diff --git a/app.py b/app.py
index d6bed00..3238ed3 100644
--- a/app.py
+++ b/app.py
@@ -1036,6 +1036,79 @@ async def vps_proxy_route(req: ProxyRouteRequest, _=Depends(_verify)):
     return {"status": "configured", "domain": domain, "upstream": upstream, "caddy": caddy, "dns": dns}
 
 
+class SpeedtestDeployRequest(BaseModel):
+    stats_password: str
+
+
+async def _fetch_forgejo_text(repo: str, path: str) -> str:
+    if repo != "sascha/speedtest" or path != "compose.yaml":
+        raise ValueError("unsupported Forgejo file")
+    cfg = SERVICES.get("forgejo", {})
+    base_url = cfg.get("url")
+    token = _get_key(cfg)
+    if not base_url or not token:
+        raise RuntimeError("Forgejo service configuration is unavailable")
+    url = f"{base_url}/api/v1/repos/{repo}/contents/{path}"
+    async with httpx.AsyncClient(timeout=30) as client:
+        response = await client.get(url, params={"ref": "main"}, headers={"Authorization": f"token {token}"})
+        response.raise_for_status()
+    return base64.b64decode(response.json()["content"]).decode()
+
+
+def _deploy_speedtest_compose(compose: str, password: str) -> dict:
+    required = [
+        "ghcr.io/librespeed/speedtest:latest",
+        '127.0.0.1:8080:8080',
+        'TELEMETRY: "true"',
+        '/app-config/speedtest/database:/database',
+        'PASSWORD: "${STATS_PASSWORD:',
+    ]
+    if any(item not in compose for item in required):
+        raise ValueError("speedtest compose is missing a required security or persistence setting")
+    if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", password):
+        raise ValueError("stats password must be 24-128 safe characters")
+    script = f"""from pathlib import Path
+import os
+stack = Path('/app-config/github/speedtest')
+database = Path('/app-config/speedtest/database')
+stack.mkdir(parents=True, exist_ok=True)
+database.mkdir(parents=True, exist_ok=True)
+compose = stack / 'compose.yaml'
+if compose.exists():
+    (stack / 'compose.yaml.bak').write_bytes(compose.read_bytes())
+compose.write_text({compose!r})
+env = stack / '.env'
+env.write_text('STATS_PASSWORD=' + {password!r} + '\\n')
+os.chmod(env, 0o600)
+"""
+    rc, _out, err = _remote_python(script)
+    if rc != 0:
+        raise RuntimeError(f"speedtest file deployment failed: {err[-300:]}")
+    preflight = "cd /app-config/github/speedtest && docker compose config -q && docker compose pull"
+    rc, _out, err = _ssh(VPS_SSH, preflight, timeout=300)
+    if rc != 0:
+        raise RuntimeError(f"speedtest compose preflight failed: {err[-500:]}")
+    deploy = "cd /app-config/github/speedtest && (docker rm -f speedtest >/dev/null 2>&1 || true) && docker compose up -d"
+    rc, out, err = _ssh(VPS_SSH, deploy, timeout=120)
+    if rc != 0:
+        raise RuntimeError(f"speedtest deployment failed: {(err or out)[-500:]}")
+    health = "for i in $(seq 1 30); do curl -fsS --max-time 3 http://127.0.0.1:8080/ >/dev/null && exit 0; sleep 2; done; exit 1"
+    rc, _out, err = _ssh(VPS_SSH, health, timeout=75)
+    if rc != 0:
+        raise RuntimeError(f"speedtest health check failed: {err[-300:]}")
+    return {"status": "deployed", "health": "ok", "database": "/app-config/speedtest/database", "public_port": False}
+
+
+@app.post("/vps/speedtest/deploy")
+async def vps_speedtest_deploy(req: SpeedtestDeployRequest, _=Depends(_verify)):
+    if not re.fullmatch(r"[A-Za-z0-9!@#%_+=:,.?-]{24,128}", req.stats_password):
+        raise HTTPException(400, "stats password must be 24-128 safe characters")
+    compose = await _fetch_forgejo_text("sascha/speedtest", "compose.yaml")
+    result = await asyncio.to_thread(_deploy_speedtest_compose, compose, req.stats_password)
+    _audit("/vps/speedtest/deploy", "POST", 200, "Git-managed LibreSpeed with private telemetry")
+    return result
+
+
 # --- VM Lifecycle Endpoints ---
 import subprocess as _sp
 
diff --git a/tests/test_app.py b/tests/test_app.py
index b8adbfe..8865342 100644
--- a/tests/test_app.py
+++ b/tests/test_app.py
@@ -322,3 +322,37 @@ def test_hetzner_token_refreshes_vault_cache_when_missing(monkeypatch):
     assert calls[0][0] == "sascha@10.4.1.116"
     assert calls[0][1] == "sudo bash /data/stacks/homelab-butler/vault-sync.sh"
     assert calls[1] == "reload"
+
+
+def test_speedtest_deploy_requires_strong_password_and_uses_git_compose(monkeypatch):
+    calls = []
+
+    async def fake_fetch(repo, path):
+        calls.append(("fetch", repo, path))
+        return "services:\n  speedtest:\n    image: ghcr.io/librespeed/speedtest:latest\n"
+
+    def fake_deploy(compose, password):
+        calls.append(("deploy", compose, password))
+        return {"status": "deployed", "health": "ok"}
+
+    monkeypatch.setattr(app, "_fetch_forgejo_text", fake_fetch)
+    monkeypatch.setattr(app, "_deploy_speedtest_compose", fake_deploy)
+    with TestClient(app.app) as client:
+        weak = client.post(
+            "/vps/speedtest/deploy",
+            headers={"Authorization": "Bearer test-token"},
+            json={"stats_password": "short"},
+        )
+        response = client.post(
+            "/vps/speedtest/deploy",
+            headers={"Authorization": "Bearer test-token"},
+            json={"stats_password": "correct-horse-battery-staple"},
+        )
+
+    assert weak.status_code == 400
+    assert response.status_code == 200
+    assert response.json()["status"] == "deployed"
+    assert calls == [
+        ("fetch", "sascha/speedtest", "compose.yaml"),
+        ("deploy", "services:\n  speedtest:\n    image: ghcr.io/librespeed/speedtest:latest\n", "correct-horse-battery-staple"),
+    ]