diff --git a/README.md b/README.md
index 13bdec7..e6b5015 100644
--- a/README.md
+++ b/README.md
@@ -32,7 +32,7 @@ configs/                   # mirrored app configs (caddy, taler, forgejo, …)
   taler-exchange/          # exchange conf (inside ansible container)
   taler-exchange-ansible/  # container taler-hacktivism-exchange-ansible
   forgejo/                 # rootless git.hacktivism.ch
-  castopod/ bonfire/ prime/ # compose mirrors (no secret values)
+  castopod/ bonfire/ lemmy/ prime/ # compose mirrors (no secret values)
   tops/                    # koopa-tops-ng1…ng3 + autostart unit
   tor/                     # KoopaRelay ORPort 8080
 scripts/                   # merchant, exchange, monitoring helpers
@@ -52,6 +52,7 @@ scripts/                   # merchant, exchange, monitoring helpers
 | `taler-hacktivism-bank` | libeufin-bank (GOA) | **9012** (+ landing **9013**) |
 | `koopa-castopod` (+ mariadb/redis) | Castopod | **9020** |
 | `koopa-bonfire` (+ postgres) | Bonfire | **9021** |
+| `koopa-lemmy-proxy` (+ lemmy/ui/pictrs/db) | Lemmy | **9026** |
 | `koopa-prime-jellyfin` | Jellyfin | **9022** |
 | `koopa-prime-qbittorrent` | qBittorrent | **9023** |
 | `koopa-forgejo` (+ postgres) | Forgejo rootless | **9024** + SSH **9200** |
@@ -62,8 +63,8 @@ Start model (exchange): `~/ansible-taler-exchange/` → `run-container-koopa.sh`
 Start model (user apps): `hernani` → `cd ~/koopa-* && podman-compose up -d`.  
 Start model (tops): user unit `container-koopa-tops.service` (linger).
 
-Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`** / `tops.ng1`–`ng3`.hacktivism.ch  
-(Caddy → 9010–9015 / 9020–**9024** / **9090–9092**; git-SSH host **9200** direct).
+Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / `bonfire.` / `prime.` / `bt.` / **`git.hacktivism.ch`** / `lemmy.` / `tops.ng1`–`ng3`.hacktivism.ch  
+(Caddy → 9010–9015 / 9020–**9026** / **9090–9092**; git-SSH host **9200** direct).
 
 Service **details**: `configs/taler-hacktivism*`, `configs/taler-exchange*`, `configs/forgejo/`, `configs/tops/`, `scripts/*`.  
 Host-wide picture: **`host/overview/services.md`**.  
diff --git a/configs/README.md b/configs/README.md
index 1fff7ba..a0904e0 100644
--- a/configs/README.md
+++ b/configs/README.md
@@ -9,7 +9,7 @@ Directories are named to match **live podman container names** where possible.
 | `taler-exchange/` | conf inside exchange container | (see exchange-ansible) |
 | `taler-exchange-ansible/` | **`taler-hacktivism-exchange-ansible`** | `taler-hacktivism-exchange-ansible:landing` |
 | `bank-landing/` `exchange-landing/` `merchant-landing/` | nginx landing snippets | ports 9013–9015 |
-| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, … | compose mirrors |
+| `koopa-*` apps | `koopa-castopod`, `koopa-bonfire`, `koopa-lemmy`, … | compose mirrors |
 | `tops/` | `koopa-tops-ng1` … `ng3` | `nginxinc/nginx-unprivileged:1.27-alpine` (non-root, :8080) |
 | `caddy/` `firewalld/` `systemd/` | host services | |
 | `tor/` | **`koopa-tor-relay`** (podman host net) | `localhost/koopa-tor-relay:latest` (**non-root** uid 1000) |
diff --git a/configs/lemmy/README.md b/configs/lemmy/README.md
index 7c4d754..6f22c5a 100644
--- a/configs/lemmy/README.md
+++ b/configs/lemmy/README.md
@@ -10,9 +10,12 @@
 
 Secrets: host `~/koopa-lemmy/{.env,lemmy.hjson}` (mode 600). Not in this repo.
 
+Theme: `extra_themes/hacktivism-overrides.css` + `scripts/lemmy/apply-branding.sh` (exchange-dark, same palette as Bonfire).
+
 ```bash
 cd ~/koopa-lemmy && set -a && source .env && set +a && podman-compose up -d
 scripts/lemmy/install-systemd.sh
+scripts/lemmy/apply-branding.sh
 ```
 
