diff --git a/helmfile.d/uptermd.yaml.gotmpl b/helmfile.d/uptermd.yaml.gotmpl
new file mode 100644
index 00000000..d665e03b
--- /dev/null
+++ b/helmfile.d/uptermd.yaml.gotmpl
@@ -0,0 +1,43 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: upterm
+  url: https://upterm.dev
+
+commonLabels:
+  tier: system
+
+releases:
+- name: uptermd
+  namespace: uptermd
+  chart: upterm/uptermd
+  version: 0.2.0
+  condition: uptermd.enabled
+  values:
+  - ../values/uptermd/values/values.yaml
+  - ../values/uptermd/values/values-{{ .Environment.Name }}.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/uptermd/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: uptermd
+  chart: manifests
+  condition: uptermd.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/uptermd/env.yaml.gotmpl
+  - ../values/uptermd/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/uptermd/manifests
+    - manifests
diff --git a/values/uptermd/env-hel1.yaml.gotmpl b/values/uptermd/env-hel1.yaml.gotmpl
new file mode 100644
index 00000000..26a494da
--- /dev/null
+++ b/values/uptermd/env-hel1.yaml.gotmpl
@@ -0,0 +1,2 @@
+uptermd:
+  enabled: true
diff --git a/values/uptermd/env.yaml.gotmpl b/values/uptermd/env.yaml.gotmpl
new file mode 100644
index 00000000..bc5373e8
--- /dev/null
+++ b/values/uptermd/env.yaml.gotmpl
@@ -0,0 +1,3 @@
+uptermd:
+  enabled: false
+  autosync: false
diff --git a/values/uptermd/kustomize/base/kustomization.yaml b/values/uptermd/kustomize/base/kustomization.yaml
new file mode 100644
index 00000000..57f354b1
--- /dev/null
+++ b/values/uptermd/kustomize/base/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - _manifest.yaml
diff --git a/values/uptermd/kustomize/default/kustomization.yaml b/values/uptermd/kustomize/default/kustomization.yaml
new file mode 100644
index 00000000..25e978c8
--- /dev/null
+++ b/values/uptermd/kustomize/default/kustomization.yaml
@@ -0,0 +1,24 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+patches:
+  - target:
+      kind: Ingress
+      name: uptermd
+    patch: |
+      $patch: delete
+      apiVersion: networking.k8s.io/v1
+      kind: Ingress
+      metadata:
+        name: uptermd
+  - target:
+      group: cert-manager.io
+      kind: Issuer
+      name: uptermd-letsencrypt
+    patch: |
+      $patch: delete
+      apiVersion: cert-manager.io/v1
+      kind: Issuer
+      metadata:
+        name: uptermd-letsencrypt
diff --git a/values/uptermd/manifests/ingress.yaml b/values/uptermd/manifests/ingress.yaml
new file mode 100644
index 00000000..95935971
--- /dev/null
+++ b/values/uptermd/manifests/ingress.yaml
@@ -0,0 +1,30 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: uptermd
+  namespace: uptermd
+  labels:
+    app.kubernetes.io/name: uptermd
+  annotations:
+    cert-manager.io/cluster-issuer: ca-issuer
+    haproxy.org/backend-protocol: h1
+    haproxy.org/timeout-tunnel: "3600s"
+    haproxy.org/timeout-client: "3600s"
+    haproxy.org/timeout-server: "3600s"
+spec:
+  ingressClassName: haproxy
+  rules:
+    - host: upterm.hel1.obx
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: uptermd
+                port:
+                  number: 80
+  tls:
+    - hosts:
+        - upterm.hel1.obx
+      secretName: uptermd-tls
diff --git a/values/uptermd/manifests/uptermd.yaml b/values/uptermd/manifests/uptermd.yaml
new file mode 100644
index 00000000..829d8e35
--- /dev/null
+++ b/values/uptermd/manifests/uptermd.yaml
@@ -0,0 +1,37 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: uptermd
+  namespace: argocd
+spec:
+  destination:
+    namespace: uptermd
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: uptermd.yaml.gotmpl
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+    {{- if .Values.uptermd.autosync }}
+    automated:
+      prune: true
+    {{- end }}
+{{- end }}
diff --git a/values/uptermd/values/values.yaml b/values/uptermd/values/values.yaml
new file mode 100644
index 00000000..c3a8fc12
--- /dev/null
+++ b/values/uptermd/values/values.yaml
@@ -0,0 +1,20 @@
+replicaCount: 1
+
+websocket:
+  enabled: true
+
+service:
+  type: ClusterIP
+
+resources:
+  limits:
+    memory: 512Mi
+  requests:
+    cpu: 100m
+    memory: 512Mi
+
+# No SSH host key is provided, so uptermd generates an ephemeral one on each
+# pod start
+host_keys: {}
+
+authorized_keys: []