diff --git a/roles/docker/defaults/main.yml b/roles/docker/defaults/main.yml
index b3ad3ce..64751e1 100644
--- a/roles/docker/defaults/main.yml
+++ b/roles/docker/defaults/main.yml
@@ -164,6 +164,11 @@ services:
     version: a21f92bf74308d66cfcd545d49b81eba0211a222
     allowed_sender_domain: true
 
+  pinafore:
+    file: pinafore.yml
+    domain: "pinafore.{{ base_domain }}"
+    version: 2.4.0
+
   membersystem:
     file: membersystem.yml
     domain: "member.{{ base_domain }}"
diff --git a/roles/docker/tasks/services/pinafore.yml b/roles/docker/tasks/services/pinafore.yml
new file mode 100644
index 0000000..9f61956
--- /dev/null
+++ b/roles/docker/tasks/services/pinafore.yml
@@ -0,0 +1,11 @@
+- name: Set up Pinafore
+  docker_container:
+    name: pinafore
+    image: "docker.data.coop/pinafore:{{ services.pinafore.version }}"
+    restart_policy: unless-stopped
+    networks:
+      - name: external_services
+    VIRTUAL_HOST: "{{ services.pinafore.domain }}"
+    VIRTUAL_PORT: 4002
+    labels:
+      com.centurylinklabs.watchtower.enable: "true"