diff --git a/deploy/labels/kustomization.yaml b/deploy/labels/kustomization.yaml
index 881d781..8f3bd7e 100644
--- a/deploy/labels/kustomization.yaml
+++ b/deploy/labels/kustomization.yaml
@@ -26,6 +26,7 @@ resources:
   - maintenance.yaml
   - agent-skills.yaml
   - agent-plugins.yaml
+  - provider-upjet-unifi.yaml
   - unifi.yaml
   - gitops-tenant-template.yaml
   - platform-template.yaml
diff --git a/deploy/labels/provider-upjet-unifi.yaml b/deploy/labels/provider-upjet-unifi.yaml
new file mode 100644
index 0000000..2709b26
--- /dev/null
+++ b/deploy/labels/provider-upjet-unifi.yaml
@@ -0,0 +1,24 @@
+# Issue labels for devantler-tech/provider-upjet-unifi. The canonical org taxonomy
+# is appended to every IssueLabels by the shared patch in kustomization.yaml. This
+# repo declares no repo-specific extras yet (`label: []`); add this repo's own
+# dependency/ecosystem labels here (the ones Dependabot/Renovate apply) once they
+# exist, so the authoritative set doesn't strip them. See ../README.md.
+apiVersion: repo.github.m.upbound.io/v1alpha1
+kind: IssueLabels
+metadata:
+  name: provider-upjet-unifi
+  annotations:
+    crossplane.io/external-name: provider-upjet-unifi
+spec:
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    repository: provider-upjet-unifi
+    # No repo-specific extras; the shared patch supplies the full canonical set.
+    label: []
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default
diff --git a/deploy/repositories/kustomization.yaml b/deploy/repositories/kustomization.yaml
index ae4582b..f605fbc 100644
--- a/deploy/repositories/kustomization.yaml
+++ b/deploy/repositories/kustomization.yaml
@@ -14,6 +14,7 @@ resources:
   - maintenance.yaml
   - agent-skills.yaml
   - agent-plugins.yaml
+  - provider-upjet-unifi.yaml
   - unifi.yaml
   - gitops-tenant-template.yaml
   - platform-template.yaml
diff --git a/deploy/repositories/provider-upjet-unifi.yaml b/deploy/repositories/provider-upjet-unifi.yaml
new file mode 100644
index 0000000..de67533
--- /dev/null
+++ b/deploy/repositories/provider-upjet-unifi.yaml
@@ -0,0 +1,27 @@
+apiVersion: repo.github.m.upbound.io/v1alpha1
+kind: Repository
+metadata:
+  name: provider-upjet-unifi
+  annotations:
+    # NET-NEW repo (not an adoption): the provider CREATEs it from this manifest.
+    # external-name pinned so the create/observe target is unambiguous.
+    crossplane.io/external-name: provider-upjet-unifi
+spec:
+  # Same all-except-Delete policy as every other managed repo (omitting Delete
+  # guarantees Crossplane can never delete a real GitHub repository). Create is
+  # present so the provider provisions this repo if it does not yet exist.
+  managementPolicies:
+    - Observe
+    - Create
+    - Update
+    - LateInitialize
+  forProvider:
+    name: provider-upjet-unifi
+    description: "Crossplane provider for Ubiquiti UniFi, generated with Upjet from ubiquiti-community/terraform-provider-unifi. Manage UniFi networks, WLANs, firewall, VPN/WireGuard, devices and settings as Kubernetes resources."
+    visibility: public
+    hasIssues: true
+    # Shared kustomization patch supplies the squash-only merge policy +
+    # webCommitSignoffRequired; nothing repo-specific needed here.
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default
diff --git a/deploy/team-repositories/grant-maintainers-on-provider-upjet-unifi.yaml b/deploy/team-repositories/grant-maintainers-on-provider-upjet-unifi.yaml
new file mode 100644
index 0000000..7e8b57c
--- /dev/null
+++ b/deploy/team-repositories/grant-maintainers-on-provider-upjet-unifi.yaml
@@ -0,0 +1,16 @@
+# Team → repository access. No external-name: this grant did not exist yet (the
+# repo is net-new), so it is Created (full management except Delete) rather than adopted.
+apiVersion: team.github.m.upbound.io/v1alpha1
+kind: TeamRepository
+metadata:
+  name: maintainers-provider-upjet-unifi
+spec:
+  managementPolicies: ["Observe", "Create", "Update", "LateInitialize"]
+  forProvider:
+    teamIdRef:
+      name: maintainers
+    repository: provider-upjet-unifi
+    permission: maintain
+  providerConfigRef:
+    kind: ProviderConfig
+    name: default
diff --git a/deploy/team-repositories/kustomization.yaml b/deploy/team-repositories/kustomization.yaml
index af5617d..25575c8 100644
--- a/deploy/team-repositories/kustomization.yaml
+++ b/deploy/team-repositories/kustomization.yaml
@@ -19,3 +19,4 @@ resources:
   - grant-maintainers-on-platform-template.yaml
   - grant-maintainers-on-unifi.yaml
   - grant-maintainers-on-homebrew-tap.yaml
+  - grant-maintainers-on-provider-upjet-unifi.yaml