diff --git a/stacks/dbaas/modules/dbaas/main.tf b/stacks/dbaas/modules/dbaas/main.tf
index 68ea9f44..1ae6f415 100644
--- a/stacks/dbaas/modules/dbaas/main.tf
+++ b/stacks/dbaas/modules/dbaas/main.tf
@@ -1236,6 +1236,34 @@ resource "null_resource" "pg_wealthfolio_sync_db" {
   }
 }
 
+# Create fire_planner database for the FIRE retirement-planning service.
+# Role password is managed by Vault Database Secrets Engine
+# (static role `pg-fire-planner`, 7d rotation).
+# fire_planner reads from payslip_ingest + wealthfolio_sync (read-only)
+# and writes its own MC results into schema fire_planner.
+resource "null_resource" "pg_fire_planner_db" {
+  depends_on = [null_resource.pg_cluster]
+
+  triggers = {
+    db_name  = "fire_planner"
+    username = "fire_planner"
+  }
+
+  provisioner "local-exec" {
+    command = <<-EOT
+      PRIMARY=$(kubectl --kubeconfig ${var.kube_config_path} get cluster -n dbaas pg-cluster -o jsonpath='{.status.currentPrimary}')
+      kubectl --kubeconfig ${var.kube_config_path} exec -n dbaas $PRIMARY -c postgres -- \
+        bash -c '
+          psql -U postgres -tc "SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = '"'"'fire_planner'"'"'" | grep -q 1 || \
+            psql -U postgres -c "CREATE ROLE fire_planner WITH LOGIN PASSWORD '"'"'changeme-vault-will-rotate'"'"'"
+          psql -U postgres -tc "SELECT 1 FROM pg_catalog.pg_database WHERE datname = '"'"'fire_planner'"'"'" | grep -q 1 || \
+            psql -U postgres -c "CREATE DATABASE fire_planner OWNER fire_planner"
+          psql -U postgres -c "GRANT ALL PRIVILEGES ON DATABASE fire_planner TO fire_planner"
+        '
+    EOT
+  }
+}
+
 # Old PostgreSQL deployment — kept commented for rollback reference
 # resource "kubernetes_deployment" "postgres" {
 #   metadata {
diff --git a/stacks/fire-planner/main.tf b/stacks/fire-planner/main.tf
new file mode 100644
index 00000000..09e1177b
--- /dev/null
+++ b/stacks/fire-planner/main.tf
@@ -0,0 +1,383 @@
+variable "image_tag" {
+  type        = string
+  default     = "latest"
+  description = "fire-planner image tag. Use 8-char git SHA in CI; :latest only for local trials."
+}
+
+variable "postgresql_host" { type = string }
+
+locals {
+  namespace = "fire-planner"
+  image     = "registry.viktorbarzin.me/fire-planner:${var.image_tag}"
+  labels = {
+    app = "fire-planner"
+  }
+}
+
+resource "kubernetes_namespace" "fire_planner" {
+  metadata {
+    name = local.namespace
+    labels = {
+      tier              = local.tiers.aux
+      "istio-injection" = "disabled"
+    }
+  }
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps
+    # this label on every namespace.
+    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
+  }
+}
+
+# App secrets — the recompute-API bearer token (manual seed in Vault).
+# Seed before applying:
+#   secret/fire-planner -> property `recompute_bearer_token`
+resource "kubernetes_manifest" "external_secret" {
+  manifest = {
+    apiVersion = "external-secrets.io/v1beta1"
+    kind       = "ExternalSecret"
+    metadata = {
+      name      = "fire-planner-secrets"
+      namespace = local.namespace
+    }
+    spec = {
+      refreshInterval = "15m"
+      secretStoreRef = {
+        name = "vault-kv"
+        kind = "ClusterSecretStore"
+      }
+      target = {
+        name = "fire-planner-secrets"
+        template = {
+          metadata = {
+            annotations = {
+              "reloader.stakater.com/match" = "true"
+            }
+          }
+        }
+      }
+      data = [
+        {
+          secretKey = "RECOMPUTE_BEARER_TOKEN"
+          remoteRef = {
+            key      = "fire-planner"
+            property = "recompute_bearer_token"
+          }
+        },
+      ]
+    }
+  }
+  depends_on = [kubernetes_namespace.fire_planner]
+}
+
+# DB credentials from Vault database engine (rotated every 7 days).
