diff --git a/apps/whoami.yaml b/apps/whoami.yaml
new file mode 100644
index 0000000..c1ec69a
--- /dev/null
+++ b/apps/whoami.yaml
@@ -0,0 +1,28 @@
+# This is an Argo CD "Application" — see apps/demo.yaml for the full
+# explanation of what this resource is and why you never apply it by hand.
+# This one is the docs/08-adding-new-apps.md hands-on exercise: a second,
+# independent app added the normal way, proving the app-of-apps pattern
+# works for more than the pre-installed apps.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: whoami
+  namespace: argocd
+spec:
+  project: default
+
+  source:
+    repoURL: https://tea.ahmza.com/ahmza/k8s-starter-pack.git
+    targetRevision: main
+    path: apps/whoami
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: whoami
+
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
diff --git a/apps/whoami/deployment.yaml b/apps/whoami/deployment.yaml
new file mode 100644
index 0000000..39f1c3a
--- /dev/null
+++ b/apps/whoami/deployment.yaml
@@ -0,0 +1,25 @@
+# A tiny HTTP server that echoes back request details (headers, hostname,
+# IP) — useful as a second, real, end-to-end proof of the app-of-apps
+# pattern from docs/08-adding-new-apps.md: no storage, no privileged
+# access, just a Deployment and a Service like apps/demo/, but a completely
+# separate app added the normal way (drop files in apps/, commit, push).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: whoami
+  namespace: whoami
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: whoami
+  template:
+    metadata:
+      labels:
+        app: whoami
+    spec:
+      containers:
+        - name: whoami
+          image: traefik/whoami:v1.10
+          ports:
+            - containerPort: 80
diff --git a/apps/whoami/namespace.yaml b/apps/whoami/namespace.yaml
new file mode 100644
index 0000000..3dba24c
--- /dev/null
+++ b/apps/whoami/namespace.yaml
@@ -0,0 +1,10 @@
+# A Namespace is a way to group related resources together inside the
+# cluster, like a folder. Keeping "whoami" separate from other apps lets you
+# manage, view, and delete them independently (e.g. `kubectl -n whoami get pods`).
+#
+# We create this explicitly, as its own file, rather than letting Argo CD
+# invent it implicitly. That way it shows up in Git like everything else.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: whoami
diff --git a/apps/whoami/service.yaml b/apps/whoami/service.yaml
new file mode 100644
index 0000000..6ab0d35
--- /dev/null
+++ b/apps/whoami/service.yaml
@@ -0,0 +1,17 @@
+# type: LoadBalancer asks MetalLB for a real, routable address from this
+# cluster's dedicated BGP service pool — see docs/05-metallb.md. 10.10.60.12
+# is the next free address in docs/network.md at the time this was added.
+apiVersion: v1
+kind: Service
+metadata:
+  name: whoami
+  namespace: whoami
+  annotations:
+    metallb.io/loadBalancerIPs: "10.10.60.12"
+spec:
+  type: LoadBalancer
+  selector:
+    app: whoami
+  ports:
+    - port: 80
+      targetPort: 80
diff --git a/docs/network.md b/docs/network.md
index 5d9c639..4cd58a6 100644
--- a/docs/network.md
+++ b/docs/network.md
@@ -50,6 +50,7 @@ This dedicated service range is advertised to the MikroTik at
 |---|---|---|---|---|---|
 | `10.10.60.10` | Argo CD UI/API (`argocd-server`) | `argocd` | 443 | `https://10.10.60.10` | Patched to `LoadBalancer` by hand — see [`docs/05-metallb.md`](05-metallb.md) |
 | `10.10.60.11` | Demo app | `demo` | 80 | `http://10.10.60.11` | [`apps/demo/service.yaml`](../apps/demo/service.yaml) |
+| `10.10.60.12` | whoami app | `whoami` | 80 | `http://10.10.60.12` | [`apps/whoami/service.yaml`](../apps/whoami/service.yaml) |
 
 Add a row here every time you add a new app with a `LoadBalancer` Service
 (see [`docs/08-adding-new-apps.md`](08-adding-new-apps.md)). Leave the URL
@@ -62,4 +63,4 @@ Addresses from the range above that aren't spoken for yet. Update this
 alongside the table above so it's obvious at a glance what's safe to hand
 to the next app.
 
-- `10.10.60.12-10.10.60.250`
+- `10.10.60.13-10.10.60.250`