diff --git a/clusters/base/apps/syncthing/helmrelease.yaml b/clusters/base/apps/syncthing/helmrelease.yaml
new file mode 100644
index 0000000..906795c
--- /dev/null
+++ b/clusters/base/apps/syncthing/helmrelease.yaml
@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: syncthing
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: syncthing/syncthing
+              tag: "2.1.3"
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8384
+
+    ingress:
+      app:
+        className: traefik
+        # the GUI has no auth of its own out of the box, so it's gated
+        # behind Authelia the same way fava/zigbee2mqtt are.
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+        hosts:
+          - host: sync.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: syncthing-tls
+            hosts:
+              - sync.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/syncthing
+      # same nfs-ganesha export webdav and markdown-vault-mcp use
+      # (10.0.64.5:/exports); mounted at the same container path (/data)
+      # as webdav so the layout matches (/data/shared/documents/...).
+      shared:
+        type: persistentVolumeClaim
+        existingClaim: syncthing-shared
+        globalMounts:
+          - path: /data
diff --git a/clusters/base/apps/syncthing/helmrepository.yaml b/clusters/base/apps/syncthing/helmrepository.yaml
new file mode 100644
index 0000000..c2395eb
--- /dev/null
+++ b/clusters/base/apps/syncthing/helmrepository.yaml
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"
diff --git a/clusters/base/apps/syncthing/kustomization.yaml b/clusters/base/apps/syncthing/kustomization.yaml
new file mode 100644
index 0000000..f32aaaf
--- /dev/null
+++ b/clusters/base/apps/syncthing/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - pv-pvc-shared.yaml
+  - helmrelease.yaml
diff --git a/clusters/base/apps/syncthing/pv-pvc-shared.yaml b/clusters/base/apps/syncthing/pv-pvc-shared.yaml
new file mode 100644
index 0000000..60e7290
--- /dev/null
+++ b/clusters/base/apps/syncthing/pv-pvc-shared.yaml
@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: syncthing-shared-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /exports
+  claimRef:
+    namespace: syncthing
+    name: syncthing-shared
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: syncthing-shared
+  namespace: syncthing
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: syncthing-shared-nfs
+  resources:
+    requests:
+      storage: 30Gi
diff --git a/clusters/base/namespaces/syncthing.yaml b/clusters/base/namespaces/syncthing.yaml
new file mode 100644
index 0000000..399f956
--- /dev/null
+++ b/clusters/base/namespaces/syncthing.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: syncthing
diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml
index 853b9fe..fffb412 100644
--- a/clusters/home/apps/kustomization.yaml
+++ b/clusters/home/apps/kustomization.yaml
@@ -12,4 +12,5 @@ resources:
   - nfs-ganesha.yaml
   - webdav.yaml
   - fava.yaml
-  - infcloud.yaml
\ No newline at end of file
+  - infcloud.yaml
+  - syncthing.yaml
\ No newline at end of file
diff --git a/clusters/home/apps/syncthing.yaml b/clusters/home/apps/syncthing.yaml
new file mode 100644
index 0000000..fed1deb
--- /dev/null
+++ b/clusters/home/apps/syncthing.yaml
@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: syncthing
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/syncthing
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml
index f01d15c..8a8d849 100644
--- a/clusters/home/namespaces/kustomization.yaml
+++ b/clusters/home/namespaces/kustomization.yaml
@@ -14,3 +14,4 @@ resources:
   - ../../base/namespaces/webdav.yaml
   - ../../base/namespaces/finance.yaml
   - ../../base/namespaces/nfs.yaml
+  - ../../base/namespaces/syncthing.yaml