diff --git a/.do/deploy.template.yaml b/.do/deploy.template.yaml
new file mode 100644
index 000000000..7f612a034
--- /dev/null
+++ b/.do/deploy.template.yaml
@@ -0,0 +1,60 @@
+# DigitalOcean "Deploy to DO" one-click button template.
+#
+# The button at cloud.digitalocean.com/apps/new?repo=... looks for this exact
+# filename (.do/deploy.template.yaml) and requires the App Spec to be nested
+# under a top-level `spec:` key. The sibling `.do/app.yaml` keeps the flat
+# format used by `doctl apps create --spec` and the App Platform UI.
+#
+# Keep these two files in sync — both deploy the headless Rust core
+# (`openhuman-core`) from the repo Dockerfile, exposing JSON-RPC on http_port.
+# After deploy:
+#   - /health is publicly reachable (no auth — used for liveness)
+#   - /rpc requires Authorization: Bearer $OPENHUMAN_CORE_TOKEN
+#
+# Operators MUST set OPENHUMAN_CORE_TOKEN to a strong secret in App Platform's
+# environment editor before any client calls /rpc.
+
+spec:
+  name: openhuman-core
+  region: nyc
+
+  services:
+    - name: core
+      dockerfile_path: Dockerfile
+      source_dir: /
+      github:
+        repo: tinyhumansai/openhuman
+        branch: main
+        deploy_on_push: false
+      instance_count: 1
+      instance_size_slug: basic-xs
+      http_port: 7788
+      health_check:
+        http_path: /health
+        initial_delay_seconds: 20
+        period_seconds: 30
+        timeout_seconds: 5
+        success_threshold: 1
+        failure_threshold: 3
+      envs:
+        - key: OPENHUMAN_CORE_HOST
+          scope: RUN_TIME
+          value: "0.0.0.0"
+        - key: OPENHUMAN_CORE_PORT
+          scope: RUN_TIME
+          value: "7788"
+        - key: OPENHUMAN_APP_ENV
+          scope: RUN_TIME
+          value: production
+        - key: BACKEND_URL
+          scope: RUN_TIME
+          value: https://api.tinyhumans.ai
+        - key: RUST_LOG
+          scope: RUN_TIME
+          value: info
+        # Required for clients to authenticate against /rpc. Set to a strong
+        # random value (e.g. `openssl rand -hex 32`) in the App Platform UI.
+        - key: OPENHUMAN_CORE_TOKEN
+          scope: RUN_TIME
+          type: SECRET
+          value: "CHANGE_ME_BEFORE_DEPLOY"