diff --git a/.gitea/workflows/server-deploy.yml b/.gitea/workflows/server-deploy.yml
index c3dc78d..d94c61c 100644
--- a/.gitea/workflows/server-deploy.yml
+++ b/.gitea/workflows/server-deploy.yml
@@ -53,3 +53,10 @@ jobs:
                   # Root context: sitesvc depends on the shared module.
                   docker build -t "$IMAGE" -f sitesvc/Dockerfile .
                   docker push "$IMAGE"
+
+            - name: Build and push admin image
+              run: |
+                  IMAGE="${{ vars.DOCKER_HOST }}/${{ github.repository_owner }}/vantage/admin:latest"
+                  # Root context: admin depends on the shared module.
+                  docker build -t "$IMAGE" -f admin/Dockerfile .
+                  docker push "$IMAGE"
diff --git a/deploy/docker-compose.site.yml b/deploy/docker-compose.site.yml
index ec7f797..3548af3 100644
--- a/deploy/docker-compose.site.yml
+++ b/deploy/docker-compose.site.yml
@@ -25,3 +25,29 @@ services:
             SMTP_PASSWORD: ${SITE_SMTP_PASSWORD:-}
             SMTP_FROM: ${SITE_SMTP_FROM:-}
             SMTP_TO: ${SITE_SMTP_TO:-support@hostxtra.co.uk}
+
+    # The licensing authority. LICENSE_SIGNING_KEY appears in exactly one
+    # service in exactly one compose file: here. It must never be added to
+    # `server`, and docker-compose.yml -- the self-hosted deployment -- must
+    # not mention admin at all.
+    admin:
+        image: gitea.hostxtra.co.uk/mrhid6/vantage/admin:latest
+        restart: unless-stopped
+        ports:
+            - 8083:8083
+        environment:
+            PORT: "8083"
+            ADMIN_MONGO_URI: ${ADMIN_MONGO_URI:-}
+            CONTROL_MONGO_URI: ${CONTROL_MONGO_URI:-}
+            REDIS_ADDR: redis:6379
+            LICENSE_SIGNING_KEY: ${LICENSE_SIGNING_KEY:-}
+            PUBLIC_URL: ${ADMIN_PUBLIC_URL:-}
+            ADMIN_ORIGIN: ${ADMIN_ORIGIN:-}
+            TRUST_PROXY: ${ADMIN_TRUST_PROXY:-true}
+            SMTP_HOST: ${SITE_SMTP_HOST:-}
+            SMTP_PORT: ${SITE_SMTP_PORT:-587}
+            SMTP_USERNAME: ${SITE_SMTP_USERNAME:-}
+            SMTP_PASSWORD: ${SITE_SMTP_PASSWORD:-}
+            SMTP_FROM: ${SITE_SMTP_FROM:-}
+        depends_on:
+            - redis