diff --git a/docker-compose.production.yml b/docker-compose.production.yml
new file mode 100644
index 0000000..b81a107
--- /dev/null
+++ b/docker-compose.production.yml
@@ -0,0 +1,30 @@
+services:
+  ihaleist:
+    image: ${IHALEIST_IMAGE:-ihaleist:latest}
+    restart: unless-stopped
+    ports:
+      - "${IHALEIST_PORT:-80}:80"
+    environment:
+      NODE_ENV: production
+      AUTH_SECRET: ${AUTH_SECRET:?AUTH_SECRET must be set}
+      APP_URL: ${APP_URL:-https://ihaleist.com}
+      CORS_ORIGINS: ${CORS_ORIGINS:-https://ihaleist.com}
+      UYUM_GOMME: ${UYUM_GOMME:-0}
+      TELEGRAM_BOT_TOKEN: ${TELEGRAM_BOT_TOKEN:-}
+      RESEND_API_KEY: ${RESEND_API_KEY:-}
+      RESEND_FROM: ${RESEND_FROM:-}
+      GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
+      GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET:-}
+      STRIPE_SECRET_KEY: ${STRIPE_SECRET_KEY:-}
+      STRIPE_WEBHOOK_SECRET: ${STRIPE_WEBHOOK_SECRET:-}
+    volumes:
+      - ihaleist-data:/app/server/data
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:80/api/ready').then(r=>{if(!r.ok) process.exit(1)}).catch(()=>process.exit(1))"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 20s
+
+volumes:
+  ihaleist-data:
diff --git a/docs/quality/deployment-runbook.md b/docs/quality/deployment-runbook.md
index 7bcca8c..8cc5910 100644
--- a/docs/quality/deployment-runbook.md
+++ b/docs/quality/deployment-runbook.md
@@ -10,6 +10,19 @@ Bu çalışma notu üretim dağıtımında kullanılacak kontrol sırasını tan
 - Sağlayıcı kullanılacaksa ilgili `GOOGLE_CLIENT_ID`, `STRIPE_SECRET_KEY`, `STRIPE_WEBHOOK_SECRET`, `RESEND_API_KEY` ve `TELEGRAM_BOT_TOKEN` değerleri.
 - `IHALEIST_USER_DATA_DIR` ve `IHALEIST_SHARED_DATA_DIR`: kalıcı volume altında, uygulama dışından erişilemeyen dizinler.
 
+## Compose ile staging smoke testi
+
+Kökteki `docker-compose.production.yml` production benzeri container, kalıcı `ihaleist-data` volume’u ve `/api/ready` healthcheck’i tanımlar. `AUTH_SECRET` zorunludur; sağlayıcı değişkenleri yalnız ilgili entegrasyon açılacaksa verilir.
+
+```sh
+AUTH_SECRET="<uzun-rastgele-değer>" IHALEIST_IMAGE=ihaleist:ci IHALEIST_PORT=18080 \
+  docker compose -f docker-compose.production.yml up -d
+docker compose -f docker-compose.production.yml ps
+AUTH_SECRET=dummy docker compose -f docker-compose.production.yml down
+```
+
+Yerel compose smoke testi 6 Eylül 2026’da `healthy` duruma ulaştı; bu sonuç production deployment kanıtı değildir.
+
 ## Yayın öncesi
 
 1. `npm ci`, `npm test` ve `npm run build` çalıştırılır; build chunk uyarıları yayın engeli değil, performans backlog’u olarak kaydedilir.
diff --git a/docs/quality/evidence/qa-compose-runtime.json b/docs/quality/evidence/qa-compose-runtime.json
new file mode 100644
index 0000000..7b3abc6
--- /dev/null
+++ b/docs/quality/evidence/qa-compose-runtime.json
@@ -0,0 +1,10 @@
+{
+  "date": "2026-09-06",
+  "image": "ihaleist-qa:local",
+  "checks": {
+    "composeConfig": "successful with AUTH_SECRET",
+    "healthcheck": "healthy",
+    "persistentVolume": "ihaleist-data mounted"
+  },
+  "scope": "Local Docker Compose smoke test; no production deployment or external side effect"
+}