diff --git a/docker/wg/clusev-wg-collect.service b/docker/wg/clusev-wg-collect.service
new file mode 100644
index 0000000..2e79628
--- /dev/null
+++ b/docker/wg/clusev-wg-collect.service
@@ -0,0 +1,13 @@
+# Clusev WireGuard status collector — oneshot (HOST-side). Run every few seconds by the paired
+# .timer; writes run/wg-status.json (no secrets) which the dashboard reads. Cheap: `wg show` is
+# instant and an unconfigured host exits immediately. install.sh rewrites the /home/nexxo/clusev paths.
+[Unit]
+Description=Clusev WireGuard status collector
+After=network.target
+
+[Service]
+Type=oneshot
+User=root
+Environment=CLUSEV_DIR=/home/nexxo/clusev
+WorkingDirectory=/home/nexxo/clusev
+ExecStart=/home/nexxo/clusev/docker/wg/clusev-wg.sh collect
diff --git a/docker/wg/clusev-wg-collect.timer b/docker/wg/clusev-wg-collect.timer
new file mode 100644
index 0000000..9a0537d
--- /dev/null
+++ b/docker/wg/clusev-wg-collect.timer
@@ -0,0 +1,13 @@
+# Fires clusev-wg-collect.service every 5 s (after a 10 s boot delay). The dashboard treats a
+# wg-status.json older than ~20 s as "collector offline".
+[Unit]
+Description=Clusev WireGuard status collector — periodic trigger
+
+[Timer]
+OnBootSec=10s
+OnUnitActiveSec=5s
+AccuracySec=1s
+Unit=clusev-wg-collect.service
+
+[Install]
+WantedBy=timers.target