diff --git a/blueprints/trek/docker-compose.yml b/blueprints/trek/docker-compose.yml
new file mode 100644
index 00000000..2195ecd8
--- /dev/null
+++ b/blueprints/trek/docker-compose.yml
@@ -0,0 +1,32 @@
+services:
+  trek:
+    image: mauriceboe/trek:3.3.0
+    restart: unless-stopped
+    environment:
+      - NODE_ENV=production
+      - PORT=3000
+      # Encryption key for secrets at rest. Persisted via the env below so it
+      # survives container recreation.
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
+      - TZ=${TZ:-UTC}
+      - LOG_LEVEL=${LOG_LEVEL:-info}
+      # Public base URL, used for links in notifications and required for OIDC
+      - APP_URL=${APP_URL}
+      # Comma-separated origins for CORS and email notification links
+      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS}
+      # Initial admin credentials, only used on first boot when no users exist
+      - ADMIN_EMAIL=${ADMIN_EMAIL}
+      - ADMIN_PASSWORD=${ADMIN_PASSWORD}
+    volumes:
+      - trek-data:/app/data
+      - trek-uploads:/app/uploads
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 15s
+
+volumes:
+  trek-data:
+  trek-uploads:
diff --git a/blueprints/trek/meta.json b/blueprints/trek/meta.json
new file mode 100644
index 00000000..d815be38
--- /dev/null
+++ b/blueprints/trek/meta.json
@@ -0,0 +1,17 @@
+{
+  "id": "trek",
+  "name": "TREK",
+  "version": "3.3.0",
+  "description": "A minimalist, self-hosted trip planner with Kanban-style task boards, budgets, packing lists, interactive maps, real-time collaboration, and OIDC single sign-on.",
+  "logo": "trek.png",
+  "links": {
+    "github": "https://github.com/mauriceboe/TREK",
+    "website": "https://github.com/mauriceboe/TREK",
+    "docs": "https://github.com/mauriceboe/TREK/wiki"
+  },
+  "tags": [
+    "travel",
+    "planning",
+    "productivity"
+  ]
+}
diff --git a/blueprints/trek/template.toml b/blueprints/trek/template.toml
new file mode 100644
index 00000000..f45225f9
--- /dev/null
+++ b/blueprints/trek/template.toml
@@ -0,0 +1,46 @@
+[variables]
+main_domain = "${domain}"
+encryption_key = "${password:64}"
+admin_email = "${email}"
+admin_password = "${password:16}"
+
+[config]
+[[config.domains]]
+serviceName = "trek"
+port = 3000
+host = "${main_domain}"
+
+[config.env]
+# Encryption key for secrets at rest (equivalent to `openssl rand -hex 32`)
+"ENCRYPTION_KEY" = "${encryption_key}"
+# Timezone for logs, reminders and scheduled tasks (e.g. Europe/Berlin)
+"TZ" = "UTC"
+# info = concise user actions; debug = verbose admin-level details
+"LOG_LEVEL" = "info"
+# Public base URL, used for links in notifications and required for OIDC.
+# Change to https:// once you enable SSL on the domain.
+"APP_URL" = "http://${main_domain}"
+# Comma-separated origins for CORS and email notification links
+"ALLOWED_ORIGINS" = "http://${main_domain}"
+# Initial admin credentials, only used on first boot when no users exist
+"ADMIN_EMAIL" = "${admin_email}"
+"ADMIN_PASSWORD" = "${admin_password}"
+
+# --- Optional: OIDC single sign-on (Google, Apple, Authentik, Keycloak, ...) ---
+# "OIDC_ISSUER" = "https://auth.example.com"
+# "OIDC_CLIENT_ID" = "trek"
+# "OIDC_CLIENT_SECRET" = "supersecret"
+# "OIDC_DISPLAY_NAME" = "SSO"
+# "OIDC_ONLY" = "false"
+# "OIDC_SCOPE" = "openid email profile"
+# "OIDC_ADMIN_CLAIM" = "groups"
+# "OIDC_ADMIN_VALUE" = "app-trek-admins"
+# "OIDC_DISCOVERY_URL" = ""
+
+# --- Optional: extras ---
+# Default language on the login page (de, en, es, fr, hu, nl, br, cs, pl, ru, zh, zh-TW, it, ar, ...)
+# "DEFAULT_LANGUAGE" = "en"
+# How long users stay logged in (1h | 12h | 7d | 30d | 90d). Default: 24h
+# "SESSION_DURATION" = "30d"
+# Unsplash Access Key for trip-cover / place-image search
+# "UNSPLASH_ACCESS_KEY" = ""
diff --git a/blueprints/trek/trek.png b/blueprints/trek/trek.png
new file mode 100644
index 00000000..b6f059ce
Binary files /dev/null and b/blueprints/trek/trek.png differ