 Daylog: `2026/2026-08-17--lemmy.md`.
diff --git a/configs/lemmy/compose.yml b/configs/lemmy/compose.yml
index 66112de..01fa6e8 100644
--- a/configs/lemmy/compose.yml
+++ b/configs/lemmy/compose.yml
@@ -54,6 +54,9 @@ services:
       - LEMMY_UI_LEMMY_INTERNAL_HOST=lemmy:8536
       - LEMMY_UI_LEMMY_EXTERNAL_HOST=${LEMMY_HOSTNAME}
       - LEMMY_UI_HTTPS=true
+      - LEMMY_UI_EXTRA_THEMES_FOLDER=/app/extra_themes
+    volumes:
+      - ./extra_themes:/app/extra_themes:ro
     depends_on:
       - lemmy
     restart: unless-stopped
diff --git a/configs/lemmy/extra_themes/hacktivism-overrides.css b/configs/lemmy/extra_themes/hacktivism-overrides.css
new file mode 100644
index 0000000..9546381
--- /dev/null
+++ b/configs/lemmy/extra_themes/hacktivism-overrides.css
@@ -0,0 +1,54 @@
+/* hacktivism — same palette as bonfire/git.hacktivism.ch (exchange-dark) */
+:root,
+[data-bs-theme=dark],
+[data-bs-theme=light] {
+  --bs-primary: #e8a838;
+  --bs-primary-rgb: 232, 168, 56;
+  --bs-secondary: #3d3128;
+  --bs-secondary-rgb: 61, 49, 40;
+  --bs-success: #16a34a;
+  --bs-info: #3ecfbf;
+  --bs-info-rgb: 62, 207, 191;
+  --bs-warning: #f0d090;
+  --bs-body-color: #fff6e8;
+  --bs-body-color-rgb: 255, 246, 232;
+  --bs-body-bg: #1a1410;
+  --bs-body-bg-rgb: 26, 20, 16;
+  --bs-emphasis-color: #fff6e8;
+  --bs-secondary-color: #ebe0d0;
+  --bs-tertiary-bg: #221c16;
+  --bs-border-color: #2a2018;
+  --bs-link-color: #e8a838;
+  --bs-link-color-rgb: 232, 168, 56;
+  --bs-link-hover-color: #f0d090;
+  --bs-link-hover-color-rgb: 240, 208, 144;
+}
+body {
+  background-color: #1a1410 !important;
+  color: #fff6e8 !important;
+}
+.navbar,
+.navbar-dark,
+.bg-dark,
+.navbar.bg-dark {
+  background-color: #14110e !important;
+}
+.navbar .navbar-brand,
+.navbar .nav-link.active {
+  color: #e8a838 !important;
+}
+.btn-primary {
+  background-color: #e8a838 !important;
+  border-color: #e8a838 !important;
+  color: #1a1410 !important;
+}
+.card,
+.list-group-item,
+.post-listing,
+.comment {
+  background-color: #221c16 !important;
+  color: #fff6e8 !important;
+  border-color: #2a2018 !important;
+}
+a { color: #e8a838 !important; }
+a:hover { color: #f0d090 !important; }
diff --git a/host/caddy/README.md b/host/caddy/README.md
index a38be73..47c3d3a 100644
--- a/host/caddy/README.md
+++ b/host/caddy/README.md
@@ -8,7 +8,7 @@ Canonical mirror in this repo: **`configs/caddy/Caddyfile`** (same content as `h
 | **9000** | HTTP + ACME webroot + HTTPS redirect |
 | **9001** | HTTPS vhosts |
 
-Public sites: `taler` / `exchange` / `bank` / `castopod` / `bonfire` / `prime` / `bt` / **`git`** / **`paivana`** / tops.ng*.  
+Public sites: `taler` / `exchange` / `bank` / `castopod` / `bonfire` / `prime` / `bt` / **`git`** / **`paivana`** / **`lemmy`** / tops.ng*.  
 Forgejo HTTP: Caddy → `127.0.0.1:9024`. Git SSH is **host :9200** (not Caddy).  
 Paivana: Caddy → `127.0.0.1:9025`.
 
diff --git a/scripts/README.md b/scripts/README.md
index f08bb2f..daa0bfa 100644
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -16,6 +16,7 @@
 | `nym/` | **koopa-nym** build/up/status (nym.com nym-node) |
 | `taler-wallet-cli/` | thin wrappers; **benchmarks live in** `../benchmarks/` |
 | `castopod/` | host `hernani` podman-compose `~/koopa-castopod` — see `castopod/README.md` |
+| `lemmy/` | host `hernani` podman-compose `~/koopa-lemmy` — see `configs/lemmy/README.md` |
 
 **Secrets:** never in this tree — sibling **`../koopa-admin-secrets`** (`koopa/host-root/<service>/` ↔ `/root/` on host; `containers/…/secrets/` for in-container).
 
diff --git a/scripts/lemmy/apply-branding.sh b/scripts/lemmy/apply-branding.sh
new file mode 100755
index 0000000..6d402aa
--- /dev/null
+++ b/scripts/lemmy/apply-branding.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+# Build extra_themes/hacktivism.css (darkly + hacktivism overrides) and set site default.
+set -euo pipefail
+LIVE="${HOME}/koopa-lemmy"
+ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
+OVERRIDES="${ROOT}/configs/lemmy/extra_themes/hacktivism-overrides.css"
+OUT="${LIVE}/extra_themes/hacktivism.css"
+
+mkdir -p "${LIVE}/extra_themes"
+podman exec koopa-lemmy-ui cat /app/dist/assets/css/themes/darkly.css > "${OUT}"
+cat "${OVERRIDES}" >> "${OUT}"
+echo "wrote ${OUT} ($(wc -l < "${OUT}") lines)"
diff --git a/scripts/login-health/README.md b/scripts/login-health/README.md
index 6a368b3..04b1a6b 100644
--- a/scripts/login-health/README.md
+++ b/scripts/login-health/README.md
@@ -65,7 +65,7 @@ overall: OK   ok=42 warn=0 fail=0
 | Git SSH | TCP `:9200` |
 
 **Critical** (→ overall FAIL): merchant, exchange, bank, forgejo, edge/critical ports.  
-**Optional** (→ WARN): castopod, bonfire, prime, bt, paivana, tops, tor, nym.
+**Optional** (→ WARN): castopod, bonfire, lemmy, prime, bt, paivana, tops, tor, nym.
 
 Read-only. No restarts, no secrets.