diff --git a/ente/Dockerfile b/ente/Dockerfile
index 974d96452..509ca2c6a 100644
--- a/ente/Dockerfile
+++ b/ente/Dockerfile
@@ -44,6 +44,15 @@ RUN set -eux; \
     curl -fsSL https://dl.min.io/client/mc/release/linux-amd64/mc -o /usr/local/bin/mc; \
     chmod +x /usr/local/bin/minio /usr/local/bin/mc
 
+RUN apk update && \
+    apk add --no-cache \
+        lsb-release curl gnupg wget tini jq sudo \
+        postgresql postgresql-client
+
+# Put museum / web on a predictable path for your run-scripts
+RUN ln -sf $(command -v museum)    /usr/bin/museum     && \
+    ln -sf $(command -v ente-web)  /usr/bin/ente-web
+
 ##################
 # 3 Install apps #
 ##################
diff --git a/ente/config.json b/ente/config.json
index 6ef462d58..84c168414 100644
--- a/ente/config.json
+++ b/ente/config.json
@@ -1,9 +1,29 @@
 {
-  "arch": [
-    "aarch64",
-    "amd64"
+  "name": "Ente",
+  "slug": "ente",
+  "version": "1.0.0test3",
+  "description": "Self-hosted, end-to-end-encrypted photo & video storage (Ente server + MinIO).",
+  "url": "https://github.com/alexbelgium/hassio-addons",
+  "arch": ["aarch64", "amd64"],
+  "image": "ghcr.io/alexbelgium/ente-{arch}",
+  "startup": "services",
+  "init": false,
+  "ports": {
+    "8080/tcp": 8280,
+    "3000/tcp": 8300,
+    "3200/tcp": 8320
+  },
+  "ports_description": {
+    "8080/tcp": "Ente API (museum)",
+    "3000/tcp": "Ente web UI",
+    "3200/tcp": "MinIO S3 endpoint"
+  },
+  "map": [
+    "addon_config:rw",
+    "media:rw",
+    "share:rw",
+    "ssl:rw"
   ],
-  "description": "Self‑hosted, end‑to‑end‑encrypted photo & video storage (Ente server + MinIO).",
   "devices": [
     "/dev/dri",
     "/dev/dri/renderD128",
@@ -13,74 +33,45 @@
     "/dev/video12"
   ],
   "environment": {
-    "DB_DATABASE_NAME": "ente_db",
-    "DB_HOSTNAME": "homeassistant.local",
-    "DB_PASSWORD": "ente",
-    "DB_PORT": "5432",
-    "DB_USERNAME": "pguser",
-    "ENTE_API_ORIGIN": "http://[HOST]:[PORT:8080]",
-    "MINIO_ROOT_PASSWORD": "minioadmin",
-    "MINIO_ROOT_USER": "minioadmin",
     "PGID": "0",
     "PUID": "0",
+    "ENTE_API_ORIGIN": "http://[HOST]:[PORT:8080]",
+    "MINIO_ROOT_USER": "minioadmin",
+    "MINIO_ROOT_PASSWORD": "minioadmin",
     "S3_BUCKET": "ente-media",
     "S3_ENDPOINT": "http://localhost:3200",
     "TZ": "Europe/Paris"
   },
-  "hassio_api": true,
-  "image": "ghcr.io/alexbelgium/ente-{arch}",
-  "init": false,
-  "map": [
-    "addon_config:rw",
-    "media:rw",
-    "share:rw",
-    "ssl:rw"
-  ],
-  "name": "Ente",
   "options": {
-    "DB_DATABASE_NAME": "ente_db",
+    "USE_EXTERNAL_DB": false,
     "DB_HOSTNAME": "homeassistant.local",
-    "DB_PASSWORD": "ente",
     "DB_PORT": 5432,
     "DB_USERNAME": "pguser",
-    "DISABLE_WEB_UI": false,
-    "MINIO_ROOT_PASSWORD": "minioadmin",
+    "DB_PASSWORD": "ente",
+    "DB_DATABASE_NAME": "ente_db",
     "MINIO_ROOT_USER": "minioadmin",
+    "MINIO_ROOT_PASSWORD": "minioadmin",
     "S3_BUCKET": "ente-media",
+    "DISABLE_WEB_UI": false,
     "TZ": "Europe/Paris"
   },
-  "panel_icon": "mdi:image-multiple",
-  "ports": {
-    "3000/tcp": 8300,
-    "3200/tcp": 8320,
-    "8080/tcp": 8280
-  },
-  "ports_description": {
-    "3000/tcp": "Ente web UI",
-    "3200/tcp": "MinIO S3 endpoint",
-    "8080/tcp": "Ente API (museum)"
-  },
-  "privileged": [
-    "SYS_ADMIN",
-    "DAC_READ_SEARCH"
-  ],
   "schema": {
-    "DB_DATABASE_NAME": "str",
-    "DB_HOSTNAME": "str",
-    "DB_PASSWORD": "str",
-    "DB_PORT": "int",
-    "DB_USERNAME": "str",
-    "DISABLE_WEB_UI": "bool?",
-    "MINIO_ROOT_PASSWORD": "str",
+    "USE_EXTERNAL_DB": "bool?",
+    "DB_HOSTNAME": "str?",
+    "DB_PORT": "int?",
+    "DB_USERNAME": "str?",
+    "DB_PASSWORD": "str?",
+    "DB_DATABASE_NAME": "str?",
     "MINIO_ROOT_USER": "str",
+    "MINIO_ROOT_PASSWORD": "str",
     "S3_BUCKET": "str",
+    "DISABLE_WEB_UI": "bool?",
     "TZ": "str?"
   },
-  "slug": "ente",
-  "startup": "services",
+  "panel_icon": "mdi:image-multiple",
+  "webui": "http://[HOST]:[PORT:3000]",
+  "privileged": ["SYS_ADMIN", "DAC_READ_SEARCH"],
+  "hassio_api": true,
   "udev": true,
-  "url": "https://github.com/alexbelgium/hassio-addons",
-  "version": "1.0.0test2",
-  "video": true,
-  "webui": "http://[HOST]:[PORT:3000]"
+  "video": true
 }
diff --git a/ente/rootfs/etc/cont-init.d/10-generate-config.sh b/ente/rootfs/etc/cont-init.d/10-generate-config.sh
new file mode 100644
index 000000000..562246b75
--- /dev/null
+++ b/ente/rootfs/etc/cont-init.d/10-generate-config.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/with-contenv bashio
+# Generate museum.yaml (first boot) from add-on options
+set -euo pipefail
+
+CFG=/config/museum.yaml
+
+if bashio::fs.file_exists "$CFG"; then
+    bashio::log.info "Using existing $CFG"
+    exit 0
+fi
+
+bashio::log.info "Generating $CFG"
+
+# --- options ---
+USE_EXTERNAL_DB=$(bashio::config.true 'USE_EXTERNAL_DB' && echo true || echo false)
+
+DB_HOST="localhost"
+DB_PORT=5432
+DB_USER="$(bashio::config 'DB_USERNAME')"
+DB_PASS="$(bashio::config 'DB_PASSWORD')"
+DB_NAME="$(bashio::config 'DB_DATABASE_NAME')"
+
+if ${USE_EXTERNAL_DB}; then
+    # override host/port for external DB (fall back if missing)
+    DB_HOST="$(bashio::config 'DB_HOSTNAME')"
+    DB_PORT="$(bashio::config 'DB_PORT')"
+    bashio::log.info "museum.yaml will point to external Postgres at ${DB_HOST}:${DB_PORT}"
+else
+    bashio::log.info "museum.yaml will use internal Postgres."
+fi
+
+MINIO_USER="$(bashio::config 'MINIO_ROOT_USER')"
+MINIO_PASS="$(bashio::config 'MINIO_ROOT_PASSWORD')"
+S3_BUCKET="$(bashio::config 'S3_BUCKET')"
+
+# helpers
+_random_b64() { head -c "$1" /dev/urandom | base64 | tr -d '\n'; }
+_random_b64_url() { head -c "$1" /dev/urandom | base64 | tr '+/' '-_' | tr -d '\n'; }
+
+cat >"$CFG" <<EOF
+key:
+  encryption: $(_random_b64 32)
+  hash: $(_random_b64 64)
+
+jwt:
+  secret: $(_random_b64_url 32)
+
+db:
+  host: ${DB_HOST}
+  port: ${DB_PORT}
+  name: ${DB_NAME}
+  user: ${DB_USER}
+  password: ${DB_PASS}
+
+s3:
+  are_local_buckets: true
+  b2-eu-cen:
+     key: ${MINIO_USER}
+     secret: ${MINIO_PASS}
+     endpoint: localhost:3200
+     region: eu-central-2
+     bucket: ${S3_BUCKET}
+EOF
+
+bashio::log.info "Generated $CFG"
diff --git a/ente/rootfs/etc/cont-init.d/20-internal-db-bootstrap.sh b/ente/rootfs/etc/cont-init.d/20-internal-db-bootstrap.sh
new file mode 100644
index 000000000..79b98f103
--- /dev/null
+++ b/ente/rootfs/etc/cont-init.d/20-internal-db-bootstrap.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/with-contenv bashio
+set -euo pipefail
+
+if bashio::config.true 'USE_EXTERNAL_DB'; then
+    bashio::log.info "External DB in use; skipping internal Postgres bootstrap."
+    exit 0
+fi
+
+bashio::log.info "Bootstrapping internal Postgres cluster…"
+
+DB_USER="$(bashio::config 'DB_USERNAME')"
+DB_PASS="$(bashio::config 'DB_PASSWORD')"
+DB_NAME="$(bashio::config 'DB_DATABASE_NAME')"
+
+# Wait for postgres service (localhost)
+until pg_isready -q -h localhost -p 5432 -U postgres; do
+    bashio::log.info "Waiting for Postgres to accept connections…"
+    sleep 1
+done
+
+bashio::log.info "Creating role + database if needed…"
+su - postgres -c psql <<SQL
+DO \$\$
+BEGIN
+   IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${DB_USER}') THEN
+      CREATE ROLE ${DB_USER} LOGIN PASSWORD '${DB_PASS}';
+   END IF;
+   IF NOT EXISTS (SELECT FROM pg_database WHERE datname = '${DB_NAME}') THEN
+      CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};
+   END IF;
+END
+\$\$;
+SQL
+
+bashio::log.info "Internal Postgres ready."
diff --git a/ente/rootfs/etc/services.d/00-postgres/run b/ente/rootfs/etc/services.d/00-postgres/run
new file mode 100644
index 000000000..96ef5dcf7
--- /dev/null
+++ b/ente/rootfs/etc/services.d/00-postgres/run
@@ -0,0 +1,19 @@
+#!/usr/bin/with-contenv bashio
+set -euo pipefail
+
+if bashio::config.true 'USE_EXTERNAL_DB'; then
+    bashio::log.info "External DB requested; not starting internal Postgres service."
+    exit 0
+fi
+
+export PGDATA=/data/postgres
+mkdir -p "$PGDATA"
+chown -R postgres:postgres /data
+
+if [[ ! -s "$PGDATA/PG_VERSION" ]]; then
+    bashio::log.info "Initializing Postgres 17 data directory."
+    su - postgres -c "/usr/lib/postgresql/17/bin/initdb -D $PGDATA"
+fi
+
+bashio::log.info "Starting Postgres 17 (listening on 127.0.0.1:5432)."
+exec su - postgres -c "/usr/lib/postgresql/17/bin/postgres -D $PGDATA -c listen_addresses='127.0.0.1'"
diff --git a/ente/rootfs/etc/services.d/01-minio/run b/ente/rootfs/etc/services.d/01-minio/run
new file mode 100644
index 000000000..312626d4a
--- /dev/null
+++ b/ente/rootfs/etc/services.d/01-minio/run
@@ -0,0 +1,4 @@
+#!/usr/bin/with-contenv bashio
+set -euo pipefail
+bashio::log.info "Starting MinIO."
+exec /usr/local/bin/minio server /data --address ":3200"
diff --git a/ente/rootfs/etc/services.d/01-museum/run b/ente/rootfs/etc/services.d/01-museum/run
deleted file mode 100755
index 4ae59932e..000000000
--- a/ente/rootfs/etc/services.d/01-museum/run
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/usr/bin/with-contenv bash
-set -e
-
-CONFIG_FILE="/config/museum.yaml"
-
-# Safety: refuse to start if the config file is missing
-if [[ ! -f "$CONFIG_FILE" ]]; then
-  echo "[museum] ERROR: $CONFIG_FILE not found" >&2
-  exit 1
-fi
-
-# Exec so that S6 can reap the PID
-exec /usr/bin/museum --config "$CONFIG_FILE"
diff --git a/ente/rootfs/etc/services.d/02-minio-init/run b/ente/rootfs/etc/services.d/02-minio-init/run
new file mode 100644
index 000000000..671482a37
--- /dev/null
+++ b/ente/rootfs/etc/services.d/02-minio-init/run
@@ -0,0 +1,16 @@
+#!/usr/bin/with-contenv bashio
+set -euo pipefail
+
+MINIO_USER="$(bashio::config 'MINIO_ROOT_USER')"
+MINIO_PASS="$(bashio::config 'MINIO_ROOT_PASSWORD')"
+S3_BUCKET="$(bashio::config 'S3_BUCKET')"
+
+bashio::log.info "Waiting for MinIO API…"
+until /usr/local/bin/mc alias set h0 http://localhost:3200 "${MINIO_USER}" "${MINIO_PASS}" 2>/dev/null; do
+    sleep 1
+done
+
+bashio::log.info "Ensuring bucket ${S3_BUCKET} exists…"
+/usr/local/bin/mc mb -p "h0/${S3_BUCKET}" || true
+bashio::log.info "MinIO bucket ready."
+exit 0
diff --git a/ente/rootfs/etc/services.d/02-minio/run b/ente/rootfs/etc/services.d/02-minio/run
deleted file mode 100755
index 23c28e2a5..000000000
--- a/ente/rootfs/etc/services.d/02-minio/run
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/with-contenv bash
-set -e
-exec /usr/local/bin/minio server /data --address ":3200"
diff --git a/ente/rootfs/etc/services.d/03-museum/run b/ente/rootfs/etc/services.d/03-museum/run
new file mode 100644
index 000000000..b4ac0ccdd
--- /dev/null
+++ b/ente/rootfs/etc/services.d/03-museum/run
@@ -0,0 +1,27 @@
+#!/usr/bin/with-contenv bashio
+set -euo pipefail
+
+CFG=/config/museum.yaml
+if ! bashio::fs.file_exists "$CFG"; then
+    bashio::log.error "$CFG not found; aborting museum start."
+    exit 1
+fi
+
+if bashio::config.true 'USE_EXTERNAL_DB'; then
+    DB_HOST="$(bashio::config 'DB_HOSTNAME')"
+    DB_PORT="$(bashio::config 'DB_PORT')"
+    DB_USER="$(bashio::config 'DB_USERNAME')"
+    bashio::log.info "Waiting for external Postgres at ${DB_HOST}:${DB_PORT}…"
+    until pg_isready -q -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER}"; do
+        sleep 2
+    done
+else
+    DB_USER="postgres"
+    bashio::log.info "Waiting for internal Postgres…"
+    until pg_isready -q -h localhost -p 5432 -U "${DB_USER}"; do
+        sleep 2
+    done
+fi
+
+bashio::log.info "Starting museum."
+exec /usr/bin/museum --config "$CFG"
diff --git a/ente/rootfs/etc/services.d/03-web/run b/ente/rootfs/etc/services.d/03-web/run
deleted file mode 100755
index 4f496bd11..000000000
--- a/ente/rootfs/etc/services.d/03-web/run
+++ /dev/null
@@ -1,4 +0,0 @@
-#!/usr/bin/with-contenv bash
-set -e
-[[ "${DISABLE_WEB_UI,,}" == "true" ]] && exit 0
-exec /usr/bin/ente-web
diff --git a/ente/rootfs/etc/services.d/04-web/run b/ente/rootfs/etc/services.d/04-web/run
new file mode 100644
index 000000000..3f2038ef3
--- /dev/null
+++ b/ente/rootfs/etc/services.d/04-web/run
@@ -0,0 +1,8 @@
+#!/usr/bin/with-contenv bashio
+set -euo pipefail
+if bashio::config.true 'DISABLE_WEB_UI'; then
+    bashio::log.info "Web UI disabled by option."
+    exit 0
+fi
+bashio::log.info "Starting Ente web."
+exec /usr/bin/ente-web