diff --git a/kubernetes/cronjob.yaml b/kubernetes/cronjob.yaml
new file mode 100644
index 0000000..dae0122
--- /dev/null
+++ b/kubernetes/cronjob.yaml
@@ -0,0 +1,48 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: version-tracker
+  namespace: k8s-version-tracker
+  labels:
+    app: version-tracker
+spec:
+  # Every Sunday at 09:00 UTC
+  schedule: "0 9 * * 0"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: version-tracker
+        spec:
+          serviceAccountName: version-tracker
+          restartPolicy: OnFailure
+          containers:
+            - name: version-tracker
+              image: registry.storedbox.net/k8s-version-tracker:latest
+              imagePullPolicy: Always
+              env:
+                - name: MATTERMOST_WEBHOOK_URL
+                  valueFrom:
+                    secretKeyRef:
+                      name: version-tracker-secrets
+                      key: MATTERMOST_WEBHOOK_URL
+                - name: LOCAL_REGISTRY
+                  value: "registry.storedbox.net"
+                - name: MIRROR_IMAGES
+                  value: "true"
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 128Mi
+                limits:
+                  cpu: 500m
+                  memory: 256Mi
+
+---
+# Mirror-only job — run this manually to pre-populate the local registry.
+# kubectl create job --from=cronjob/version-tracker mirror-images-manual -n k8s-version-tracker