diff --git a/roles/docker/defaults/main.yml b/roles/docker/defaults/main.yml
index b3ad3ce7..f5a54e71 100644
--- a/roles/docker/defaults/main.yml
+++ b/roles/docker/defaults/main.yml
@@ -164,6 +164,11 @@ services:
     version: a21f92bf74308d66cfcd545d49b81eba0211a222
     allowed_sender_domain: true
 
+  pinafore:
+    file: pinafore.yml
+    domain: "pinafore.{{ base_domain }}"
+    version: v2.4.0
+
   membersystem:
     file: membersystem.yml
     domain: "member.{{ base_domain }}"
diff --git a/roles/docker/tasks/services/pinafore.yml b/roles/docker/tasks/services/pinafore.yml
new file mode 100644
index 00000000..a275f3a1
--- /dev/null
+++ b/roles/docker/tasks/services/pinafore.yml
@@ -0,0 +1,14 @@
+- name: Set up Pinafore
+  docker_container:
+    name: pinafore
+    image: "docker.data.coop/pinafore:{{ services.pinafore.version }}"
+    restart_policy: unless-stopped
+    networks:
+      - name: external_services
+    env:
+      VIRTUAL_HOST: "{{ services.pinafore.domain }}"
+      VIRTUAL_PORT: "4002"
+      LETSENCRYPT_HOST: "{{ services.pinafore.domain }}"
+      LETSENCRYPT_EMAIL: "{{ letsencrypt_email }}"
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"