diff --git a/apps/argo/kargo.yaml b/apps/argo/kargo.yaml
new file mode 100644
index 0000000..3614c07
--- /dev/null
+++ b/apps/argo/kargo.yaml
@@ -0,0 +1,44 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kargo
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "100"
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: argo
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    server: "https://kubernetes.default.svc"
+    namespace: kargo
+  source:
+    chart: kargo
+    repoURL: ghcr.io/akuity/kargo-charts
+    targetRevision: 0.6.0
+    helm:
+      releaseName: kargo
+      valuesObject:
+        api:
+          tls:
+            enabled: false
+          host: kargo.cthulhu.k8s.vxm.cz
+          ingress:
+            enabled: true
+            ingressClassName: nginx
+            annotations:
+              cert-manager.io/cluster-issuer: letsencrypt-dns-production
+              cert-manager.io/issue-temporary-certificate: "true" # issue temporary certificate before we get the real one
+            pathType: Prefix
+            tls:
+              enabled: true
+              selfSignedCert: false
+          adminAccount:
+            passwordHash: "$2a$10$Nw17cb5DQDmgi8oMyNzf8em5pdbXcDnQ/WvKVplAe7Eob43dKY8C." # admin
+            tokenSigningKey: klDmTci4Sazfr9xA75lmczGLBNU8zzKLMwhyi3c