diff --git a/g9-migration/compose/wireguard/docker-compose.yml b/g9-migration/compose/wireguard/docker-compose.yml
new file mode 100644
index 0000000..032585c
--- /dev/null
+++ b/g9-migration/compose/wireguard/docker-compose.yml
@@ -0,0 +1,22 @@
+# WireGuard — E4 (J5040) : accès VPN famille (portable). LAN-only (ufw 51820 udp WAN).
+# Config client générée à l'activation (wg genkey, QR via `wg show`); secrets hors git.
+services:
+  wireguard:
+    image: lscr.io/linuxserver/wireguard@sha256:437a490f7afc6969434251351ba47455a3829e71cef9c6172f3f533332d04063
+    container_name: wireguard
+    restart: unless-stopped
+    labels:
+      - "com.centurylinklabs.watchtower.enable=false"
+    cap_add:
+      - NET_ADMIN
+      - SYS_MODULE
+    sysctls:
+      - net.ipv4.ip_forward=1
+      - net.ipv6.conf.all.forwarding=1
+    environment:
+      - WG_HOST=folzocorp.fr
+      - WG_PORT=51820
+    volumes:
+      - ./wg:/etc/wireguard
+    ports:
+      - "0.0.0.0:51820:51820/udp"