diff --git a/install-stack.sh b/install-stack.sh
index 5e10d08..59f4871 100755
--- a/install-stack.sh
+++ b/install-stack.sh
@@ -1662,6 +1662,88 @@ ${build_out}"
   npm_add_location "/kds/" "10.10.10.125" 3080
 }
 
+deploy_directors_report() {
+  msg_step "Directors Forecast Report (LXC 123 · 10.10.10.123)"
+
+  if [[ -z "${DIRECTORS_REPORT_DB_PASS:-}" ]]; then
+    DIRECTORS_REPORT_DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
+    printf '\nDIRECTORS_REPORT_DB_PASS=%s\n' "$DIRECTORS_REPORT_DB_PASS" >> "$CREDS_FILE"
+    msg_ok "Generated DIRECTORS_REPORT_DB_PASS → ${CREDS_FILE}"
+  fi
+
+  msg_info "Creating LXC 123"
+  create_lxc 123 "10.10.10.123" "directors-report" 1024 1
+  msg_ok "LXC 123 created"
+
+  msg_info "Installing Docker"
+  install_docker 123
+  install_mgmt_key 123
+  msg_ok "Docker + SSH ready"
+
+  msg_info "Creating directors_report_db database"
+  pct exec 100 -- bash -c "
+    docker exec hotel-manage-postgres psql -U postgres -c \
+      \"CREATE USER directors_report WITH PASSWORD '${DIRECTORS_REPORT_DB_PASS}';\" 2>/dev/null || true
+    docker exec hotel-manage-postgres psql -U postgres -c \
+      \"CREATE DATABASE directors_report_db OWNER directors_report;\" 2>/dev/null || true
+    docker exec hotel-manage-postgres psql -U postgres -d directors_report_db -c \
+      \"GRANT ALL ON SCHEMA public TO directors_report;\" 2>/dev/null || true
+    docker exec hotel-manage-postgres psql -U postgres -d forecasting_db -c \
+      \"GRANT SELECT ON newbook_bookings_stats, newbook_net_revenue_data, forecasts, monthly_budgets, daily_budgets TO directors_report;\" 2>/dev/null || true
+  " &>/dev/null
+  msg_ok "Databases ready (own DB + read access to forecasting_db)"
+
+  msg_info "Deploying directors-report"
+  deploy_service 123 "directors-report" "${REPO_ROOT}/directors-report" /opt/directors-report
+
+  push_file 123 /opt/directors-report/.env <<EOF
+NODE_ENV=production
+APP_SLUG=directors-report
+DATABASE_URL=postgresql://directors_report:${DIRECTORS_REPORT_DB_PASS}@10.10.10.100:5432/directors_report_db
+FORECAST_DATABASE_URL=postgresql://directors_report:${DIRECTORS_REPORT_DB_PASS}@10.10.10.100:5432/forecasting_db
+CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
+SETTINGS_URL=http://10.10.10.116:3080
+SETTINGS_SECRET=${SETTINGS_SECRET}
+OFFICE_IP_CHECK=${OFFICE_IP_CHECK:-${OFFICE_IP:-disabled}}
+FRONTEND_PORT=3080
+VITE_HOTEL_NAME=${SITE_NAME:-Hotel}
+EOF
+
+  local build_out
+  if ! build_out=$(pct exec 123 -- bash -c "cd /opt/directors-report && docker compose up -d --build 2>&1"); then
+    msg_error "docker compose build failed in LXC 123:
+${build_out}"
+  fi
+
+  msg_info "Waiting for directors-report"
+  wait_healthy 123 "http://localhost:3080/directors-report/health" \
+    && msg_ok "Directors Forecast Report running at 10.10.10.123:3080" \
+    || msg_warn "Directors Forecast Report may need extra time — check LXC 123"
+
+  msg_info "Seeding directors-report into auth DB"
+  pct exec 100 -- docker exec hotel-manage-postgres psql -U postgres -d auth_db -c "
+    INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
+    VALUES ('directors-report', 'Directors Forecast', 'Monthly revenue forecast report — OTB, pickup, budget and year-on-year comparison', '/directors-report', 'FileBarChart', '#7c3aed', 'Management', '10.10.10.123', 3080)
+    ON CONFLICT (slug) DO UPDATE SET
+      name=EXCLUDED.name, description=EXCLUDED.description, base_path=EXCLUDED.base_path,
+      icon=EXCLUDED.icon, theme_color=EXCLUDED.theme_color, category=EXCLUDED.category,
+      internal_host=EXCLUDED.internal_host, internal_port=EXCLUDED.internal_port;
+    INSERT INTO app_capabilities (app_id, slug, name, description, sort_order)
+    SELECT a.id, c.slug, c.name, c.description, c.sort_order
+    FROM apps a, (VALUES
+      ('view',     'View Report',   'View the forecast worksheet and report',             1),
+      ('edit',     'Edit Forecast', 'Edit pickup, dry/wet overrides and save snapshots',  2),
+      ('settings', 'Settings',      'Access app settings',                                3)
+    ) AS c(slug, name, description, sort_order)
+    WHERE a.slug = 'directors-report'
+    ON CONFLICT (app_id, slug) DO NOTHING;
+  " &>/dev/null \
+    && msg_ok "directors-report seeded into auth DB" \
+    || msg_warn "Seed failed — run seed-app.js manually"
+
+  npm_add_location "/directors-report/" "10.10.10.123" 3080
+}
+
 # ════════════════════════════════════════════════════════════════════════════
 # NPM PROXY HOSTS (via API)
 # ════════════════════════════════════════════════════════════════════════════
@@ -1966,6 +2048,7 @@ if [[ "${1:-}" == "--only" ]]; then
     reports)         deploy_reports ;;
     kitchen)         deploy_kitchen ;;
     kds)             deploy_kds ;;
+    directors-report) deploy_directors_report ;;
   esac
   exit 0
 fi
@@ -1993,5 +2076,6 @@ deploy_rates
 deploy_reports
 deploy_kitchen
 deploy_kds
+deploy_directors_report
 configure_npm_proxy_hosts
 print_summary