = Path('/app-config/github/speedtest')
+database = Path('/app-config/speedtest/database')
+stack.mkdir(parents=True, exist_ok=True)
+database.mkdir(parents=True, exist_ok=True)
+compose = stack / 'compose.yaml'
+if compose.exists():
+    (stack / 'compose.yaml.bak').write_bytes(compose.read_bytes())
+compose.write_text({compose!r})
+env = stack / '.env'
+env.write_text('STATS_PASSWORD=' + {password!r} + '\\n')
+os.chmod(env, 0o600)
+"""
+    rc, _out, err = _remote_python(script)
+    if rc != 0:
+        raise RuntimeError(f"speedtest file deployment failed: {err[-300:]}")
+    preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose pull"
+    rc, _out, err = _ssh(VPS_SSH, preflight, timeout=300)
+    if rc != 0:
+        raise RuntimeError(f"speedtest compose preflight failed: {err[-500:]}")
+    deploy = "cd /app-config/github/speedtest && (docker rm -f speedtest >/dev/null 2>&1 || true) && docker compose up -d"
+    rc, out, err = _ssh(VPS_SSH, deploy, timeout=120)
+    if rc != 0:
+        raise RuntimeError(f"speedtest deployment failed: {(err or out)[-500:]}")
+    health = "for i in $(seq 1 30); do curl -fsS --max-time 3 http://127.0.0.1:8080/ >/dev/null && exit 0; sleep 2; done; exit 1"
+    rc, _out, err = _ssh(VPS_SSH, health, timeout=75)
+    if rc != 0:
+        raise RuntimeError(f"speedtest health check failed: {err[-300:]}")
+    return {"status": "deployed", "health": "ok", "database": "/app-config/speedtest/database", "public_port": False}
+
+
+@app.post("/vps/speedtest/deploy")
+async def vps_speedtest_deploy(req: SpeedtestDeployRequest, _=Depends(_verify)):
+    if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", req.stats_password):
+        raise HTTPException(400, "stats password must be 24-128 safe characters")
+    compose = await _fetch_forgejo_text("sascha/speedtest", "compose.yaml")
+    result = await asyncio.to_thread(_deploy_speedtest_compose, compose, req.stats_password)
+    _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed LibreSpeed with private telemetry")
+    return result
+
+
 # --- VM Lifecycle Endpoints ---
 import subprocess as _sp