diff --git a/aws/ec2-user-data.sh b/aws/ec2-user-data.sh
new file mode 100644
index 0000000..3289b63
--- /dev/null
+++ b/aws/ec2-user-data.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+# First-boot setup for the Gitea host on Amazon Linux 2023 (x86_64). Runs once as root.
+# No secrets in this file. Output goes to /var/log/user-data.log and the EC2 console.
+# Installs: 2 GB swap (t3.micro has 1 GB RAM), Docker, git, and a pinned, checksummed
+# Docker Compose plugin. Does NOT deploy Gitea: that is done by hand and documented.
+set -euxo pipefail
+exec > >(tee /var/log/user-data.log | logger -t user-data -s 2>/dev/console) 2>&1
+
+COMPOSE_VERSION="v5.6.0"
+# SHA-256 of docker-compose-linux-x86_64 for v5.6.0 (GitHub release asset digest and .sha256 file agree).
+COMPOSE_SHA256="40343e21ca777173e69cff5dbafeb37c6f81f3b0d57d9e597f036e95eb63e76a"
+
+# --- 2 GB swap file (idempotent) ---
+if ! swapon --show | grep -q /swapfile; then
+  dd if=/dev/zero of=/swapfile bs=1M count=2048
+  chmod 600 /swapfile
+  mkswap /swapfile
+  swapon /swapfile
+  grep -q '^/swapfile' /etc/fstab || echo '/swapfile swap swap defaults 0 0' >> /etc/fstab
+fi
+
+# --- Docker + git from the Amazon Linux repositories ---
+dnf install -y docker git
+systemctl enable --now docker
+usermod -aG docker ec2-user
+
+# --- Docker Compose plugin, pinned and verified ---
+PLUGIN_DIR=/usr/local/lib/docker/cli-plugins
+mkdir -p "$PLUGIN_DIR"
+curl -fsSL -o "$PLUGIN_DIR/docker-compose" \
+  "https://github.com/docker/compose/releases/download/${COMPOSE_VERSION}/docker-compose-linux-x86_64"
+echo "${COMPOSE_SHA256}  ${PLUGIN_DIR}/docker-compose" | sha256sum -c -
+chmod +x "$PLUGIN_DIR/docker-compose"
+
+# --- Record versions for the manual ---
+docker --version
+docker compose version
+git --version
+free -m
+swapon --show
+echo "user-data finished OK"