diff --git a/pihole/.env.example b/pihole/.env.example
index e7b9ba0..bcf23bc 100644
--- a/pihole/.env.example
+++ b/pihole/.env.example
@@ -16,3 +16,10 @@ KEEPALIVED_STATE=MASTER
 KEEPALIVED_PRIORITY=100
 KEEPALIVED_PASSWORD=CHANGE01
 KEEPALIVED_NOPREEMPT=true
+
+# Nebula Sync (PD primary -> replicas)
+NEBULA_SYNC_PRIMARY=http://127.0.0.1:8953|CHANGE_ME
+NEBULA_SYNC_REPLICAS=http://10.5.1.5:8954|CHANGE_ME
+NEBULA_SYNC_FULL_SYNC=false
+NEBULA_SYNC_RUN_GRAVITY=true
+NEBULA_SYNC_CRON=0 3 * * *
diff --git a/pihole/README.md b/pihole/README.md
index 8d19892..9b4297f 100644
--- a/pihole/README.md
+++ b/pihole/README.md
@@ -7,10 +7,11 @@ Primary-node stack for the Pi-hole HA plan.
 - **Node role:** PD primary / MASTER
 - **VIP target:** `10.5.1.53/24`
 
-This stack intentionally covers the **PD primary** only:
+This stack intentionally covers the **PD primary** plus PD-hosted sync:
 - Pi-hole
 - Unbound
 - Keepalived
+- Nebula Sync
 
 Serenity and RPi4 replicas still need their own deployment steps.
 
@@ -43,5 +44,6 @@ If that validates cleanly, bring it up:
 - `KEEPALIVED_PASSWORD` must be **8 chars or fewer** because VRRP PASS auth is annoying and old.
 - Verify `LAN_INTERFACE` on PD before deployment (`ip link show`).
 - `FTLCONF_dns_listeningMode=LOCAL` is set because TrueNAS binds loopback on port 53.
-- This stack does **not** include Nebula Sync yet. Add that after Serenity/RPi replicas are live.
+- Pi-hole NTP is explicitly disabled here because PD host `chronyd` already owns UDP 123.
+- Nebula Sync runs on PD and uses `NEBULA_SYNC_PRIMARY` / `NEBULA_SYNC_REPLICAS` from `.env`.
 - `keepalived.conf` is generated and should stay local/untracked.
diff --git a/pihole/docker-compose.yaml b/pihole/docker-compose.yaml
index 62cbb66..77facca 100644
--- a/pihole/docker-compose.yaml
+++ b/pihole/docker-compose.yaml
@@ -60,3 +60,18 @@ services:
       - NET_RAW
     volumes:
       - ./keepalived.conf:/usr/local/etc/keepalived/keepalived.conf:ro
+
+  nebula-sync:
+    image: lovelaze/nebula-sync:latest
+    container_name: nebula-sync
+    network_mode: host
+    restart: unless-stopped
+    depends_on:
+      pihole:
+        condition: service_healthy
+    environment:
+      PRIMARY: ${NEBULA_SYNC_PRIMARY}
+      REPLICAS: ${NEBULA_SYNC_REPLICAS}
+      FULL_SYNC: ${NEBULA_SYNC_FULL_SYNC}
+      RUN_GRAVITY: ${NEBULA_SYNC_RUN_GRAVITY}
+      CRON: ${NEBULA_SYNC_CRON}