diff --git a/apps/immichframe/.gitignore b/apps/immichframe/.gitignore
new file mode 100644
index 0000000..2946e34
--- /dev/null
+++ b/apps/immichframe/.gitignore
@@ -0,0 +1,2 @@
+Chart.lock
+charts/
diff --git a/apps/immichframe/Chart.yaml b/apps/immichframe/Chart.yaml
new file mode 100644
index 0000000..a29798b
--- /dev/null
+++ b/apps/immichframe/Chart.yaml
@@ -0,0 +1,9 @@
+apiVersion: v2
+name: immichframe
+description: Cluster-specific ImmichFrame deployment
+type: application
+version: 0.1.0
+dependencies:
+- name: immichframe
+  version: 0.0.0
+  repository: https://brunner.ninja/charts
diff --git a/apps/immichframe/templates/immichframe-api.yaml b/apps/immichframe/templates/immichframe-api.yaml
new file mode 100644
index 0000000..8988446
--- /dev/null
+++ b/apps/immichframe/templates/immichframe-api.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: immichframe-api
+  namespace: default
+spec:
+  encryptedData:
+    api-key: AgBO+AeSPCJx/9GvDbxJLMaCLI6XiNR3JINDkn9VnsQe7BRlWsp4dLo20y5eT0hyvOaSvOW0etzJbFM2NZ+s8JwsSFpt4AAwR6B+GxlrlRIqWgVUE/T6oaIoSycuHsQ4/mQxR8YUP5wA6l/tcWrSft7qDa99Ob5S/k4Pq0u8zuZrg3oRCZ6ReUJ/6+hbf9YIo/+JLW7WfcpjNmKUw2XWEJdoIUL65ne3VeqKQjJB7yV2jHQdXmbgRvWrhAATrQmsxkSMTtaQKxg/VxXmhcKTxDNPcJB6qezydp0/8VpElUWSEqTWKSSTZ4YAVV6sIBb1LUczkMZ5VwZFzM8v+B/m53HFfY+gzluEDvC4GMQYZH/jcPsOPFJxyNLCzkpXLUgnun3aRgtIwjgKN5pFQzf+e3rhWzswgxel1vD1t4kZPVkg/Jl6yUxp73rBsW1IFfNLrFrN48gzMGDy4nddt/VHxwshoP9OG4HPPza8l1tFDnedSBkuo62BPEaOQIZFAc19+P1gnSWpRkjKBqwCsIl1Vm6lFbAB6iVpEWlsDxIrboHVjM6Iff2FihF1KLaaAU3weuItHsnp9Jj37toZxkV8jBkb1Y+xtlS+0hS0sLOja0G05j/qk6jNNk40xmnSpKSb5tZMksr+ANrdodTmq+/IFyCGMvPgDpmluPRP8Rx8QmyDzJ/oM4bPMKCFcvNQNm+L+asvnjzQJed2FrXVUQ71FcDzotb4pdAXW7hziORMqrO5xuaQgyCs8KpV5w==
+  template:
+    metadata:
+      name: immichframe-api
+      namespace: default
+    type: Opaque
diff --git a/apps/immichframe/values.yaml b/apps/immichframe/values.yaml
new file mode 100644
index 0000000..5b16ed1
--- /dev/null
+++ b/apps/immichframe/values.yaml
@@ -0,0 +1,49 @@
+immichframe:
+  fullnameOverride: immichframe
+  replicaCount: 2
+
+  image:
+    pullPolicy: Always
+
+  timezone: Europe/Vienna
+
+  config:
+    general:
+      Interval: 15
+      ShowClock: false
+    accounts:
+    - immichServerUrl: https://immich.brunner.ninja
+      apiKeySecret:
+        name: immichframe-api
+        key: api-key
+      options:
+        Albums:
+        - 489d6c4d-d175-45e0-aeae-e2791dfc9658
+
+  ingress:
+    enabled: true
+    className: traefik
+    annotations:
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    hosts:
+    - host: immichframe.brunner.ninja
+      paths:
+      - path: /
+        pathType: Prefix
+
+  podDisruptionBudget:
+    enabled: true
+    minAvailable: 1
+
+  prometheusRule:
+    enabled: true
+    labels:
+      release: prometheus
+
+  resources:
+    requests:
+      cpu: 10m
+      memory: 256Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
diff --git a/bootstrap/project.yaml b/bootstrap/project.yaml
index 329c63f..dd40246 100644
--- a/bootstrap/project.yaml
+++ b/bootstrap/project.yaml
@@ -11,6 +11,8 @@ spec:
   - namespace: default
     server: https://kubernetes.default.svc
   namespaceResourceWhitelist:
+  - group: ""
+    kind: ConfigMap
   - group: ""
     kind: PersistentVolumeClaim
   - group: ""
@@ -21,5 +23,9 @@ spec:
     kind: Ingress
   - group: policy
     kind: PodDisruptionBudget
+  - group: monitoring.coreos.com
+    kind: PrometheusRule
   - group: monitoring.coreos.com
     kind: ServiceMonitor
+  - group: bitnami.com
+    kind: SealedSecret
diff --git a/scripts/update-immichframe-chart.sh b/scripts/update-immichframe-chart.sh
new file mode 100755
index 0000000..bc0979a
--- /dev/null
+++ b/scripts/update-immichframe-chart.sh
@@ -0,0 +1,36 @@
+#!/bin/sh
+set -eu
+
+if [ "$#" -ne 1 ] || ! printf '%s\n' "$1" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z.-]+)?$'; then
+  echo "usage: $0 <semantic-chart-version>" >&2
+  exit 2
+fi
+
+script_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+repository_dir=$(dirname -- "${script_dir}")
+chart="${repository_dir}/apps/immichframe/Chart.yaml"
+temporary="${chart}.tmp"
+
+awk -v version="$1" '
+  /^- name: immichframe$/ {
+    dependency = 1
+  }
+  dependency && /^  version: / {
+    if (updated) {
+      print "multiple immichframe dependency versions found" > "/dev/stderr"
+      exit 1
+    }
+    print "  version: " version
+    updated = 1
+    dependency = 0
+    next
+  }
+  { print }
+  END {
+    if (!updated) {
+      print "immichframe dependency version not found" > "/dev/stderr"
+      exit 1
+    }
+  }
+' "${chart}" > "${temporary}"
+mv "${temporary}" "${chart}"