diff --git a/apps/diun/values.yaml b/apps/diun/values.yaml
new file mode 100644
index 0000000..f1aa0d8
--- /dev/null
+++ b/apps/diun/values.yaml
@@ -0,0 +1,13 @@
+matrix:
+  enabled: true
+  homeserver: matrix.brunner.ninja:443
+  roomId: "!ckpLXMvXlZJtuvQBIJ:brunner.ninja"
+  tokenSecretName: diun-matrix-token
+
+registry:
+  enabled: true
+  name: registry.brunner.ninja
+  credentialsSecretName: diun-registry-credentials
+
+persistence:
+  existingClaim: diun
diff --git a/bootstrap/diun-project.yaml b/bootstrap/diun-project.yaml
new file mode 100644
index 0000000..6cf101e
--- /dev/null
+++ b/bootstrap/diun-project.yaml
@@ -0,0 +1,27 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: diun
+  namespace: argocd
+spec:
+  description: Diun workload and its Kubernetes discovery permissions
+  sourceRepos:
+  - https://brunner.ninja/charts
+  - https://code.brunner.ninja/feedc0de/homelab-gitops.git
+  destinations:
+  - namespace: diun
+    server: https://kubernetes.default.svc
+  clusterResourceWhitelist:
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRole
+  - group: rbac.authorization.k8s.io
+    kind: ClusterRoleBinding
+  namespaceResourceWhitelist:
+  - group: ""
+    kind: ConfigMap
+  - group: ""
+    kind: PersistentVolumeClaim
+  - group: ""
+    kind: ServiceAccount
+  - group: apps
+    kind: Deployment
diff --git a/bootstrap/diun.yaml b/bootstrap/diun.yaml
new file mode 100644
index 0000000..b706ce3
--- /dev/null
+++ b/bootstrap/diun.yaml
@@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: diun
+  namespace: argocd
+spec:
+  project: diun
+  sources:
+  - repoURL: https://brunner.ninja/charts
+    chart: diun
+    targetRevision: 1.0.0-2-g887ea3f
+    helm:
+      releaseName: diun
+      valueFiles:
+      - $values/apps/diun/values.yaml
+  - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+    targetRevision: main
+    ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: diun
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
+    syncOptions:
+    - CreateNamespace=true
+    - ServerSideApply=true