diff --git a/flake.nix b/flake.nix
index ef2655a..22dde68 100644
--- a/flake.nix
+++ b/flake.nix
@@ -8,6 +8,9 @@
 
     tangled.url = "git+https://tangled.org/tangled.org/core";
     tangled.inputs.nixpkgs.follows = "nixpkgs";
+
+    tranquil-pds.url = "git+https://tangled.org/tranquil.farm/tranquil-pds";
+    tranquil-pds.inputs.nixpkgs.follows = "nixpkgs";
   };
   outputs =
     inputs@{ nixpkgs, ... }:
@@ -20,6 +23,7 @@
             inputs.sops-nix.nixosModules.sops
             inputs.tangled.nixosModules.knot
             inputs.tangled.nixosModules.spindle
+            inputs.tranquil-pds.nixosModules.tranquil-pds
           ];
         };
       };
diff --git a/modules/hetzner-aarch64.nix b/modules/hetzner-aarch64.nix
index b677654..2bacd05 100644
--- a/modules/hetzner-aarch64.nix
+++ b/modules/hetzner-aarch64.nix
@@ -39,4 +39,10 @@
 
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
+
+  # Add swap file for building large Rust projects
+  swapDevices = [{
+    device = "/swapfile";
+    size = 4 * 1024; # 4GB
+  }];
 }
diff --git a/secrets/kuribo/tranquil-pds.env b/secrets/kuribo/tranquil-pds.env
new file mode 100644
index 0000000..41f5741
--- /dev/null
+++ b/secrets/kuribo/tranquil-pds.env
@@ -0,0 +1,28 @@
+#ENC[AES256_GCM,data:uT7liv6i+39HBT1tMkHiTIGhUyXw,iv:92Ka7wMhb4KiL3dntrJ/noU4507aL7JW92CXt3JeSK0=,tag:KY8bJwDhCKvnQ3DUmk/oqA==,type:comment]
+#ENC[AES256_GCM,data:7OolqxEvGMgPdGPmENWsusNkCH/afKfL/wr20SqC5bzizOTY+vKqJ/JBsc4=,iv:eqo9z16twhExXhbCs2u0XTMK/rJWnXtx8BDx2yPpav8=,tag:uoEXFJo6XP9PRZUYkqMFhQ==,type:comment]
+JWT_SECRET=ENC[AES256_GCM,data:Mj1HC9XzBr5hjGHdLv+b2FExI+W6tTP5Z9qDomycr2M3OICj4wArt5Gf+YoGDWAgw96y1FueJuA7UZbpzdtdNA==,iv:Eah2ZgY//C0uUXq3rSHYqIWENKJkcdT8NUSIXH2HKVk=,tag:lxWGpzl13VeDg1wo/6cpDQ==,type:str]
+DPOP_SECRET=ENC[AES256_GCM,data:J2e1d0hyHRyKMSb/pZgb2aLCdWNwtZPAyV5I4f4yvx9zmaxs9KjicP0XODh9VkridbSUM4TRsC8IkuChMSTMhQ==,iv:ibMjSLvE6bxov7jtW99POXgK2Z7EAh5O+E9yUOtzGos=,tag:AnpEB0DM8eAsYx5IETQ74w==,type:str]
+MASTER_KEY=ENC[AES256_GCM,data:6O0m9MvoE1iWwd9WYpDMkxvIiHF7D3yJcduvKbA9bQwNyNS7ASlX8WtRsW9eYyqzJ9nExUTgsiRKWwrfLiRc8A==,iv:7AOGJcGRPjyD7ryAvZ1AN4u2348TQVBDKNzes3o1d4Q=,tag:ofpWXIfLDgMKUkqsWSSSiQ==,type:str]
+#ENC[AES256_GCM,data:0/SDGkkw2sqDOIkVdkSD6AhmPdobILxRhYGKj+8Ge45FWN2L0fnhT3s50Q==,iv:qRXdlOH3lEIBZDJhSaLR6fd4OQ5mr/lN6JTgrP3/Gnc=,tag:4srFAugJZ0sg/XrIPB3gpA==,type:comment]
+PLC_ROTATION_KEY=ENC[AES256_GCM,data:4A7+X1kvYXCjifiDtuoT8nthimenJ/5i0YKYgnvrplzH9b6gaF2yi2KOd2P/qGJzeWNYCV2wAigKsQ3+cs19sQ==,iv:iU+kjxRe+Sm4xhmzj0lFavnR4mgl5WS5yk6vQC6KuSk=,tag:AKcPp+w+NsL1MRb1+gulFw==,type:str]
+#ENC[AES256_GCM,data:Va4T6FcmXG6JzqOqTGeH2xP1UWI8fsuF0N0OSzKPbgs0oyrWLw==,iv:QykbfWjqo9MSPx+Z7DJPl979RrlU2m3tNgQMJgUKUL0=,tag:9TuIDROLYnHpomzXGRglaw==,type:comment]
+CLOUDFLARE_API_TOKEN=ENC[AES256_GCM,data:Wp+fQSFdA7mngPTxewSVGBftUEpaLW/TNrHTjVn+rY9rGyqfMIRevw==,iv:b4I8gS8yIURT7/QjJg282eEcXIXkLfV2To7zJlZaFDA=,tag:oZSAESmaHuw59XshEgTMNA==,type:str]