+# Template builds the asyncpg DSN consumed by the FastAPI app + CronJob
+# as DB_CONNECTION_STRING.
+resource "kubernetes_manifest" "db_external_secret" {
+  manifest = {
+    apiVersion = "external-secrets.io/v1beta1"
+    kind       = "ExternalSecret"
+    metadata = {
+      name      = "fire-planner-db-creds"
+      namespace = local.namespace
+    }
+    spec = {
+      refreshInterval = "15m"
+      secretStoreRef = {
+        name = "vault-database"
+        kind = "ClusterSecretStore"
+      }
+      target = {
+        name = "fire-planner-db-creds"
+        template = {
+          metadata = {
+            annotations = {
+              "reloader.stakater.com/match" = "true"
+            }
+          }
+          data = {
+            DB_CONNECTION_STRING = "postgresql+asyncpg://fire_planner:{{ .password }}@${var.postgresql_host}:5432/fire_planner"
+            DB_PASSWORD          = "{{ .password }}"
+          }
+        }
+      }
+      data = [{
+        secretKey = "password"
+        remoteRef = {
+          key      = "static-creds/pg-fire-planner"
+          property = "password"
+        }
+      }]
+    }
+  }
+  depends_on = [kubernetes_namespace.fire_planner]
+}
+
+resource "kubernetes_deployment" "fire_planner" {
+  metadata {
+    name      = "fire-planner"
+    namespace = kubernetes_namespace.fire_planner.metadata[0].name
+    labels = merge(local.labels, {
+      tier = local.tiers.aux
+    })
+    annotations = {
+      "reloader.stakater.com/search" = "true"
+    }
+  }
+
+  spec {
+    replicas = 1
+    strategy {
+      type = "Recreate"
+    }
+
+    selector {
+      match_labels = local.labels
+    }
+
+    template {
+      metadata {
+        labels = local.labels
+        annotations = {
+          "dependency.kyverno.io/wait-for" = "postgresql.dbaas:5432"
+        }
+      }
+
+      spec {
+        image_pull_secrets {
+          name = "registry-credentials"
+        }
+
+        init_container {
+          name    = "alembic-migrate"
+          image   = local.image
+          command = ["python", "-m", "fire_planner", "migrate"]
+
+          env_from {
+            secret_ref {
+              name = "fire-planner-db-creds"
+            }
+          }
+
+          resources {
+            requests = {
+              cpu    = "50m"
+              memory = "256Mi"
+            }
+            limits = {
+              memory = "512Mi"
+            }
+          }
+        }
+
+        container {
+          name  = "fire-planner"
+          image = local.image
+
+          command = ["python", "-m", "fire_planner", "serve"]
+
+          port {
+            container_port = 8080
+          }
+
+          env_from {
+            secret_ref {
+              name = "fire-planner-secrets"
+            }
+          }
+          env_from {
+            secret_ref {
+              name = "fire-planner-db-creds"
+            }
+          }
+
+          readiness_probe {
+            http_get {
+              path = "/healthz"
+              port = 8080
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 10
+          }
+
+          liveness_probe {
+            http_get {
+              path = "/healthz"
+              port = 8080
+            }
+            initial_delay_seconds = 5
+            period_seconds        = 10
+          }
+
+          resources {
+            requests = {
+              cpu    = "100m"
+              memory = "512Mi"
+            }
+            limits = {
+              memory = "1024Mi"
+            }
+          }
+        }
+      }
+    }
+  }
+
+  lifecycle {
+    ignore_changes = [spec[0].template[0].spec[0].dns_config] # KYVERNO_LIFECYCLE_V1
+  }
+
+  depends_on = [
+    kubernetes_manifest.external_secret,
+    kubernetes_manifest.db_external_secret,
+  ]
+}
+
+# ClusterIP-only — /recompute is cluster-internal (operator triggers
+# via kubectl port-forward or ad-hoc CronJob).
