diff --git a/apps/cloudnative-pg.yaml b/apps/cloudnative-pg.yaml
new file mode 100644
index 0000000..cde2b3b
--- /dev/null
+++ b/apps/cloudnative-pg.yaml
@@ -0,0 +1,34 @@
+# CloudNativePG manages PostgreSQL databases as Kubernetes resources. The
+# companion Barman Cloud plugin sends database backups and transaction logs to
+# object storage; installing both here gives future apps one shared database
+# operator without forcing them to share one PostgreSQL server.
+#
+# Deliberately NO resources-finalizer.argocd.argoproj.io here. PostgreSQL
+# clusters managed by this operator hold application data, so removing this
+# Application must not cascade into a surprise deletion of database machinery.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: cloudnative-pg
+  namespace: argocd
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza.com/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/cloudnative-pg
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cnpg-system
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      # Both dependencies install cluster-wide CRDs. Server-side apply avoids
+      # annotation-size limits and lets Kubernetes handle CRD fields safely.
+      - ServerSideApply=true
diff --git a/apps/cloudnative-pg/Chart.yaml b/apps/cloudnative-pg/Chart.yaml
new file mode 100644
index 0000000..d1812b8
--- /dev/null
+++ b/apps/cloudnative-pg/Chart.yaml
@@ -0,0 +1,19 @@
+# One umbrella chart installs the PostgreSQL operator and its current backup
+# plugin together. Applications create their own independent PostgreSQL
+# Cluster resources; these shared controllers hold no application data.
+apiVersion: v2
+name: cloudnative-pg-app
+description: >-
+  Installs CloudNativePG and the Barman Cloud object-storage backup plugin
+version: 0.1.0
+type: application
+
+dependencies:
+  - name: cloudnative-pg
+    # Pin versions so an unrelated Git sync cannot silently upgrade the
+    # controller responsible for every PostgreSQL database in the cluster.
+    version: 0.29.1
+    repository: https://cloudnative-pg.github.io/charts
+  - name: plugin-barman-cloud
+    version: 0.8.1
+    repository: https://cloudnative-pg.github.io/charts
diff --git a/docs/network.md b/docs/network.md
index ea2b148..313931b 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -64,6 +64,7 @@ This dedicated service range is advertised to the MikroTik at
 | Address | What | Namespace | Port(s) | URL | Source |
 |---|---|---|---|---|---|
 | `10.10.60.10` | Argo CD UI/API (`argocd-server`) | `argocd` | 443 | `https://10.10.60.10` | Patched to `LoadBalancer` by hand — see [`docs/05-metallb.md`](05-metallb.md) |
+| `10.10.60.11` | Reserved for the Authentik LDAP Outpost used by Jellyfin | `authentik` | 636 | `ldaps://10.10.60.11:636` | Planned Authentik deployment; verify the address and TLS certificate before migrating Jellyfin |
 | `10.10.60.12` | ingress-nginx (shared, routes by hostname) | `ingress-nginx` | 80, 443 | `http://10.10.60.12`, `https://10.10.60.12` | [`apps/ingress-nginx/values.yaml`](../apps/ingress-nginx/values.yaml) — see [`docs/11-ingress.md`](11-ingress.md) |
 
 Add a row here every time you add a new app with its own dedicated
@@ -97,7 +98,7 @@ Addresses from the range above that aren't spoken for yet. Update this
 alongside the table above so it's obvious at a glance what's safe to hand
 to the next app.
 
-- `10.10.60.11`, `10.10.60.13-10.10.60.250`
+- `10.10.60.13-10.10.60.250`
 
 (`whoami`'s former `10.10.60.12` was reclaimed here after that app was
 removed as the docs/08 exercise — it now belongs to ingress-nginx instead.