diff --git a/compose-snippets/watchtower.yml b/compose-snippets/watchtower.yml
new file mode 100644
index 0000000..fef1786
--- /dev/null
+++ b/compose-snippets/watchtower.yml
@@ -0,0 +1,21 @@
+# Watchtower — auto-pull updated images and restart containers
+# Prerequisites: docker login git.thewichersfamily.com on the Pi first.
+#
+# To limit to specific containers only, add this label to them:
+#   com.centurylinklabs.watchtower.enable: "true"
+# Then add WATCHTOWER_LABEL_ENABLE=true below.
+
+services:
+  watchtower:
+    image: containrrr/watchtower:latest
+    container_name: watchtower
+    restart: unless-stopped
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /root/.docker/config.json:/config.json:ro
+    environment:
+      - WATCHTOWER_POLL_INTERVAL=300     # check every 5 min
+      - WATCHTOWER_CLEANUP=true          # remove old image layers after update
+      - WATCHTOWER_INCLUDE_STOPPED=false
+      # Optional ntfy notification on updates:
+      # - WATCHTOWER_NOTIFICATION_URL=generic+https://ntfy.thewichersfamily.com/watchtower