+resource "kubernetes_service" "fire_planner" {
+  metadata {
+    name      = "fire-planner"
+    namespace = kubernetes_namespace.fire_planner.metadata[0].name
+    labels    = local.labels
+  }
+
+  spec {
+    type     = "ClusterIP"
+    selector = local.labels
+
+    port {
+      name        = "http"
+      port        = 8080
+      target_port = 8080
+    }
+  }
+}
+
+# Monthly recompute on the 2nd at 09:00 UTC. Wealthfolio-sync runs on
+# the 1st at 08:00, so account_snapshot is fresh by the time the
+# planner picks up.
+resource "kubernetes_cron_job_v1" "fire_planner_recompute" {
+  metadata {
+    name      = "fire-planner-recompute"
+    namespace = kubernetes_namespace.fire_planner.metadata[0].name
+  }
+  spec {
+    schedule                      = "0 9 2 * *"
+    concurrency_policy            = "Forbid"
+    successful_jobs_history_limit = 3
+    failed_jobs_history_limit     = 5
+    starting_deadline_seconds     = 600
+
+    job_template {
+      metadata {
+        labels = local.labels
+      }
+      spec {
+        backoff_limit              = 1
+        ttl_seconds_after_finished = 86400
+        template {
+          metadata {
+            labels = local.labels
+          }
+          spec {
+            restart_policy = "OnFailure"
+            image_pull_secrets {
+              name = "registry-credentials"
+            }
+            container {
+              name    = "recompute"
+              image   = local.image
+              command = ["python", "-m", "fire_planner", "recompute-all"]
+
+              env_from {
+                secret_ref {
+                  name = "fire-planner-secrets"
+                }
+              }
+              env_from {
+                secret_ref {
+                  name = "fire-planner-db-creds"
+                }
+              }
+
+              resources {
+                requests = {
+                  cpu    = "200m"
+                  memory = "1Gi"
+                }
+                limits = {
+                  memory = "2Gi"
+                }
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+
+  lifecycle {
+    # KYVERNO_LIFECYCLE_V1
+    ignore_changes = [spec[0].job_template[0].spec[0].template[0].spec[0].dns_config]
+  }
+
+  depends_on = [
+    kubernetes_manifest.external_secret,
+    kubernetes_manifest.db_external_secret,
+  ]
+}
+
+# Plan-time read of the ESO-created K8s Secret for Grafana datasource
+# password. First-apply gotcha: must
+# `terragrunt apply -target=kubernetes_manifest.db_external_secret` so
+# the Secret exists before this data source plans.
+data "kubernetes_secret" "fire_planner_db_creds" {
+  metadata {
+    name      = "fire-planner-db-creds"
+    namespace = kubernetes_namespace.fire_planner.metadata[0].name
+  }
+  depends_on = [kubernetes_manifest.db_external_secret]
+}
+
+# Grafana datasource for fire_planner PostgreSQL DB.
+# Lives in the monitoring namespace so the grafana sidecar
+# (label grafana_datasource=1) picks it up.
+#
+# Grafana 11.2+ Postgres plugin reads the DB name from jsonData.database;
+# the top-level `database` field is silently ignored by the frontend and
+# triggers "you do not have default database" on every panel.
+# See github.com/grafana/grafana#112418 — same fix as the payslip-ingest
+# datasource (commit cc56ba29).
+resource "kubernetes_config_map" "grafana_fire_planner_datasource" {
+  metadata {
+    name      = "grafana-fire-planner-datasource"
+    namespace = "monitoring"
+    labels = {
+      grafana_datasource = "1"
+    }
+  }
+  data = {
+    "fire-planner-datasource.yaml" = yamlencode({
+      apiVersion = 1
+      datasources = [{
+        name   = "FirePlanner"
+        type   = "postgres"
+        access = "proxy"
+        url    = "${var.postgresql_host}:5432"
+        user   = "fire_planner"
+        uid    = "fire-planner-pg"
+        jsonData = {
+          database        = "fire_planner"
+          sslmode         = "disable"
+          postgresVersion = 1600
+          timescaledb     = false
+        }
+        secureJsonData = {
+          password = data.kubernetes_secret.fire_planner_db_creds.data["DB_PASSWORD"]
+        }
+        editable = true
+      }]
+    })
+  }
+}
diff --git a/stacks/fire-planner/terragrunt.hcl b/stacks/fire-planner/terragrunt.hcl
new file mode 100644
index 00000000..c1d2e468
--- /dev/null
+++ b/stacks/fire-planner/terragrunt.hcl
@@ -0,0 +1,28 @@
+include "root" {
+  path = find_in_parent_folders()
+}
+
+dependency "platform" {
+  config_path  = "../platform"
+  skip_outputs = true
+}
+
+dependency "vault" {
+  config_path  = "../vault"
+  skip_outputs = true
+}
+
+dependency "external-secrets" {
+  config_path  = "../external-secrets"
+  skip_outputs = true
+}
+
+dependency "dbaas" {
+  config_path  = "../dbaas"
+  skip_outputs = true
+}
+
+inputs = {
+  # fire-planner repo HEAD — bump on every deploy.
