diff --git a/Caddyfile b/Caddyfile
index 5967cb0..7764dd7 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -473,6 +473,14 @@ plane.ginnoir.com {
 	}
 }
 
+# =============================================================
+# PHOTOS — internal only
+# =============================================================
+photos.ginnoir.com {
+	import internal_only
+	reverse_proxy immich-server:2283
+}
+
 # =============================================================
 # NOTES / PKM — internal only (LiveSync over LAN or tailnet)
 # =============================================================
diff --git a/stacks/photos/docker-compose.yml b/stacks/photos/docker-compose.yml
new file mode 100644
index 0000000..fda0fba
--- /dev/null
+++ b/stacks/photos/docker-compose.yml
@@ -0,0 +1,64 @@
+# photos stack — Immich self-hosted photo backup.
+# Upload storage on ZFS (/storage1/labdata/immich/upload).
+# Config/DB on SSD (/config/immich/).
+# Internal-only: photos.ginnoir.com requires LAN or tailnet.
+
+services:
+  immich-server:
+    container_name: immich-server
+    image: ghcr.io/immich-app/immich-server:release
+    restart: unless-stopped
+    networks: [photos, edge]
+    env_file:
+      - stack.env
+    volumes:
+      - /storage1/labdata/immich/upload:/usr/src/app/upload
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "2283:2283"
+    depends_on:
+      - immich-redis
+      - immich-postgres
+
+  immich-machine-learning:
+    container_name: immich-machine-learning
+    image: ghcr.io/immich-app/immich-machine-learning:release
+    restart: unless-stopped
+    networks: [photos]
+    env_file:
+      - stack.env
+    volumes:
+      - /config/immich/model-cache:/cache
+
+  immich-redis:
+    container_name: immich-redis
+    image: docker.io/redis:6.2-alpine
+    restart: unless-stopped
+    networks: [photos]
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+  immich-postgres:
+    container_name: immich-postgres
+    image: ghcr.io/immich-app/postgres:14-vectorchord0.3.0-pgvectors0.3.0
+    restart: unless-stopped
+    networks: [photos]
+    env_file:
+      - stack.env
+    environment:
+      POSTGRES_PASSWORD: ${DB_PASSWORD}
+      POSTGRES_USER: ${DB_USERNAME}
+      POSTGRES_DB: ${DB_DATABASE_NAME}
+      POSTGRES_INITDB_ARGS: '--data-checksums'
+    volumes:
+      - /config/immich/pgdata:/var/lib/postgresql/data
+    labels:
+      com.centurylabs.watchtower.enable: "false"
+
+networks:
+  photos:
+    name: photos
+    driver: bridge
+  edge:
+    name: edge
+    external: true
diff --git a/stacks/photos/stack.env b/stacks/photos/stack.env
new file mode 100644
index 0000000..839b26a
--- /dev/null
+++ b/stacks/photos/stack.env
@@ -0,0 +1,15 @@
+PUID=1000
+PGID=1000
+TZ=America/Chicago
+
+# Postgres
+DB_HOSTNAME=immich-postgres
+DB_USERNAME=immich
+DB_PASSWORD=UXhnm2Gzzlm2nmJP1xWbc5L3M9Dt9TpG
+DB_DATABASE_NAME=immich
+
+# Redis
+REDIS_HOSTNAME=immich-redis
+
+# Immich
+UPLOAD_LOCATION=/usr/src/app/upload