diff --git a/oam/oam-ui-nginx.vhost b/oam/oam-ui-nginx.vhost
new file mode 100644
index 0000000..a76c6a1
--- /dev/null
+++ b/oam/oam-ui-nginx.vhost
@@ -0,0 +1,60 @@
+# tsys-librenms nginx vhost for the OAM docker UIs — deployed 2026-09-03 [#697]
+# cert: oam-ui.knel.net (SANs: smokeping/netdisco/oxidized/unpoller.knel.net) from fleet CA
+# IaC codification tracked via #454 (AWX lane); this file is the config SoR copy.
+
+server {
+    listen 443 ssl;
+    server_name smokeping.knel.net;
+    ssl_certificate /etc/nginx/ssl/oam-ui.knel.net.fullchain;
+    ssl_certificate_key /etc/nginx/ssl/oam-ui.knel.net.key;
+
+    location / {
+        proxy_pass http://127.0.0.1:8081;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_http_version 1.1;
+    }
+}
+server {
+    listen 443 ssl;
+    server_name netdisco.knel.net;
+    ssl_certificate /etc/nginx/ssl/oam-ui.knel.net.fullchain;
+    ssl_certificate_key /etc/nginx/ssl/oam-ui.knel.net.key;
+
+    location / {
+        proxy_pass http://127.0.0.1:8082;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_http_version 1.1;
+    }
+}
+server {
+    listen 443 ssl;
+    server_name oxidized.knel.net;
+    ssl_certificate /etc/nginx/ssl/oam-ui.knel.net.fullchain;
+    ssl_certificate_key /etc/nginx/ssl/oam-ui.knel.net.key;
+
+    location / {
+        proxy_pass http://127.0.0.1:8083;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_http_version 1.1;
+    }
+}
+server {
+    listen 443 ssl;
+    server_name unpoller.knel.net;
+    ssl_certificate /etc/nginx/ssl/oam-ui.knel.net.fullchain;
+    ssl_certificate_key /etc/nginx/ssl/oam-ui.knel.net.key;
+
+    location / {
+        proxy_pass http://127.0.0.1:8084;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_http_version 1.1;
+    }
+}