diff --git a/terraform/README.md b/terraform/README.md
index c2f9e37..c8163d0 100644
--- a/terraform/README.md
+++ b/terraform/README.md
@@ -4,8 +4,14 @@ Hetzner Cloud infrastructure managed via Terraform.
 
 ## Servers
 
-- **asxpio-ops** (CX22: 2 vCPU, 4GB) - Forgejo, Traefik, monitoring, static sites
-- **asxpio-services** (CX43: 8 vCPU, 16GB) - Immich, game servers, XMPP, CI/CD
+- **asxpio-ops** (2 vCPU, 4GB) - Traefik, Forgejo, app stacks
+- **asxpio-services** (CX43: 8 vCPU, 16GB) - CI runner, game servers, SillyTavern
+
+Both servers carry `prevent_destroy` and ignore changes to `user_data`,
+`image` and `ssh_keys`: cloud-init only runs at first boot, and hcloud
+would otherwise replace a running server when those change. Edits to
+`cloud-init/*.yaml` therefore describe a rebuild, not the live machine;
+day-to-day configuration is in `../ansible`.
 
 ## Storage (S3-compatible)
 
@@ -17,7 +23,7 @@ Hetzner Cloud infrastructure managed via Terraform.
 - asxpio-backups-main (hel1)
 - asxpio-backups-repl (fsn1)
 
-**Immich:**
+**Immich (buckets kept, service not running):**
 - asxpio-immich-main (hel1)
 - asxpio-immich-repl (fsn1)
 
@@ -31,7 +37,7 @@ Hetzner Cloud infrastructure managed via Terraform.
 
 | Item | Monthly |
 |------|---------|
-| ops CX22 | €3.71 |
+| ops | €3.71 |
 | services CX43 | €11.15 |
 | IPv4 (2x) | €1.24 |
 | S3 (1TB) | €6.19 |
diff --git a/terraform/cloud-init/ops.yaml b/terraform/cloud-init/ops.yaml
index 68ee38c..ddffdee 100644
--- a/terraform/cloud-init/ops.yaml
+++ b/terraform/cloud-init/ops.yaml
@@ -32,6 +32,14 @@ users:
     ssh_authorized_keys:
       - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZ+/5F7SxdTVW47iiStLpGK77oWfR5NgaK4tTSR/aVB me@asxp.io
 
+  - name: zerrtika
+    groups: sudo
+    shell: /bin/bash
+    sudo: ['ALL=(ALL) NOPASSWD:ALL']
+    lock_passwd: true
+    ssh_authorized_keys:
+      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac
+
   - name: deploy
     groups: sudo
     shell: /bin/bash
@@ -90,6 +98,7 @@ runcmd:
 
   # Add users to docker group (after docker is installed)
   - usermod -aG docker asxpi
+  - usermod -aG docker zerrtika
   - usermod -aG docker deploy
 
   # Enable and start fail2ban
diff --git a/terraform/cloud-init/services.yaml b/terraform/cloud-init/services.yaml
index 78c4033..2880e0b 100644
--- a/terraform/cloud-init/services.yaml
+++ b/terraform/cloud-init/services.yaml
@@ -31,6 +31,13 @@ users:
     lock_passwd: true
     ssh_authorized_keys:
       - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZ+/5F7SxdTVW47iiStLpGK77oWfR5NgaK4tTSR/aVB me@asxp.io
+  - name: zerrtika
+    groups: sudo
+    shell: /bin/bash
+    sudo: ['ALL=(ALL) NOPASSWD:ALL']
+    lock_passwd: true
+    ssh_authorized_keys:
+      - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIELE7hTD4sC5raqjSxy2fXyM+q1CwwVuy9KLFgDR6SFl zerrtika@zerrtika-mac
   - name: deploy
     groups: sudo
     shell: /bin/bash
@@ -89,6 +96,7 @@ runcmd:
 
   # Add users to docker group (after docker is installed)
   - usermod -aG docker asxpi
+  - usermod -aG docker zerrtika
   - usermod -aG docker deploy
 
   # Enable and start fail2ban
diff --git a/terraform/servers.tf b/terraform/servers.tf
index 945ce29..1d48fd9 100644
--- a/terraform/servers.tf
+++ b/terraform/servers.tf
@@ -1,4 +1,4 @@
-# Ops Server - CX22 (2 vCPU, 4GB RAM)
+# Ops Server (2 vCPU, 4GB RAM)
 resource "hcloud_server" "ops" {
   name        = "asxpio-ops"
   image       = "debian-13"
@@ -33,6 +33,13 @@ resource "hcloud_server" "ops" {
 
   # Cloud-init for automated server setup
   user_data = file("${path.module}/cloud-init/ops.yaml")
+  # cloud-init only runs at first boot, and hcloud replaces the server
+  # when user_data, image or ssh_keys change. Never let an edit to those
+  # destroy a running machine: changes there apply to a rebuild only.
+  lifecycle {
+    ignore_changes  = [user_data, image, ssh_keys]
+    prevent_destroy = true
+  }
 }
 
 # Services Server - CX43 (8 vCPU, 16GB RAM)
@@ -70,4 +77,11 @@ resource "hcloud_server" "services" {
 
   # Cloud-init for automated server setup
   user_data = file("${path.module}/cloud-init/services.yaml")
+  # cloud-init only runs at first boot, and hcloud replaces the server
+  # when user_data, image or ssh_keys change. Never let an edit to those
+  # destroy a running machine: changes there apply to a rebuild only.
+  lifecycle {
+    ignore_changes  = [user_data, image, ssh_keys]
+    prevent_destroy = true
+  }
 }