diff --git a/servers/media-core/grimmory/.env.example b/servers/media-core/grimmory/.env.example
new file mode 100644
index 0000000..8735d33
--- /dev/null
+++ b/servers/media-core/grimmory/.env.example
@@ -0,0 +1,2 @@
+GRIMMORY_DB_PASSWORD=replace-with-a-random-password
+GRIMMORY_DB_ROOT_PASSWORD=replace-with-a-different-random-password
diff --git a/servers/media-core/grimmory/README.md b/servers/media-core/grimmory/README.md
new file mode 100644
index 0000000..6578cba
--- /dev/null
+++ b/servers/media-core/grimmory/README.md
@@ -0,0 +1,21 @@
+# Grimmory on media-core
+
+- LAN URL: `http://192.168.50.46:6060`
+- Existing library: `/mnt/truenas/multimedia/books` -> `/books` (read-only)
+- BookDrop: `/mnt/truenas/multimedia/curator/staging/grimmory` -> `/bookdrop`
+- Application data: `/opt/media-core/appdata/grimmory/data`
+- MariaDB data: `/opt/media-core/appdata/grimmory/mariadb`
+- Storage mode: `NETWORK`
+
+This is a parallel evaluation deployment. BookOrbit remains online and both
+applications may index the same final library, but only Grimmory's dedicated
+BookDrop is writable. Do not enable file rename, move, delete, or metadata
+write-back against `/books` during the evaluation.
+
+Create the first library at container path `/books`. Set
+`GRIMMORY_DB_PASSWORD` and `GRIMMORY_DB_ROOT_PASSWORD` only in the Arcane
+project environment; do not commit their values.
+
+Before an upgrade, dump the `grimmory` MariaDB database and back up
+`/opt/media-core/appdata/grimmory/data`. Image tags describe the release and
+the pinned OCI index digests are authoritative.
diff --git a/servers/media-core/grimmory/compose.yaml b/servers/media-core/grimmory/compose.yaml
new file mode 100644
index 0000000..7fa31f2
--- /dev/null
+++ b/servers/media-core/grimmory/compose.yaml
@@ -0,0 +1,88 @@
+x-arcane:
+  icon: book-open
+  urls:
+    - http://192.168.50.46:6060
+
+services:
+  grimmory:
+    image: ghcr.io/grimmory-tools/grimmory:v3.5.0@sha256:bf6fe21c6e247597f7869664a440b5a34242e2d2940575cae39c17bfaa66dc0b
+    container_name: grimmory
+    restart: unless-stopped
+    init: true
+    depends_on:
+      mariadb:
+        condition: service_healthy
+    ports:
+      - "6060:6060"
+    environment:
+      USER_ID: "1000"
+      GROUP_ID: "1000"
+      TZ: Asia/Shanghai
+      DATABASE_URL: jdbc:mariadb://mariadb:3306/grimmory
+      DATABASE_USERNAME: grimmory
+      DATABASE_PASSWORD: ${GRIMMORY_DB_PASSWORD:?set GRIMMORY_DB_PASSWORD in the Arcane project environment}
+      SWAGGER_ENABLED: "false"
+      FORCE_DISABLE_OIDC: "false"
+      DISK_TYPE: NETWORK
+    volumes:
+      - type: bind
+        source: /opt/media-core/appdata/grimmory/data
+        target: /app/data
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /mnt/truenas/multimedia/books
+        target: /books
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /mnt/truenas/multimedia/curator/staging/grimmory
+        target: /bookdrop
+        bind:
+          create_host_path: false
+    healthcheck:
+      test: ["CMD-SHELL", "wget -q --spider http://127.0.0.1:6060/api/v1/healthcheck"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 90s
+    labels:
+      com.getarcaneapp.arcane.icon: book-open
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"
+
+  mariadb:
+    image: lscr.io/linuxserver/mariadb:11.4.8@sha256:91de7f701bc7fc3a424b81beafca7a7c6c4c5b7c8be6afd2ae148698695c0b0c
+    container_name: grimmory-db
+    restart: unless-stopped
+    environment:
+      PUID: "1000"
+      PGID: "1000"
+      TZ: Asia/Shanghai
+      MYSQL_ROOT_PASSWORD: ${GRIMMORY_DB_ROOT_PASSWORD:?set GRIMMORY_DB_ROOT_PASSWORD in the Arcane project environment}
+      MYSQL_DATABASE: grimmory
+      MYSQL_USER: grimmory
+      MYSQL_PASSWORD: ${GRIMMORY_DB_PASSWORD:?set GRIMMORY_DB_PASSWORD in the Arcane project environment}
+    volumes:
+      - type: bind
+        source: /opt/media-core/appdata/grimmory/mariadb
+        target: /config
+        bind:
+          create_host_path: false
+    healthcheck:
+      test: ["CMD", "mariadb-admin", "ping", "-h", "localhost"]
+      interval: 5s
+      timeout: 5s
+      retries: 12
+      start_period: 30s
+    labels:
+      com.getarcaneapp.arcane.icon: mariadb
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"