diff --git a/apps/paperless-postgresql/values.yaml b/apps/paperless-postgresql/values.yaml
new file mode 100644
index 0000000..e85362c
--- /dev/null
+++ b/apps/paperless-postgresql/values.yaml
@@ -0,0 +1,39 @@
+# Preserve the existing PostgreSQL 17 data directory; chart 1.6.8 defaults to
+# PostgreSQL 18, which must not be selected during a GitOps ownership transfer.
+image:
+  registry: docker.io
+  repository: postgres
+  tag: 17.11-bookworm
+settings:
+  existingSecret: paperless-postgres
+  superuser:
+    secretKey: POSTGRES_USER
+  superuserPassword:
+    secretKey: POSTGRES_PASSWORD
+userDatabase:
+  existingSecret: paperless-postgres
+  name:
+    secretKey: USERDB_NAME
+  user:
+    secretKey: USERDB_USER
+  password:
+    secretKey: USERDB_PASSWORD
+storage:
+  requestedSize: 8Gi
+  className: rook-ceph-block-ec
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+resources:
+  requests:
+    cpu: 100m
+    memory: 512Mi
+args:
+  - -c
+  - max_connections=200
+securityContext:
+  readOnlyRootFilesystem: false
+  runAsNonRoot: true
+  runAsUser: 999
+  runAsGroup: 999
+  allowPrivilegeEscalation: false
diff --git a/apps/paperless-valkey/values.yaml b/apps/paperless-valkey/values.yaml
new file mode 100644
index 0000000..a103ba7
--- /dev/null
+++ b/apps/paperless-valkey/values.yaml
@@ -0,0 +1,16 @@
+fullnameOverride: valkey
+replica:
+  enabled: false
+dataStorage:
+  enabled: false
+auth:
+  enabled: false
+readinessProbe:
+  enabled: true
+valkeyConfig: |
+  save ""
+  appendonly no
+resources:
+  requests:
+    cpu: 25m
+    memory: 64Mi
diff --git a/apps/paperless/README.md b/apps/paperless/README.md
new file mode 100644
index 0000000..ac61d76
--- /dev/null
+++ b/apps/paperless/README.md
@@ -0,0 +1,29 @@
+# Paperless namespace ownership
+
+Paperless, ScanservJS, and Stirling PDF use three independently published
+charts and three Argo Applications. Paperless's chart owns only the Paperless
+Deployment, Service, and Ingress; the scanner chart owns the ScanservJS
+Deployment, ConfigMap action, Service, and Ingress; the Stirling chart owns the
+PDF editor Deployment, Service, and Ingress. This repository supplies hostnames,
+Secret names, the scanner's eSCL endpoint and shared claim, resource sizing,
+and Paperless's soft preference for the `arschrock` node.
+
+The `paperless-storage` Application owns the pre-existing `paperless-data` and
+`paperless-runtime` PVC declarations with pruning disabled. Neither chart
+recreates them. The scanner action copies scans to the `consume` subdirectory
+of `paperless-data`; it does not use email or a recipient address.
+
+PostgreSQL currently remains the existing manual Helm release `postgresql`
+at chart 1.6.8 with the PostgreSQL 17.11 image. Its Argo declaration is staged
+but intentionally not activated: a server-side dry-run of the current chart
+against the live StatefulSet reported an immutable-spec/field-ownership
+conflict. Do not delete or recreate its StatefulSet or PVC to force adoption.
+The `postgres-data-postgresql-0` PVC and `paperless-postgres` Secret must be
+preserved. Valkey remains the existing ephemeral Deployment for now; its
+upstream chart changes the Deployment selector, so its staged Application is
+also intentionally not activated. Resolve these as separate, verified cutovers.
+
+`paperless-secret-key`, `paperless-postgres`, and `paperless-oidc` remain
+cluster-managed Secrets referenced by name. They are not copied into this
+public repository. The old deployment repository's Authentik/OIDC setup
+scripts remain a recovery reference until their ownership is settled.
diff --git a/bootstrap/kustomization.yaml b/bootstrap/kustomization.yaml
index 518c5b3..c353fac 100644
--- a/bootstrap/kustomization.yaml
+++ b/bootstrap/kustomization.yaml
@@ -62,3 +62,4 @@ resources:
 - grafana.yaml
 - visual-studio-code.yaml
 - wiki-js.yaml
+- paperless-project.yaml
diff --git a/bootstrap/paperless-postgresql.yaml b/bootstrap/paperless-postgresql.yaml
new file mode 100644
index 0000000..4db4550
--- /dev/null
+++ b/bootstrap/paperless-postgresql.yaml
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: paperless-postgresql
+  namespace: argocd
+spec:
+  project: paperless
+  sources:
+    - repoURL: https://groundhog2k.github.io/helm-charts/
+      chart: postgres
+      targetRevision: 1.6.8
+      helm:
+        releaseName: postgresql
+        valueFiles: [$values/apps/paperless-postgresql/values.yaml]
+    - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: paperless-ngx
+  syncPolicy:
+    automated:
+      enabled: true
+      prune: false
+      selfHeal: true
diff --git a/bootstrap/paperless-project.yaml b/bootstrap/paperless-project.yaml
index d1d062f..2d59a32 100644
--- a/bootstrap/paperless-project.yaml
+++ b/bootstrap/paperless-project.yaml
@@ -16,7 +16,6 @@ spec:
   namespaceResourceWhitelist:
     - {group: "", kind: ConfigMap}
     - {group: "", kind: PersistentVolumeClaim}
-    - {group: "", kind: Secret}
     - {group: "", kind: Service}
     - {group: "", kind: ServiceAccount}
     - {group: apps, kind: Deployment}
diff --git a/bootstrap/paperless-valkey.yaml b/bootstrap/paperless-valkey.yaml
new file mode 100644
index 0000000..f9159a5
--- /dev/null
+++ b/bootstrap/paperless-valkey.yaml
@@ -0,0 +1,25 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: paperless-valkey
+  namespace: argocd
+spec:
+  project: paperless
+  sources:
+    - repoURL: https://valkey.io/valkey-helm/
+      chart: valkey
+      targetRevision: 0.12.0
+      helm:
+        releaseName: valkey
+        valueFiles: [$values/apps/paperless-valkey/values.yaml]
+    - repoURL: https://code.brunner.ninja/feedc0de/homelab-gitops.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: paperless-ngx
+  syncPolicy:
+    automated:
+      enabled: false
+      prune: false
+      selfHeal: false