diff --git a/.env.example b/.env.example
index df9db2d..19919cb 100644
--- a/.env.example
+++ b/.env.example
@@ -12,6 +12,11 @@ CORS_ALLOWED_ORIGINS=https://bridzik.liptim.eu
 # Shared secret for the self-hosted /api/admin/* stats endpoints.
 ADMIN_TOKEN=tajneheslo
 
+# pgAdmin login (UI bound to 127.0.0.1:8081 on the host -- access via SSH tunnel,
+# never expose publicly since it has full access to the Postgres data).
+PGADMIN_DEFAULT_EMAIL=admin@example.com
+PGADMIN_DEFAULT_PASSWORD=zmen_ma
+
 # Fernet key encrypting Player.totp_secret at rest. Generate with:
 #   python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
 # Keep it stable across restarts/redeploys -- losing it locks every account
diff --git a/docker-compose.prod.yaml b/docker-compose.prod.yaml
index e13027e..5cea56b 100644
--- a/docker-compose.prod.yaml
+++ b/docker-compose.prod.yaml
@@ -18,6 +18,19 @@ services:
     networks:
       caddy_network:
 
+  pgadmin:
+    image: dpage/pgadmin4:latest
+    environment:
+      PGADMIN_DEFAULT_EMAIL: ${PGADMIN_DEFAULT_EMAIL}
+      PGADMIN_DEFAULT_PASSWORD: ${PGADMIN_DEFAULT_PASSWORD}
+    volumes:
+      - pgadmin_data:/var/lib/pgadmin
+    restart: always
+    depends_on:
+      - db
+    networks:
+      caddy_network:
+
   backend:
     build: .
     environment:
@@ -47,6 +60,7 @@ services:
 
 volumes:
   pgdata:
+  pgadmin_data:
 
 networks:
   caddy_network: