diff --git a/.gitignore b/.gitignore
--- a/.gitignore
+++ b/.gitignore
@@ -30,6 +30,10 @@
 web/resources/static/libs/*
 plans/*
 
+!fly.toml
+!.tangled/**/*
+
+!litestream.yml
 
 # !Makefile
 
diff --git a/Dockerfile b/Dockerfile
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,6 @@
 FROM docker.io/golang:1.26-alpine AS build
 
-RUN apk add --no-cache upx
+RUN apk add --no-cache upx ca-certificates
 
 WORKDIR /src
 COPY . ./
@@ -9,7 +9,12 @@ RUN --mount=type=cache,target=/root/.cache/go-build \
 go build -ldflags="-s" -o /bin/main ./cmd/web
 RUN upx -9 -k /bin/main
 
+FROM litestream/litestream:latest AS litestream
+
 FROM scratch
 ENV PORT=9001
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=litestream /usr/local/bin/litestream /usr/local/bin/litestream
+COPY litestream.yml /etc/litestream.yml
 COPY --from=build /bin/main /
-ENTRYPOINT ["/main"]
+ENTRYPOINT ["/usr/local/bin/litestream", "replicate", "-exec", "/main"]
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -75,11 +75,19 @@
 ```bash
 docker build -t atmoquest:latest .
 docker run --rm -p 8080:8080 \
+  -v atmoquest_data:/data \
   -e PUBLIC_URL=https://your.domain \
   -e SESSION_SECRET=$(openssl rand -hex 32) \
   -e ADMIN_SIGNING_KEY=$(openssl rand -base64 32) \
+  -e BUCKET_NAME=your-bucket \
+  -e AWS_ENDPOINT_URL_S3=https://your-s3-endpoint \
+  -e AWS_ACCESS_KEY_ID=… \
+  -e AWS_SECRET_ACCESS_KEY=… \
+  -e AWS_REGION=auto \
   atmoquest:latest
 ```
+
+The image bundles [Litestream](https://litestream.io) as its supervisor process: it watches `/data/atmoquest.db`'s WAL and streams changes to S3-compatible object storage. Replica config lives in [`litestream.yml`](litestream.yml) and reads bucket + credentials from the `BUCKET_NAME` / `AWS_*` env vars above. Litestream is required — without those vars set the container won't start. Mount a volume at `/data` so the database and the OAuth signing key (`/data/oauth_key.pem`) survive restarts.
 
 ## Contributing
 
diff --git a/litestream.yml b/litestream.yml
new file mode 100644
--- /dev/null
+++ b/litestream.yml
@@ -0,0 +1,11 @@
+dbs:
+  - path: /data/atmoquest.db
+    replica:
+      type: s3
+      bucket: ${BUCKET_NAME}
+      path: atmoquest
+      endpoint: ${AWS_ENDPOINT_URL_S3}
+      force-path-style: true
+      access-key-id: ${AWS_ACCESS_KEY_ID}
+      secret-access-key: ${AWS_SECRET_ACCESS_KEY}
+      region: ${AWS_REGION}