diff --git a/cluster/platform/nfs-csi/application.yaml b/cluster/platform/nfs-csi/application.yaml
new file mode 100644
index 0000000..eb7a348
--- /dev/null
+++ b/cluster/platform/nfs-csi/application.yaml
@@ -0,0 +1,39 @@
+# ------------------------------------------------------------------------------
+# Platform: nfs-csi
+# Wave 2 — no secret dependencies; must be ready before stateful workloads
+# Multi-source: Helm chart from upstream + StorageClass manifest
+# ------------------------------------------------------------------------------
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: nfs-csi
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: default
+  sources:
+    # Source 1: Helm chart from upstream
+    - repoURL: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
+      chart: csi-driver-nfs
+      targetRevision: v4.9.0
+      helm:
+        valueFiles:
+          - $values/cluster/platform/nfs-csi/values.yaml
+    # Source 2: Repo — values ref + StorageClass
+    - repoURL: https://gitea.mk-labs.cloud/rblundon/homelab.git
+      targetRevision: main
+      path: cluster/platform/nfs-csi
+      ref: values
+      directory:
+        exclude: "application.yaml"
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: kube-system
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
diff --git a/cluster/platform/nfs-csi/storageclass.yaml b/cluster/platform/nfs-csi/storageclass.yaml
new file mode 100644
index 0000000..be62b9d
--- /dev/null
+++ b/cluster/platform/nfs-csi/storageclass.yaml
@@ -0,0 +1,29 @@
+# ------------------------------------------------------------------------------
+# StorageClass: nfs-emporium
+# Provisioner: nfs.csi.k8s.io (csi-driver-nfs)
+# Server: emporium (Synology DS1621+) — 10.1.71.9
+# Export: /volume1/fastpass
+#
+# Dynamic provisioning: each PVC gets a subdirectory under /volume1/fastpass
+# archiveOnDelete=false means the directory is deleted when the PVC is deleted.
+# Set to "true" if you want data retained after PVC deletion.
+# ------------------------------------------------------------------------------
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-emporium
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 10.1.71.9
+  share: /volume1/fastpass
+  # Create a unique subdirectory per PVC (dynamic provisioning)
+  subDir: ${pvc.metadata.namespace}/${pvc.metadata.name}
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+mountOptions:
+  - nfsvers=4.1
+  - hard
+  - timeo=600
+  - retrans=3
diff --git a/cluster/platform/nfs-csi/values.yaml b/cluster/platform/nfs-csi/values.yaml
new file mode 100644
index 0000000..c90e6e5
--- /dev/null
+++ b/cluster/platform/nfs-csi/values.yaml
@@ -0,0 +1,25 @@
+# ------------------------------------------------------------------------------
+# csi-driver-nfs values for fastpass
+# Minimal overrides — defaults are fine for a homelab NFS workload
+# ------------------------------------------------------------------------------
+
+# Deploy the driver components to kube-system (default)
+# Controller runs as a Deployment; node driver runs as a DaemonSet on all nodes
+
+controller:
+  # Single replica is fine for a homelab cluster
+  replicas: 1
+
+  # Run controller on control plane nodes is acceptable here;
+  # remove this toleration if you want it strictly on workers
+  tolerations:
+    - key: node-role.kubernetes.io/control-plane
+      operator: Exists
+      effect: NoSchedule
+
+driver:
+  name: nfs.csi.k8s.io
+
+# Feature gates — keep defaults (no externalSnapshotter needed yet)
+feature:
+  enableFSGroupPolicy: true