diff --git a/k8s/vpa.yaml b/k8s/vpa.yaml
new file mode 100644
index 0000000..6e940de
--- /dev/null
+++ b/k8s/vpa.yaml
@@ -0,0 +1,17 @@
+# Recommendation-only VPAs for every Deployment/StatefulSet in
+# this app (D-012, epic homelab#455). The in-cluster recommender
+# publishes targets in each VPA's status; requests get right-sized
+# from measured data in a follow-up commit. Never auto-applies.
+---
+apiVersion: autoscaling.k8s.io/v1
+kind: VerticalPodAutoscaler
+metadata:
+  name: sd-webui-rcom
+  namespace: sd-webui-rcom
+spec:
+  targetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: sd-webui-rcom
+  updatePolicy:
+    updateMode: "Off"