diff --git a/ansible/host_vars/gpu-node.yaml b/ansible/host_vars/gpu-node.yaml
index 188db4d..2c8b52f 100644
--- a/ansible/host_vars/gpu-node.yaml
+++ b/ansible/host_vars/gpu-node.yaml
@@ -21,7 +21,8 @@ ufw_allowed_ports:
   - { port: "11434", proto: tcp, comment: "Ollama API" }
   - { port: "61208", proto: tcp, comment: "Glances web UI" }
 
-data_dirs: []
+data_dirs:
+  - /data/tts-gateway
 
 # ── nvidia ─────────────────────────────────────────────────────────────────────
 nvidia_driver_version: "570"
diff --git a/manifests/home-services/certs.yaml b/manifests/home-services/certs.yaml
index 2d5e978..ebedf7c 100644
--- a/manifests/home-services/certs.yaml
+++ b/manifests/home-services/certs.yaml
@@ -52,3 +52,22 @@ spec:
     - client auth
     - digital signature
     - key encipherment
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: tts-gateway-tls
+  namespace: home-services
+spec:
+  secretName: tts-gateway-tls
+  issuerRef:
+    name: internal-ca-issuer
+    kind: ClusterIssuer
+  commonName: tts-gateway
+  dnsNames:
+    - tts-gateway.home-services.svc.cluster.local
+    - tts-gateway
+  usages:
+    - server auth
+    - digital signature
+    - key encipherment
diff --git a/manifests/home-services/tts-gateway.yaml b/manifests/home-services/tts-gateway.yaml
new file mode 100644
index 0000000..37d5258
--- /dev/null
+++ b/manifests/home-services/tts-gateway.yaml
@@ -0,0 +1,136 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tts-gateway
+  namespace: home-services
+  labels:
+    app: tts-gateway
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: tts-gateway
+  template:
+    metadata:
+      labels:
+        app: tts-gateway
+    spec:
+      runtimeClassName: nvidia
+      nodeSelector:
+        nik4nao.com/gpu: "true"
+      tolerations:
+        - key: spot
+          operator: Equal
+          value: "true"
+          effect: NoSchedule
+      imagePullSecrets:
+        - name: gitea-registry-secret
+      containers:
+        - name: tts-gateway
+          image: gitea.nik4nao.com/nik/tts-gateway:latest
+          ports:
+            - containerPort: 50053
+              name: grpc
+          env:
+            - name: GRPC_PORT
+              value: "50053"
+            - name: INFERENCE_SIDECAR_ADDR
+              value: "localhost:50054"
+            - name: OTEL_ENDPOINT
+              value: "otel-collector-opentelemetry-collector.monitoring.svc.cluster.local:4317"
+            - name: LOG_LEVEL
+              value: "info"
+            - name: LOG_FORMAT
+              value: "json"
+            - name: TLS_DIR
+              value: /tls
+          readinessProbe:
+            tcpSocket:
+              port: 50053
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: 50053
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          volumeMounts:
+            - name: tls
+              mountPath: /tls
+              readOnly: true
+        # Needs an Nvidia GPU for net_g.infer() - only meaningfully runs on
+        # nik-gpu. Shares the pod network with tts-gateway so the Go side can
+        # reach it over localhost, mirroring the --network host setup used
+        # for local docker testing (see tts-gateway/README.md).
+        - name: tts-sidecar
+          image: gitea.nik4nao.com/nik/tts-sidecar:latest
+          ports:
+            - containerPort: 50054
+              name: http
+          env:
+            - name: PORT
+              value: "50054"
+            - name: CONFIG_PATH
+              value: /models/uma.json
+            - name: CHECKPOINT_PATH
+              value: /models/G_790000.pth
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 50054
+            initialDelaySeconds: 15
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 50054
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          resources:
+            requests:
+              cpu: 500m
+              memory: 3Gi
+              nvidia.com/gpu: 1
+            limits:
+              cpu: "2"
+              memory: 6Gi
+              nvidia.com/gpu: 1
+          volumeMounts:
+            - name: models
+              mountPath: /models
+              readOnly: true
+      volumes:
+        - name: tls
+          secret:
+            secretName: tts-gateway-tls
+        # Checkpoint/config aren't baked into the sidecar image (still an
+        # open decision per tts-gateway/README.md) - bind-mounted from
+        # /data/tts-gateway on nik-gpu instead. Populate with G_790000.pth
+        # and uma.json before this Deployment will go Ready.
+        - name: models
+          hostPath:
+            path: /data/tts-gateway
+            type: Directory
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: tts-gateway
+  namespace: home-services
+  labels:
+    app: tts-gateway
+spec:
+  selector:
+    app: tts-gateway
+  ports:
+    - name: grpc
+      port: 50053
+      targetPort: 50053
+  type: ClusterIP