+  image_tag = "latest"
+}
diff --git a/stacks/monitoring/modules/monitoring/dashboards/fire-planner.json b/stacks/monitoring/modules/monitoring/dashboards/fire-planner.json
new file mode 100644
index 00000000..9dba9e11
--- /dev/null
+++ b/stacks/monitoring/modules/monitoring/dashboards/fire-planner.json
@@ -0,0 +1,226 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {"type": "datasource", "uid": "grafana"},
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "description": "FIRE Retirement Planner — risk-adjusted, tax-minimised Monte Carlo over jurisdictions, withdrawal strategies, and UK-departure years. Backed by fire_planner schema on pg-cluster-rw.",
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "id": null,
+  "templating": {
+    "list": [
+      {
+        "name": "scenario",
+        "type": "query",
+        "label": "Scenario",
+        "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+        "query": "SELECT external_id FROM fire_planner.scenario ORDER BY external_id",
+        "refresh": 1,
+        "includeAll": false,
+        "multi": false,
+        "current": {"selected": false, "text": "cyprus-vpw-leave-y3-glide-rising", "value": "cyprus-vpw-leave-y3-glide-rising"}
+      }
+    ]
+  },
+  "links": [],
+  "panels": [
+    {
+      "id": 1,
+      "title": "Net worth over time (real + nominal)",
+      "type": "timeseries",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 8, "w": 24, "x": 0, "y": 0},
+      "fieldConfig": {
+        "defaults": {"unit": "currencyGBP", "decimals": 0},
+        "overrides": []
+      },
+      "options": {"legend": {"displayMode": "table", "showLegend": true}, "tooltip": {"mode": "multi"}},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "time_series",
+          "rawSql": "SELECT snapshot_date AS time, account_name AS metric, SUM(market_value_gbp) AS value FROM fire_planner.account_snapshot WHERE snapshot_date >= NOW() - INTERVAL '10 years' GROUP BY snapshot_date, account_name ORDER BY snapshot_date"
+        }
+      ]
+    },
+    {
+      "id": 2,
+      "title": "Monte Carlo fan chart — selected scenario",
+      "type": "timeseries",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 10, "w": 24, "x": 0, "y": 8},
+      "description": "P10/p25/p50/p75/p90 portfolio value across MC paths, for the scenario picked in the selector at the top.",
+      "fieldConfig": {"defaults": {"unit": "currencyGBP", "decimals": 0}, "overrides": []},
+      "options": {"legend": {"displayMode": "table", "showLegend": true}, "tooltip": {"mode": "multi"}},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "time_series",
+          "rawSql": "SELECT (DATE_TRUNC('year', NOW()) + (year_idx || ' years')::interval) AS time, 'p10' AS metric, p10_portfolio_gbp AS value FROM fire_planner.projection_yearly p JOIN fire_planner.mc_run r ON r.id = p.mc_run_id JOIN fire_planner.scenario s ON s.id = r.scenario_id WHERE s.external_id = '$scenario' UNION ALL SELECT (DATE_TRUNC('year', NOW()) + (year_idx || ' years')::interval), 'p25', p25_portfolio_gbp FROM fire_planner.projection_yearly p JOIN fire_planner.mc_run r ON r.id = p.mc_run_id JOIN fire_planner.scenario s ON s.id = r.scenario_id WHERE s.external_id = '$scenario' UNION ALL SELECT (DATE_TRUNC('year', NOW()) + (year_idx || ' years')::interval), 'p50', p50_portfolio_gbp FROM fire_planner.projection_yearly p JOIN fire_planner.mc_run r ON r.id = p.mc_run_id JOIN fire_planner.scenario s ON s.id = r.scenario_id WHERE s.external_id = '$scenario' UNION ALL SELECT (DATE_TRUNC('year', NOW()) + (year_idx || ' years')::interval), 'p75', p75_portfolio_gbp FROM fire_planner.projection_yearly p JOIN fire_planner.mc_run r ON r.id = p.mc_run_id JOIN fire_planner.scenario s ON s.id = r.scenario_id WHERE s.external_id = '$scenario' UNION ALL SELECT (DATE_TRUNC('year', NOW()) + (year_idx || ' years')::interval), 'p90', p90_portfolio_gbp FROM fire_planner.projection_yearly p JOIN fire_planner.mc_run r ON r.id = p.mc_run_id JOIN fire_planner.scenario s ON s.id = r.scenario_id WHERE s.external_id = '$scenario' ORDER BY time"
