diff --git a/docker/vault-test/compose.yaml b/docker/vault-test/compose.yaml
new file mode 100644
index 0000000..db62940
--- /dev/null
+++ b/docker/vault-test/compose.yaml
@@ -0,0 +1,16 @@
+# vault-test — HashiCorp Vault DEV server (in-memory; wipes on restart).
+# TEST ONLY. Loopback bind. Root token is the well-known dev default
+# ("root") — this is not a credential, by design. PKI experiments for
+# #697 (SSH certs, k8s CA) happen against THIS instance first.
+services:
+  vault:
+    image: hashicorp/vault:2.0.4
+    container_name: ukrrs-pfv-vault-test
+    ports:
+      - "127.0.0.1:8201:8200"
+    environment:
+      VAULT_DEV_ROOT_TOKEN_ID: "root"
+      VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
+    cap_add:
+      - IPC_LOCK
+    restart: unless-stopped
diff --git a/docker/vaultwarden-test/compose.yaml b/docker/vaultwarden-test/compose.yaml
new file mode 100644
index 0000000..d01711e
--- /dev/null
+++ b/docker/vaultwarden-test/compose.yaml
@@ -0,0 +1,15 @@
+# vaultwarden-test — loopback test instance. Vaultwarden is the secrets SoR
+# in prod (ruling #743); this instance exists for preprod-style testing only.
+services:
+  vaultwarden:
+    image: vaultwarden/server:1.37.2
+    container_name: ukrrs-pfv-vaultwarden-test
+    ports:
+      - "127.0.0.1:8222:80"
+    volumes:
+      - vw-test-data:/data
+    environment:
+      DOMAIN: "http://127.0.0.1:8222"
+    restart: unless-stopped
+volumes:
+  vw-test-data: