diff --git a/.prototools b/.prototools
index 522320f..1715d8b 100644
--- a/.prototools
+++ b/.prototools
@@ -16,6 +16,7 @@ shellcheck = "0.11.0"
 shfmt = "3.13.1"
 taplo = "0.10.0"
 task = "3.51.1"
+terraform = "1.14.9"
 tsh = "18.9.1"
 typos = "1.47.2"
 yamlfmt = "0.21.0"
@@ -40,6 +41,7 @@ shellcheck = "file://./shellcheck/plugin.toml"
 shfmt = "file://./shfmt/plugin.toml"
 taplo = "file://./taplo/plugin.toml"
 task = "file://./task/plugin.toml"
+terraform = "file://./terraform/plugin.toml"
 tsh = "file://./tsh/plugin.toml"
 typos = "file://./typos/plugin.toml"
 yamlfmt = "file://./yamlfmt/plugin.toml"
diff --git a/.typos.toml b/.typos.toml
index ec5dde6..a5f7b67 100644
--- a/.typos.toml
+++ b/.typos.toml
@@ -3,3 +3,6 @@
 # Disabling ignore-hidden also stops .git from being skipped, so exclude it.
 extend-exclude = [".git/"]
 ignore-hidden = false
+[default.extend-identifiers]
+# Company name: https://www.hashicorp.com
+HashiCorp = "HashiCorp"
diff --git a/terraform/README.md b/terraform/README.md
new file mode 100644
index 0000000..8fecd3e
--- /dev/null
+++ b/terraform/README.md
@@ -0,0 +1,19 @@
+# terraform plugin
+
+[Terraform](https://github.com/hashicorp/terraform) plugin for
+[proto](https://github.com/moonrepo/proto).
+
+Binaries are served from <https://releases.hashicorp.com/terraform/> rather than GitHub
+release assets, so the plugin uses HashiCorp's standard zip + companion `SHA256SUMS`
+file.
+
+## Installation
+
+terraform is not built into proto, so register this plugin, pin a version, then
+install:
+
+```shell
+proto plugin add terraform "https://raw.githubusercontent.com/Genesis-Embodied-AI/proto-plugins/main/terraform/plugin.toml"
+proto pin terraform latest --resolve
+proto install terraform
+```
diff --git a/terraform/plugin.toml b/terraform/plugin.toml
new file mode 100644
index 0000000..8c125e2
--- /dev/null
+++ b/terraform/plugin.toml
@@ -0,0 +1,36 @@
+name = "terraform"
+type = "cli"
+
+[resolve]
+git-url = "https://github.com/hashicorp/terraform"
+# Terraform's tag list mixes clean vMAJOR.MINOR.PATCH releases with alpha/beta/rc
+# pre-releases (v1.15.0-alpha.x, v1.15.0-rc1, etc.); restrict to bare semver.
+version-pattern = "^v((?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+))$"
+
+# Honor the tfenv/tfswitch convention so a `.terraform-version` next to a Stack
+# overrides the project-wide pin in `.prototools`.
+[detect]
+version-files = [".terraform-version"]
+
+[install.arch]
+aarch64 = "arm64"
+x86_64 = "amd64"
+
+[platform.linux]
+download-file = "terraform_{version}_linux_{arch}.zip"
+checksum-file = "terraform_{version}_SHA256SUMS"
+exe-path = "terraform"
+
+[platform.macos]
+download-file = "terraform_{version}_darwin_{arch}.zip"
+checksum-file = "terraform_{version}_SHA256SUMS"
+exe-path = "terraform"
+
+[platform.windows]
+download-file = "terraform_{version}_windows_{arch}.zip"
+checksum-file = "terraform_{version}_SHA256SUMS"
+exe-path = "terraform.exe"
+
+[install]
+download-url = "https://releases.hashicorp.com/terraform/{version}/{download_file}"
+checksum-url = "https://releases.hashicorp.com/terraform/{version}/{checksum_file}"