diff --git a/CLAUDE.md b/CLAUDE.md
index 90e9652..08c356e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -8,6 +8,8 @@ blumeops is Erich Blume's GitOps repository for personal infrastructure, orchest
 
 **CRITICAL: Public repo at github.com/eblume/blumeops - never commit secrets!**
 
+**Shell:** The user's shell is **fish**. Use `$status` not `$?` for exit codes. Use fish syntax in interactive examples.
+
 ## Rules
 
 1. **Always run `mise run zk-docs -- --style=header --color=never --decorations=always` at session start**
diff --git a/argocd/manifests/ntfy/deployment.yaml b/argocd/manifests/ntfy/deployment.yaml
index 55c27c7..7bff658 100644
--- a/argocd/manifests/ntfy/deployment.yaml
+++ b/argocd/manifests/ntfy/deployment.yaml
@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: ntfy
-          image: binwiederhier/ntfy:v2.17.0
+          image: registry.ops.eblu.me/blumeops/ntfy:v1.0.0
           args: ["serve", "--config", "/etc/ntfy/server.yml"]
           ports:
             - containerPort: 80
diff --git a/containers/ntfy/Dockerfile b/containers/ntfy/Dockerfile
new file mode 100644
index 0000000..b371aa0
--- /dev/null
+++ b/containers/ntfy/Dockerfile
@@ -0,0 +1,62 @@
+# ntfy push notification server
+# Three-stage build: Web UI (Node), server (Go+SQLite), runtime (Alpine)
+
+ARG NTFY_VERSION=v2.17.0
+ARG NTFY_COMMIT=a03a37feb1869e84e3af0dd6190bdc7183f211ec
+
+FROM node:22-alpine AS web-build
+
+ARG NTFY_COMMIT
+RUN apk add --no-cache git
+
+RUN mkdir /app && cd /app \
+    && git init \
+    && git remote add origin https://forge.ops.eblu.me/eblume/ntfy.git \
+    && git fetch --depth 1 origin ${NTFY_COMMIT} \
+    && git checkout FETCH_HEAD
+
+WORKDIR /app/web
+RUN npm ci
+RUN npm run build
+
+FROM golang:alpine3.22 AS build
+
+ARG NTFY_VERSION
+ARG NTFY_COMMIT
+RUN apk add --no-cache build-base git
+
+RUN mkdir /app && cd /app \
+    && git init \
+    && git remote add origin https://forge.ops.eblu.me/eblume/ntfy.git \
+    && git fetch --depth 1 origin ${NTFY_COMMIT} \
+    && git checkout FETCH_HEAD
+
+WORKDIR /app
+
+# Copy pre-built web UI assets
+COPY --from=web-build /app/web/build /app/server/site
+
+# Create docs placeholder with dummy file (go:embed requires non-empty dir)
+RUN mkdir -p server/docs && touch server/docs/placeholder
+
+ENV CGO_ENABLED=1
+
+RUN go build \
+    -o /ntfy \
+    -tags sqlite_omit_load_extension,osusergo,netgo \
+    -ldflags "-linkmode=external -extldflags=-static -s -w -X main.version=${NTFY_VERSION}"
+
+FROM alpine:3.22
+
+LABEL org.opencontainers.image.title=ntfy
+LABEL org.opencontainers.image.description="ntfy is a simple HTTP-based pub-sub notification service"
+LABEL org.opencontainers.image.source=https://github.com/binwiederhier/ntfy
+
+RUN apk --no-cache add tzdata
+
+COPY --from=build /ntfy /usr/bin/ntfy
+
+EXPOSE 80
+
+USER 65534
+ENTRYPOINT ["/usr/bin/ntfy"]
diff --git a/docs/changelog.d/feature-ntfy-container.infra.md b/docs/changelog.d/feature-ntfy-container.infra.md
new file mode 100644
index 0000000..869e5a0
--- /dev/null
+++ b/docs/changelog.d/feature-ntfy-container.infra.md
@@ -0,0 +1 @@
+Port ntfy to a locally built container image from forge mirror source.