diff --git a/deployments/quirrel/fly.toml b/deployments/quirrel/fly.toml
new file mode 100644
index 0000000..5a1ee2a
--- /dev/null
+++ b/deployments/quirrel/fly.toml
@@ -0,0 +1,28 @@
+app = "quirrel-prod"
+
+[build]
+  image = "ghcr.io/quirrel-dev/quirrel:main"
+
+[[services]]
+  internal_port = 9181
+  protocol = "tcp"
+
+  [services.concurrency]
+    hard_limit = 25
+    soft_limit = 20
+    type = "connections"
+
+  [[services.http_checks]]
+    interval = "10s"
+    method = "get"
+    path = "/health"
+    protocol = "http"
+    timeout = "2s"
+
+  [[services.ports]]
+    handlers = ["http"]
+    port = 80
+
+  [[services.ports]]
+    handlers = ["tls", "http"]
+    port = 443
diff --git a/deployments/quirrel/readme.md b/deployments/quirrel/readme.md
new file mode 100644
index 0000000..d3c0429
--- /dev/null
+++ b/deployments/quirrel/readme.md
@@ -0,0 +1,21 @@
+# Quirrel
+
+Quirrel instance running on fly.io
+
+### Deploy
+
+```shell
+flyctl launch --name quirrel-prod
+node -e "console.log(crypto.randomBytes(16).toString('hex'))" # copy its output
+flyctl secrets set PASSPHRASES= # paste the 32-character long password copied previously
+flyctl secrets set REDIS_URL=redis://:REDIS_PASSWORD@cdg.quirrel-redis-prod.internal:6379?family=6
+flyctl deploy
+```
+
+### Set up with the app
+
+Copy the output of this command below and set it to the app's `QUIRREL_TOKEN` secret
+
+```shell
+curl --user ignored:PASSPHRASES_FROM_EARLIER -X PUT https://quirrel-prod.fly.dev/tokens/shellphone
+```