diff --git a/servers/legion/k8s/monitoring/wireguard-expiry-reminder.yaml b/servers/legion/k8s/monitoring/wireguard-expiry-reminder.yaml
new file mode 100644
index 0000000..3116cdd
--- /dev/null
+++ b/servers/legion/k8s/monitoring/wireguard-expiry-reminder.yaml
@@ -0,0 +1,273 @@
+# WireGuard key expiry reminders — voidstash GL.iNet router key expires 2027-04-11
+# Schedule: 1 month out, then weekly, then daily in the last week
+# Posts to #infrastructure-alerts via Slack bot token from Vault
+#
+# To renew: ProtonVPN dashboard → WireGuard → neural_net-US-IL-267 → delete & regenerate
+# Then re-add to GL.iNet router WireGuard Client page
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: wireguard-reminder
+  namespace: monitoring
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: wireguard-reminder-slack
+  namespace: monitoring
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    name: vault
+    kind: ClusterSecretStore
+  target:
+    name: wireguard-reminder-slack
+    creationPolicy: Owner
+  data:
+    - secretKey: bot_token
+      remoteRef:
+        key: secret/data/slack
+        property: bot_token
+---
+# Template for all reminder jobs — actual CronJobs below reference this pattern
+# Reminder script: posts to Slack with urgency based on days remaining
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: wireguard-reminder-script
+  namespace: monitoring
+data:
+  notify.sh: |
+    #!/bin/sh
+    CHANNEL="C0AND3S44CE"
+    EXPIRY="2027-04-11"
+    TODAY=$(date +%Y-%m-%d)
+    DAYS=$(( ($(date -d "$EXPIRY" +%s 2>/dev/null || date -j -f "%Y-%m-%d" "$EXPIRY" +%s) - $(date +%s)) / 86400 ))
+
+    if [ "$DAYS" -le 7 ]; then
+      EMOJI=":rotating_light:"
+      URGENCY="*URGENT — $DAYS days left*"
+    elif [ "$DAYS" -le 14 ]; then
+      EMOJI=":warning:"
+      URGENCY="*$DAYS days left*"
+    else
+      EMOJI=":bell:"
+      URGENCY="$DAYS days left"
+    fi
+
+    curl -s -X POST "https://slack.com/api/chat.postMessage" \
+      -H "Authorization: Bearer $(cat /etc/slack/bot_token)" \
+      -H "Content-Type: application/json" \
+      -d "{
+        \"channel\": \"$CHANNEL\",
+        \"text\": \"$EMOJI *WireGuard key expiry reminder* — $URGENCY\",
+        \"blocks\": [{
+          \"type\": \"section\",
+          \"text\": {
+            \"type\": \"mrkdwn\",
+            \"text\": \"$EMOJI *ProtonVPN WireGuard key expiring soon*\n$URGENCY · expires $EXPIRY\n\n*Key:* \`neural_net-US-IL-267\` on GL.iNet home router\n\n*To renew:* ProtonVPN dashboard → WireGuard → delete \`neural_net-US-IL-267\` → generate new config → re-add to GL.iNet\"
+          }
+        }]
+      }"
+    echo "Notified Slack — $DAYS days until expiry"
+---
+# 1 month out: March 11, 2027
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wireguard-reminder-1month
+  namespace: monitoring
+spec:
+  schedule: "0 9 11 3 *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: wireguard-reminder
+          restartPolicy: OnFailure
+          containers:
+            - name: notify
+              image: alpine:latest
+              command: ["sh", "/scripts/notify.sh"]
+              volumeMounts:
+                - name: script
+                  mountPath: /scripts
+                - name: slack-token
+                  mountPath: /etc/slack
+                  readOnly: true
+              resources:
+                requests:
+                  memory: 16Mi
+                  cpu: 10m
+                limits:
+                  memory: 64Mi
+                  cpu: 50m
+          volumes:
+            - name: script
+              configMap:
+                name: wireguard-reminder-script
+                defaultMode: 0755
+            - name: slack-token
+              secret:
+                secretName: wireguard-reminder-slack
+---
+# Weekly: March 25, 2027
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wireguard-reminder-week3
+  namespace: monitoring
+spec:
+  schedule: "0 9 25 3 *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: wireguard-reminder
+          restartPolicy: OnFailure
+          containers:
+            - name: notify
+              image: alpine:latest
+              command: ["sh", "/scripts/notify.sh"]
+              volumeMounts:
+                - name: script
+                  mountPath: /scripts
+                - name: slack-token
+                  mountPath: /etc/slack
+                  readOnly: true
+              resources:
+                requests:
+                  memory: 16Mi
+                  cpu: 10m
+                limits:
+                  memory: 64Mi
+                  cpu: 50m
+          volumes:
+            - name: script
+              configMap:
+                name: wireguard-reminder-script
+                defaultMode: 0755
+            - name: slack-token
+              secret:
+                secretName: wireguard-reminder-slack
+---
+# Weekly: April 1, 2027
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wireguard-reminder-week2
+  namespace: monitoring
+spec:
+  schedule: "0 9 1 4 *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: wireguard-reminder
+          restartPolicy: OnFailure
+          containers:
+            - name: notify
+              image: alpine:latest
+              command: ["sh", "/scripts/notify.sh"]
+              volumeMounts:
+                - name: script
+                  mountPath: /scripts
+                - name: slack-token
+                  mountPath: /etc/slack
+                  readOnly: true
+              resources:
+                requests:
+                  memory: 16Mi
+                  cpu: 10m
+                limits:
+                  memory: 64Mi
+                  cpu: 50m
+          volumes:
+            - name: script
+              configMap:
+                name: wireguard-reminder-script
+                defaultMode: 0755
+            - name: slack-token
+              secret:
+                secretName: wireguard-reminder-slack
+---
+# Weekly: April 4, 2027
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wireguard-reminder-week1
+  namespace: monitoring
+spec:
+  schedule: "0 9 4 4 *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: wireguard-reminder
+          restartPolicy: OnFailure
+          containers:
+            - name: notify
+              image: alpine:latest
+              command: ["sh", "/scripts/notify.sh"]
+              volumeMounts:
+                - name: script
+                  mountPath: /scripts
+                - name: slack-token
+                  mountPath: /etc/slack
+                  readOnly: true
+              resources:
+                requests:
+                  memory: 16Mi
+                  cpu: 10m
+                limits:
+                  memory: 64Mi
+                  cpu: 50m
+          volumes:
+            - name: script
+              configMap:
+                name: wireguard-reminder-script
+                defaultMode: 0755
+            - name: slack-token
+              secret:
+                secretName: wireguard-reminder-slack
+---
+# Daily April 5-10: run every day in April, script computes days remaining
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: wireguard-reminder-daily
+  namespace: monitoring
+spec:
+  schedule: "0 9 5-10 4 *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: wireguard-reminder
+          restartPolicy: OnFailure
+          containers:
+            - name: notify
+              image: alpine:latest
+              command: ["sh", "/scripts/notify.sh"]
+              volumeMounts:
+                - name: script
+                  mountPath: /scripts
+                - name: slack-token
+                  mountPath: /etc/slack
+                  readOnly: true
+              resources:
+                requests:
+                  memory: 16Mi
+                  cpu: 10m
+                limits:
+                  memory: 64Mi
+                  cpu: 50m
+          volumes:
+            - name: script
+              configMap:
+                name: wireguard-reminder-script
+                defaultMode: 0755
+            - name: slack-token
+              secret:
+                secretName: wireguard-reminder-slack