diff --git a/testset/README.md b/testset/README.md
new file mode 100644
index 0000000..c8b6f0d
--- /dev/null
+++ b/testset/README.md
@@ -0,0 +1,8 @@
+# netinfra test set
+
+> **Docs live on Discourse — this repo is the executable source of truth.**
+> **Topic:** https://community.turnsys.com/t/306 · **Env map:** https://community.turnsys.com/t/331
+
+Sectestbed netinfra set (VM 5109 `sectestbed-netinfra`, pfv-tsys5): Pi-hole 2026.07.2 + Technitium 15.4.0 for version testing ahead of prod (netinfra-01/02). Preprod counterpart: VM 53109 `preprod-netinfra` (same host; app provisioning pending — template lacks qemu-guest-agent).
+
+Deploy: `VM_IP=sectestbed-netinfra VM_USER=root bash tests/remote.sh vm-copy` from PFVCluster, then `cd /opt/netinfra-test && docker compose up -d`.
diff --git a/testset/compose.yaml b/testset/compose.yaml
new file mode 100644
index 0000000..3bd32d4
--- /dev/null
+++ b/testset/compose.yaml
@@ -0,0 +1,38 @@
+# netinfra test set — deployed on sectestbed-netinfra (VM 5109, tsys5) [#769]
+# Pi-hole = the DNS test target (VM LAN :53); Technitium = admin/version test
+# (loopback :5380, DNS on loopback :5353 to avoid the :53 conflict).
+# NOTE: upstreams point at 1.1.1.1 — tsys5 VM subnets cannot reach the
+# 192.168.3.x LAN gateway.
+services:
+  pihole:
+    image: pihole/pihole:2026.07.2
+    container_name: ukrrs-pfv-pihole-test
+    ports:
+      - "53:53/tcp"
+      - "53:53/udp"
+      - "80:80/tcp"
+    environment:
+      TZ: America/Chicago
+      FTLCONF_webserver_api_password: "sectestbed-only"
+      FTLCONF_dns_upstreams: "1.1.1.1"
+    volumes:
+      - pihole-etc:/etc/pihole
+    restart: unless-stopped
+
+  technitium:
+    image: technitium/dns-server:15.4.0
+    container_name: ukrrs-pfv-technitium-test
+    ports:
+      - "127.0.0.1:5380:5380/tcp"
+      - "127.0.0.1:5353:53/udp"
+      - "127.0.0.1:5353:53/tcp"
+    environment:
+      DNS_SERVER_DOMAIN: sectestbed-netinfra.knel.net
+      DNS_SERVER_ADMIN_PASSWORD: "sectestbed-only"
+    volumes:
+      - technitium-config:/etc/dns
+    restart: unless-stopped
+
+volumes:
+  pihole-etc:
+  technitium-config: