diff --git a/devserver/ansible/playbook.yaml b/devserver/ansible/playbook.yaml
index 8dfca67..7986be3 100644
--- a/devserver/ansible/playbook.yaml
+++ b/devserver/ansible/playbook.yaml
@@ -5,5 +5,6 @@
   roles:
     - common
     - docker
+    - seamark
     - infisical
     - svc-events
diff --git a/devserver/ansible/roles/seamark/defaults/main.yaml b/devserver/ansible/roles/seamark/defaults/main.yaml
new file mode 100644
index 0000000..310da8b
--- /dev/null
+++ b/devserver/ansible/roles/seamark/defaults/main.yaml
@@ -0,0 +1,9 @@
+---
+# seamark — authenticate Docker to the buoy.cr registry.
+#
+# The svc-events compose stack pulls `buoy.cr/devict.org/events:latest`, so
+# Docker needs credentials for buoy.cr.
+
+seamark_registry: "buoy.cr"
+seamark_handle: "devict.org"
+seamark_app_password: "{{ lookup('env', 'SEAMARK_REGISTRY_APP_PASSWORD') }}"
diff --git a/devserver/ansible/roles/seamark/tasks/main.yaml b/devserver/ansible/roles/seamark/tasks/main.yaml
new file mode 100644
index 0000000..3557392
--- /dev/null
+++ b/devserver/ansible/roles/seamark/tasks/main.yaml
@@ -0,0 +1,41 @@
+---
+# seamark — write a native Docker `auths` entry for buoy.cr into root's
+# ~/.docker/config.json so the svc-events stack can pull
+# `buoy.cr/devict.org/events:latest` non-interactively.
+#
+# Prerequisites (satisfied by playbook role order):
+#   - docker role: docker + compose plugin installed
+#
+# See defaults/main.yaml for why we use auths instead of the atcr helper,
+# and why we write the file directly instead of slurp+merge.
+
+- name: fail when app password is not provided
+  ansible.builtin.assert:
+    that:
+      - seamark_app_password | length > 0
+    fail_msg: >-
+      SEAMARK_REGISTRY_APP_PASSWORD is not set. Add it to .env.local.op
+      (op:// reference) and re-run, or export it in your shell.
+
+- name: ensure root docker config directory exists
+  ansible.builtin.file:
+    path: /root/.docker
+    state: directory
+    owner: root
+    group: root
+    mode: "0700"
+  become: true
+
+- name: write root docker config with buoy.cr auth
+  ansible.builtin.copy:
+    dest: /root/.docker/config.json
+    content: >-
+      {{
+        {'auths': {seamark_registry: {'auth': ((seamark_handle ~ ':' ~ seamark_app_password) | b64encode)}}}
+        | to_nice_json
+      }}{{ '\n' }}
+    owner: root
+    group: root
+    mode: "0600"
+  become: true
+  notify: restart svc-events