diff --git a/apps/monitoring/loki-deployment.yaml b/apps/monitoring/loki-deployment.yaml
new file mode 100644
index 0000000..ef2c662
--- /dev/null
+++ b/apps/monitoring/loki-deployment.yaml
@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: loki
+  namespace: monitoring
+  labels:
+    app: loki
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: loki
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        app: loki
+    spec:
+      # DEV-483 bridge fix: pin Loki to k3s-worker-2 so the loki-storage-encrypted
+      # RWO CSI volume co-locates with the backup-volumes CronJob (also on worker-2).
+      # Removed as part of DEV-482 step 6 once the legacy backup-volumes CronJob
+      # is retired (Option 4: restic -> Hetzner Object Storage).
+      nodeSelector:
+        kubernetes.io/hostname: k3s-worker-2
+      containers:
+      - name: loki
+        image: grafana/loki:2.9.2
+        args:
+        - -config.file=/etc/loki/loki.yaml
+        ports:
+        - containerPort: 3100
+          name: http
+        - containerPort: 9096
+          name: grpc
+        resources:
+          requests:
+            cpu: 200m
+            memory: 512Mi
+          limits:
+            cpu: 500m
+            memory: 1Gi
+        volumeMounts:
+        - name: loki-config
+          mountPath: /etc/loki
+        - name: loki-storage
+          mountPath: /loki
+      volumes:
+      - name: loki-config
+        configMap:
+          name: loki-config
+      - name: loki-storage
+        persistentVolumeClaim:
+          claimName: loki-storage-encrypted