+        }
+      ]
+    },
+    {
+      "id": 3,
+      "title": "Confidence heatmap — jurisdiction × strategy",
+      "type": "table",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 18},
+      "description": "Median success rate by (jurisdiction, strategy), averaged across leave-UK years and glide paths.",
+      "fieldConfig": {
+        "defaults": {"custom": {"align": "left", "displayMode": "auto"}, "unit": "percentunit", "decimals": 2},
+        "overrides": []
+      },
+      "options": {"showHeader": true},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "table",
+          "rawSql": "SELECT jurisdiction, strategy, AVG(success_rate) AS avg_success FROM fire_planner.scenario_summary GROUP BY jurisdiction, strategy ORDER BY jurisdiction, strategy"
+        }
+      ]
+    },
+    {
+      "id": 4,
+      "title": "Median lifetime tax — by jurisdiction",
+      "type": "barchart",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 18},
+      "fieldConfig": {"defaults": {"unit": "currencyGBP", "decimals": 0}, "overrides": []},
+      "options": {"orientation": "horizontal", "showValue": "auto", "stacking": "none", "legend": {"displayMode": "list"}},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "table",
+          "rawSql": "SELECT jurisdiction, AVG(median_lifetime_tax_gbp) AS lifetime_tax FROM fire_planner.scenario_summary GROUP BY jurisdiction ORDER BY lifetime_tax DESC"
+        }
+      ]
+    },
+    {
+      "id": 5,
+      "title": "Withdrawal runway — years to ruin (failing paths)",
+      "type": "table",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 26},
+      "description": "Among scenarios where some MC paths failed, the median year-to-ruin. Empty where every path survives.",
+      "fieldConfig": {"defaults": {"unit": "y", "decimals": 1}, "overrides": []},
+      "options": {"showHeader": true},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "table",
+          "rawSql": "SELECT jurisdiction, strategy, leave_uk_year, glide_path, median_years_to_ruin FROM fire_planner.scenario_summary WHERE median_years_to_ruin IS NOT NULL ORDER BY median_years_to_ruin ASC LIMIT 20"
+        }
+      ]
+    },
+    {
+      "id": 6,
+      "title": "Optimal leave-UK year",
+      "type": "stat",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 4, "w": 6, "x": 12, "y": 26},
+      "description": "leave_uk_year that maximises success_rate − lifetime_tax (tax in £M; small weighting).",
+      "fieldConfig": {"defaults": {"unit": "none"}, "overrides": []},
+      "options": {"colorMode": "value", "reduceOptions": {"calcs": ["lastNotNull"]}},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "table",
+          "rawSql": "SELECT leave_uk_year FROM fire_planner.scenario_summary WHERE jurisdiction <> 'uk' ORDER BY (success_rate - median_lifetime_tax_gbp / 1000000.0) DESC LIMIT 1"
+        }
+      ]
+    },
+    {
+      "id": 7,
+      "title": "Median ending wealth — selected scenario",
+      "type": "stat",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 4, "w": 6, "x": 18, "y": 26},
+      "fieldConfig": {"defaults": {"unit": "currencyGBP", "decimals": 0}, "overrides": []},
+      "options": {"colorMode": "value", "reduceOptions": {"calcs": ["lastNotNull"]}},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "table",
