diff --git a/docker/stepca-test/compose.yaml b/docker/stepca-test/compose.yaml
new file mode 100644
index 0000000..81fbece
--- /dev/null
+++ b/docker/stepca-test/compose.yaml
@@ -0,0 +1,20 @@
+# step-ca ACME endpoint — TEST PILOT (workstation loopback + tailnet) [#697]
+# Real-root intermediate integration is a later phase (t/327 design).
+services:
+  stepca:
+    image: smallstep/step-ca:0.30.2
+    container_name: ca-stepca-test
+    extra_hosts:
+      - "ultix-streaming.knel.net:host-gateway"
+    restart: "no"
+    ports:
+      - "127.0.0.1:8443:9000"
+      - "172.17.0.1:8443:9000"
+    volumes:
+      - data:/home/step
+    environment:
+      DOCKER_STEPCA_INIT_NAME: "KNEL CA Test Pilot"
+      DOCKER_STEPCA_INIT_DNS_NAMES: "localhost,tsys-ca.knel.net"
+      DOCKER_STEPCA_INIT_PROVISIONER_NAME: "admin"
+volumes:
+  data: