diff --git a/kustomize/base/frontend/deployment.yaml b/kustomize/base/frontend/deployment.yaml
new file mode 100644
index 0000000..771f078
--- /dev/null
+++ b/kustomize/base/frontend/deployment.yaml
@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trade-frontend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: trade-frontend
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: trade-frontend
+    spec:
+      imagePullSecrets:
+        - name: gitea-registry
+      containers:
+        - name: frontend
+          image: rv32i.pl/trade/trade-frontend:k3s-20260106013603
+          imagePullPolicy: IfNotPresent
+          ports:
+            - name: http
+              containerPort: 8081
+          env:
+            - name: PORT
+              value: "8081"
+            - name: APP_VERSION
+              value: "staging"
+            - name: API_UPSTREAM
+              value: "http://trade-api:8787"
+            - name: BASIC_AUTH_FILE
+              value: "/tokens/frontend.json"
+            - name: API_READ_TOKEN_FILE
+              value: "/tokens/read.json"
+          volumeMounts:
+            - name: tokens
+              mountPath: /tokens
+              readOnly: true
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 2
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+      volumes:
+        - name: tokens
+          secret:
+            secretName: trade-frontend-tokens