+          "rawSql": "SELECT p50_ending_gbp FROM fire_planner.scenario_summary WHERE scenario_id = (SELECT id FROM fire_planner.scenario WHERE external_id = '$scenario')"
+        }
+      ]
+    },
+    {
+      "id": 8,
+      "title": "Success rate vs spend (UK-stay)",
+      "type": "barchart",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 8, "w": 12, "x": 0, "y": 30},
+      "description": "Sanity gauge — UK success rate by strategy, helps anchor expectations against published cFIREsim numbers.",
+      "fieldConfig": {"defaults": {"unit": "percentunit", "decimals": 2}, "overrides": []},
+      "options": {"orientation": "horizontal", "showValue": "auto", "legend": {"displayMode": "list"}},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "table",
+          "rawSql": "SELECT strategy, AVG(success_rate) AS success FROM fire_planner.scenario_summary WHERE jurisdiction = 'uk' GROUP BY strategy ORDER BY success DESC"
+        }
+      ]
+    },
+    {
+      "id": 9,
+      "title": "Sequence-of-returns sensitivity (top failing scenarios)",
+      "type": "table",
+      "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+      "gridPos": {"h": 8, "w": 12, "x": 12, "y": 30},
+      "description": "Pearson correlation between year-1 portfolio drawdown and overall success — strongly negative ⇒ scenario is sequence-of-returns sensitive (case for the rising-equity glide).",
+      "fieldConfig": {"defaults": {"unit": "none", "decimals": 4}, "overrides": []},
+      "options": {"showHeader": true},
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {"type": "grafana-postgresql-datasource", "uid": "fire-planner-pg"},
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "table",
+          "rawSql": "SELECT s.external_id, r.sequence_risk_correlation, r.success_rate FROM fire_planner.mc_run r JOIN fire_planner.scenario s ON s.id = r.scenario_id WHERE r.id IN (SELECT MAX(id) FROM fire_planner.mc_run GROUP BY scenario_id) ORDER BY r.sequence_risk_correlation ASC LIMIT 15"
+        }
+      ]
+    }
+  ],
+  "schemaVersion": 39,
+  "tags": ["finance", "fire", "retirement", "monte-carlo"],
+  "title": "FIRE Planner",
+  "uid": "fire-planner",
+  "version": 1,
+  "weekStart": ""
+}
diff --git a/stacks/monitoring/modules/monitoring/grafana.tf b/stacks/monitoring/modules/monitoring/grafana.tf
index ed1f4451..b7f8d261 100644
--- a/stacks/monitoring/modules/monitoring/grafana.tf
+++ b/stacks/monitoring/modules/monitoring/grafana.tf
@@ -137,6 +137,7 @@ locals {
     "uk-payslip.json"         = "Finance"
     "job-hunter.json"         = "Finance"
     "wealth.json"             = "Finance"
+    "fire-planner.json"       = "Finance"
   }
 }
 
diff --git a/stacks/vault/main.tf b/stacks/vault/main.tf
index ee8d98ef..a47379ff 100644
--- a/stacks/vault/main.tf
+++ b/stacks/vault/main.tf
@@ -539,7 +539,7 @@ resource "vault_database_secret_backend_connection" "postgresql" {
     "pg-health", "pg-linkwarden",
     "pg-affine", "pg-woodpecker", "pg-claude-memory",
     "pg-terraform-state", "pg-payslip-ingest", "pg-job-hunter",
-    "pg-wealthfolio-sync"
+    "pg-wealthfolio-sync", "pg-fire-planner"
   ]
 
   postgresql {
@@ -701,6 +701,14 @@ resource "vault_database_secret_backend_static_role" "pg_wealthfolio_sync" {
   rotation_period = 604800
 }
 
+resource "vault_database_secret_backend_static_role" "pg_fire_planner" {
+  backend         = vault_mount.database.path
+  db_name         = vault_database_secret_backend_connection.postgresql.name
+  name            = "pg-fire-planner"
+  username        = "fire_planner"
+  rotation_period = 604800
+}
+
 # =============================================================================
 # Kubernetes Secrets Engine — Dynamic K8s Credentials
 # =============================================================================