+#ENC[AES256_GCM,data:Rwsf2UXpqZZjTOIx7PQrY5VKYLvosACnAcs=,iv:1wwuqeU7slNLoY23WVMUjZ7Ds4rjs49CqSvjKRQ8Yr4=,tag:281fAfeJOMZBb6+5sssDYg==,type:comment]
+S3_BUCKET=ENC[AES256_GCM,data:zEBsVVwHOaxu,iv:FFNvGqOnTkSb/hThGE+4jhFVrtQu8UmuuFj1KLHUl4w=,tag:umarOwJihqvRnNXtzfBF9Q==,type:str]
+S3_ENDPOINT=ENC[AES256_GCM,data:0atTeoPoeFRbERHVGekwaAFeswWWhbIfqNH07e+WtboFrOM=,iv:MQ19TAXyyFiTy72vV7BNiIEV3mYub6rlnEMfaE5LYFI=,tag:JrpC0Tqf2lBffeS0UwnqyQ==,type:str]
+AWS_ACCESS_KEY_ID=ENC[AES256_GCM,data:o5qAatqaETTLuIeYX6wdjCT+8RE=,iv:VtZimAT/dv0naJClbs6Mww9l6xbeQ6J7o5zP9axdVb8=,tag:fsPq1GpVVfX9y3yKxo4ZXw==,type:str]
+AWS_SECRET_ACCESS_KEY=ENC[AES256_GCM,data:xmOHAOBYKgEvTwi3IojhjXAxmCDjKD54ZqeLdypdPBCz6WgoCvXFKA==,iv:j8CknNrur0D0imZdMBI+1CLAD29raDSmowz2+5N4bU8=,tag:tIttmCQsXH8Zq+w6oNdMjw==,type:str]
+AWS_REGION=ENC[AES256_GCM,data:WtfRdA==,iv:z5V8PZAlArDKnxPepFd3DGOu1uHW8o8nvbuFBbESi1I=,tag:os0joOzJO9EpaTpeIRcLdQ==,type:str]
+#ENC[AES256_GCM,data:R84B2kDI3ksykBe5,iv:7IZFFAnaBqrnrMM24pDgBSGHqnLb2mPjgg46/LSRV+w=,tag:UigfhDaWXLLH/6KQkJekyg==,type:comment]
+SSO_DISCORD_CLIENT_ID=ENC[AES256_GCM,data:Uv+XhViVoEbpI2fWQ9RjU9CjCQ==,iv:MvxNPKKRPe64APkkQBl7bEH1NqLD14mAxLk1EbgV0hE=,tag:gmvLUgJb+APs6qr73LJKpg==,type:str]
+SSO_DISCORD_CLIENT_SECRET=ENC[AES256_GCM,data:c4hoEm3ITaT8WWjez+qFo/nrsIs5PtCBnolGDt15AcQ=,iv:qTUxN79YxAKBJUkx5wyrX/4u3u1BEdEJBiUQ6YypLgk=,tag:j3dJ9tTW+RuN9FuOhqzHpQ==,type:str]
+#ENC[AES256_GCM,data:GFLA9tgtlgwWaqPG+Hhk6b5DD8DlnSM/iZkZcPQKQFKuqxuVE/oAd+n085zi18FKaqr+q1t6Xq/+HV09uEI=,iv:dlD06U+hXgmkXTztm1ZjcG10Ip4IPPFxxAb1C82saWE=,tag:/aG7Mw9N120fhxYHx0pvaQ==,type:comment]
+MAIL_FROM_ADDRESS=ENC[AES256_GCM,data:NBu6w+LxPvPZ7qRBoxZHMvUbPOg+,iv:KBpxZgwwjDSdXjX7mcCNNiL/A90+V0pd84d3OZbfJiA=,tag:3rzQ0dlsT4Fw09+YzFmEGQ==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLam52UzJyMFBUaWVWWStZ\nNUpBbHFjNHdqc1ZFTE96Q0laWWJjRDFHRm53ClIzVjd0UnRDS09jTmdGZ0MyZm5s\nd3I5UG5SUFB0VWFFUHgraFNhZFNzclEKLS0tIHlGNE1uTFBBUEZrM0RSU0dPMWZu\ncWtuSEVhRUtBMkpiSk9GWWhoTnZxZEkKiKWdUZ4mqvqAmqd013xd5tW5UGcMY8Wi\nkc/y1UlZnJFMU3OoICdWXEbet81TQriNxPjXjhgmBUlK3zfzy6LGIg==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1h08rnd0jeddf55l6l3rf6dlwwh7mngcxy92tyz0hfysjqx4wvgrq6vmah2
+sops_age__list_1__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLS2ZYSExScEhhV1NRZUc4\nU1pDOU5ydVlPb2NNdHUxTmNYMHhqMDBRU3o0Ck91MHRKY2RJWG1FRlhGbGRNSHRw\nVGRpV3o0K3ZzaWxJK1NqNG5oRnYwY0EKLS0tIFFOWm05ZEtSMUFsME1WMGtKdEFs\nU1RCR29vREwzQXJZSXJoVmR3Y2IvTUEKps6/I4f4Ec73c+N0JN+xSyQfMfEsqHda\noC++w3UpkCkyNKiLWbbTaWMCjRoSX7jhKEmCZvoU7J1X4pTRFHFAQQ==\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_1__map_recipient=age1dhxleu7puseq4fz5gprzdssprdd452kjry2n47xaqfh22p5eyqfs68zysl
+sops_lastmodified=2026-03-27T03:46:07Z
