diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 65c99fa..8008d5e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -46,10 +46,12 @@ updates:
       - "/kubernetes/code/gitea"
       - "/kubernetes/code/harbor"
       - "/kubernetes/home/home-assisant"
+      - "/kubernetes/home/zigbee2mqtt"
       - "/kubernetes/infrastructure/authentik"
       - "/kubernetes/personal/linkwarden"
       - "/kubernetes/personal/notesnook"
       - "/kubernetes/personal/photoprism"
+      - "/kubernetes/production/umami"
       - "/kubernetes/system/csi-driver-nfs"
       - "/kubernetes/system/external-dns"
       - "/kubernetes/system/traefik"
diff --git a/kubernetes/production/umami/kustomization.yaml b/kubernetes/production/umami/kustomization.yaml
new file mode 100644
index 0000000..b3a1573
--- /dev/null
+++ b/kubernetes/production/umami/kustomization.yaml
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: umami
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: umami-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
diff --git a/kubernetes/production/umami/kustomizeconfig.yaml b/kubernetes/production/umami/kustomizeconfig.yaml
new file mode 100644
index 0000000..3365acc
--- /dev/null
+++ b/kubernetes/production/umami/kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease
diff --git a/kubernetes/production/umami/namespace.yaml b/kubernetes/production/umami/namespace.yaml
new file mode 100644
index 0000000..196046b
--- /dev/null
+++ b/kubernetes/production/umami/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: umami
diff --git a/kubernetes/production/umami/release.yaml b/kubernetes/production/umami/release.yaml
new file mode 100644
index 0000000..14efb2a
--- /dev/null
+++ b/kubernetes/production/umami/release.yaml
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: umami
+  namespace: umami
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: umami
+        namespace: umami
+      chart: umami
+      version: '7.1.0'
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: umami-values
diff --git a/kubernetes/production/umami/repository.yaml b/kubernetes/production/umami/repository.yaml
new file mode 100644
index 0000000..f6255a8
--- /dev/null
+++ b/kubernetes/production/umami/repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: umami
+  namespace: umami
+spec:
+  interval: 1m
+  url: https://charts.christianhuth.de
diff --git a/kubernetes/production/umami/values.yaml b/kubernetes/production/umami/values.yaml
new file mode 100644
index 0000000..fda5ce5
--- /dev/null
+++ b/kubernetes/production/umami/values.yaml
@@ -0,0 +1,33 @@
+ingress:
+    enabled: true
+    hosts:
+        - host: umami.lan
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+sops:
+    lastmodified: "2025-12-29T14:08:28Z"
+    mac: ENC[AES256_GCM,data:efRSNqXGpsn9fJqX5exXiq3HRM4BDyEGogVpiZTVBp3P+QWh5QZSNtE2DMTXIkOFSG52lEKUmKlRhBjO2RnwqaFWeYvuNnpJiIPwZXW0bq7kT5y48C+tuSznj2Shrk1MegqklK4ccFc/zQG56gANOcPZ7/vz6tW2jLD86qFRVmo=,iv:djmPGeibwyEF17F4izA7sRIb5zLzTDkokQzu8VKbqnE=,tag:V/hxBPmMnrgOx+zYiMjiSw==,type:str]
+    pgp:
+        - created_at: "2025-12-29T14:08:28Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+PhSbkqtutVp8cmBinvGyVxJTQVGeziuzgRRc67SsfZsh
+            TTbQ5SM3hNgK4lAKpdmdTaNk7pbtj8eTxCUe7F4kR4Rx0ReEI8o9B9v2KIe5SILW
+            n2fz0kEKRjKZW7uDojXNzSvQLEBV4RKejkAOyWalq0Wu1vG+wA2+Y5sN5OIK1eBT
+            z+F5nStfT7QPV5Jmb/lvZwTvTGDnvdFfwLBMraCrH3mvrnAHI4tRfz9UvbNQN/ip
+            KTMUdL8P2Ry3lHx99cDibVHs2e/BMVARVng4Lozc3KEBuF3/J2eURiGgQQw18dBe
+            tdMiaB1P2hlT0mtH9Z0IWgm3JDsduV3GgctE4UXtEk8b8SMrG5DRpmviWQ1IYJnR
+            EMOigatT/B2tr+5je02+F34KYl56WAZPZXrB4RZkxqtelhvo/GBxF/FdR54iDKvU
+            iPhXTx5Tkflk2NXTuAFRPSreAYSh4fjsI5ozkCmb5g1GX9FPbw5Sdz7wnD0z/nSn
+            obfkb5hfRdeUcXHQolwI5/5mhhpUH51cTF4pKExzgX5b6fHUgCo631/lFbI5fv1X
+            VmZ6sGi/pCv03fJ61TAg2xxwblJBVmoAF/+LYRBRqmcesHyiNGs/ko+GStR1DeBh
+            LVDoaTJAngEOrXIOu9zGonN6h9j09M5B7NWjs9+H1XkF6fEjfucrKCnvkRbMl0zS
+            XgFV4z7lrG/XI86xBUWULNPKkI/bD1bgQwHHkSslDTyfXgq5q5hlGqstJSC+Ga6l
+            MZkNV1Al0xlIGgveEamfnNN9jivgsISWIhts4GyYWTEypPJk2x1crLm5rqOFp2w=
+            =jgoW
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2