+sops_mac=ENC[AES256_GCM,data:4IaypLApjBuyujeJNsBjYN3i3TW7Duvj532ex5EdtkrCuNhmoB+YoC6yoO3ap6Sq21M8yBmeyZKfxrDHQAUL+xoxQXQAyj/Ot1ZbGLwo/w1EI5ka/0+ohOxkb/Bc75ioGyu8x+605dEQYst2Sm6nTKkEclDoaM3FzZGd6gHtM8g=,iv:4sKe7PxjGw/curGjnq3d4bRb7N3EcXFd0e44oZYY3ZA=,tag:Q6JtBs31lu/KEc4WoXEXiQ==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.11.0
diff --git a/servers/kuribo/configuration.nix b/servers/kuribo/configuration.nix
index d9b2c40..f392143 100644
--- a/servers/kuribo/configuration.nix
+++ b/servers/kuribo/configuration.nix
@@ -5,7 +5,8 @@
     ../../modules/gc.nix
     ../../users/users.nix
     ./caddy.nix
-    ./pds.nix
+    ./pds.nix           # Old PDS on port 3000 - remove after migration
+    ./tranquil-pds.nix  # Tranquil on port 3001 at new.pds.starhaven.dev
     ./tangled.nix
     ./papermario-dx-build.nix
   ];
diff --git a/servers/kuribo/tranquil-pds.nix b/servers/kuribo/tranquil-pds.nix
new file mode 100644
index 0000000..91b3671
--- /dev/null
+++ b/servers/kuribo/tranquil-pds.nix
@@ -0,0 +1,73 @@
+# STAGING CONFIG: Tranquil at new.pds.starhaven.dev (port 3001)
+# Old PDS stays at pds.starhaven.dev (port 3000)
+# After migration, change hostname back to pds.starhaven.dev and port to 3000
+{ config, pkgs, ... }:
+{
+  sops.secrets.tranquil-pds = {
+    sopsFile = ../../secrets/kuribo/tranquil-pds.env;
+    format = "dotenv";
+    owner = "tranquil-pds";
+    group = "tranquil-pds";
+  };
+
+  services.tranquil-pds = {
+    enable = true;
+    database.createLocally = true;
+    environmentFiles = [ config.sops.secrets.tranquil-pds.path ];
+
+    settings = {
+      server = {
+        # STAGING: temporary subdomain during migration
+        hostname = "new.pds.starhaven.dev";
+        port = 3001;
+        user_handle_domains = [ ".starhaven.dev" ];
+        contact_email = "admin@starhaven.dev";
+
+        # Open registration (no invite required)
+        invite_code_required = false;
+      };
+
+      storage = {
+        # S3 config comes from environment file
+        backend = "s3";
+      };
+
+      email = {
+        from_address = "noreply@starhaven.dev";
+        from_name = "Star Haven";
+      };
+
+      # Discord SSO (credentials in env file)
+      sso.discord = {
+        enabled = true;
+        display_name = "Discord";
+      };
+
+      # Accept repo imports for migration
+      import = {
+        accepting = true;
+        max_size = 1073741824; # 1GB
+      };
+    };
+  };
+
+  # Caddy: serve both old PDS and new Tranquil
+  services.caddy.virtualHosts."new.pds.starhaven.dev" = {
+    extraConfig = ''
+      tls {
+        dns cloudflare {env.CLOUDFLARE_API_TOKEN}
+      }
+      reverse_proxy http://127.0.0.1:3001
+    '';
+  };
+
+  # Caddy needs the secrets for CLOUDFLARE_API_TOKEN
+  systemd.services.caddy = {
+    after = [
+      "tranquil-pds.service"
+      "ondemand-tls-helper.service"
+      "sops-nix.service"
+    ];
+    serviceConfig.EnvironmentFile = config.sops.secrets.tranquil-pds.path;
+  };
+}