diff --git a/README.md b/README.md
index 96859e4..50dc802 100644
--- a/README.md
+++ b/README.md
@@ -457,6 +457,20 @@ If these variables are not set, the Data Quality Agent will still run and genera
 Reports are accessible at `https://<your-host>/bbmri-data-quality-agent` (default credentials are admin:admin, please change it after first login!!).
 
 [Official documentation](https://fdqf.bbmri-eric.eu/user/deployment.html)
+
+### OVis (CCP only)
+
+OVis visualizes your tumor documentation data at `https://<your-host>/ccp-ovis`. Set in your `ccp.conf`:
+
+```bash
+ENABLE_OVIS=true
+OVIS_SUPERADMIN_EMAILS=admin@your-site.de
+```
+
+Users authenticate centrally with their CCP account (membership in your site's CCP group required), while their permissions are defined inside OVis -- so no duplicate user accounts are needed. The addresses in `OVIS_SUPERADMIN_EMAILS` become super admins and can grant roles to everyone else.
+
+Data is imported on first start into `/var/cache/bridgehead/ccp/ovis-mongodb`. Deleting that directory also resets all OVis permissions.
+
 ## Things you should know
 
 ### Auto-Updates
diff --git a/ccp/modules/ovis-compose.yml b/ccp/modules/ovis-compose.yml
new file mode 100644
index 0000000..e34e094
--- /dev/null
+++ b/ccp/modules/ovis-compose.yml
@@ -0,0 +1,102 @@
+services:
+  ovis-traefik-forward-auth:
+    container_name: bridgehead-ccp-ovis-forward-auth
+    image: docker.verbis.dkfz.de/cache/oauth2-proxy/oauth2-proxy:latest
+    environment:
+      - http_proxy=http://forward_proxy:3128
+      - https_proxy=http://forward_proxy:3128
+      - OAUTH2_PROXY_PROVIDER=oidc
+      - OAUTH2_PROXY_SKIP_PROVIDER_BUTTON=true
+      - OAUTH2_PROXY_OIDC_ISSUER_URL=${OIDC_PRIVATE_URL}
+      - OAUTH2_PROXY_CLIENT_ID=${OIDC_PRIVATE_CLIENT_ID}
+      - OAUTH2_PROXY_CLIENT_SECRET=${OIDC_CLIENT_SECRET}
+      - OAUTH2_PROXY_COOKIE_SECRET=${OVIS_AUTH_COOKIE_SECRET}
+      - OAUTH2_PROXY_COOKIE_NAME=_BRIDGEHEAD_oauth2_ovis
+      - OAUTH2_PROXY_COOKIE_DOMAINS=.${HOST}
+      - OAUTH2_PROXY_COOKIE_REFRESH=4m
+      - OAUTH2_PROXY_COOKIE_EXPIRE=24h
+      - OAUTH2_PROXY_HTTP_ADDRESS=:4180
+      - OAUTH2_PROXY_REVERSE_PROXY=true
+      - OAUTH2_PROXY_WHITELIST_DOMAINS=.${HOST}
+      - OAUTH2_PROXY_UPSTREAMS=static://202
+      - OAUTH2_PROXY_EMAIL_DOMAINS=*
+      - OAUTH2_PROXY_SCOPE=openid profile email
+      - OAUTH2_PROXY_SET_AUTHORIZATION_HEADER=true
+      - OAUTH2_PROXY_SET_XAUTHREQUEST=true
+      - OAUTH2_PROXY_ALLOWED_GROUPS=${OIDC_USER_GROUP}
+      - OAUTH2_PROXY_OIDC_GROUPS_CLAIM=${OIDC_GROUP_CLAIM}
+      - OAUTH2_PROXY_PROXY_PREFIX=/oauth2-ovis
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.services.ovis-traefik-forward-auth.loadbalancer.server.port=4180"
+      - "traefik.http.routers.ovis-traefik-forward-auth.rule=Host(`${HOST}`) && PathPrefix(`/oauth2-ovis`)"
+      - "traefik.http.routers.ovis-traefik-forward-auth.tls=true"
+      - "traefik.http.middlewares.traefik-forward-auth-ovis.forwardauth.address=http://ovis-traefik-forward-auth:4180"
+      - "traefik.http.middlewares.traefik-forward-auth-ovis.forwardauth.authResponseHeaders=Authorization,X-Auth-Request-Email,X-Auth-Request-User,X-Auth-Request-Preferred-Username"
+    depends_on:
+      forward_proxy:
+        condition: service_healthy
+
+  ovis-backend-database-mongodb:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-backend-mongodb:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-mongo
+    volumes:
+      - /var/cache/bridgehead/ccp/ovis-mongodb:/data/db
+
+  ovis-backend-mongodb-data-preprocessing:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-backend-preprocessor:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-preprocessing
+    environment:
+      ADDRESS: mongodb://ovis-backend-database-mongodb:27017
+    depends_on:
+      - ovis-backend-database-mongodb
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:9000/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 6
+      start_period: 5s
+
+  ovis-backend-data-import:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-backend-data-import:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-import
+    depends_on:
+      ovis-backend-mongodb-data-preprocessing:
+        condition: service_healthy
+    environment:
+      FHIR_SERVER_URL: http://bridgehead-ccp-blaze:8080/fhir
+
+  ovis-backend-apollo:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-backend-apollo:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-backend
+    environment:
+      ADDRESS: mongodb://ovis-backend-database-mongodb:27017
+      OVIS_SUPERADMIN_EMAILS: ${OVIS_SUPERADMIN_EMAILS:-}
+    depends_on:
+      - ovis-backend-database-mongodb
+      - ovis-backend-mongodb-data-preprocessing
+      - ovis-backend-data-import
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "-X", "POST", "-H", "content-type: application/json", "-d", "{\"query\":\"{__typename}\"}", "http://localhost:4001/graphql"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    # Internal only - no direct Traefik exposure. GraphQL is accessed via frontend internal proxy.
+
+  ovis-frontend:
+    image: docker.verbis.dkfz.de/cache/samply/ovis-frontend:${OVIS_TAG}
+    container_name: bridgehead-ccp-ovis-frontend
+    environment:
+      ORIGIN: https://${HOST}
+    depends_on:
+      ovis-backend-apollo:
+        condition: service_healthy
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.regex=^https?://([^/]+)/ccp-ovis$"
+      - "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.replacement=https://$${1}/ccp-ovis/"
+      - "traefik.http.middlewares.ovis-frontend-ccp-slash-redirect.redirectregex.permanent=true"
+      - "traefik.http.routers.ovis-frontend-ccp.tls=true"
+      - "traefik.http.routers.ovis-frontend-ccp.rule=PathPrefix(`/ccp-ovis`)"
+      - "traefik.http.routers.ovis-frontend-ccp.middlewares=traefik-forward-auth-ovis,ovis-frontend-ccp-slash-redirect"
+      - "traefik.http.services.ovis-frontend-ccp.loadbalancer.server.port=5173"
diff --git a/ccp/modules/ovis-setup.sh b/ccp/modules/ovis-setup.sh
new file mode 100644
index 0000000..07e1b22
--- /dev/null
+++ b/ccp/modules/ovis-setup.sh
@@ -0,0 +1,12 @@
+#!/bin/bash -e
+
+if [ "$ENABLE_OVIS" == true ]; then
+  log INFO "OVIS setup detected -- will start OVIS services with local oauth2-proxy middleware."
+  OVERRIDE+=" -f ./$PROJECT/modules/ovis-compose.yml"
+  add_private_oidc_redirect_url "/oauth2-ovis/callback"
+  add_private_oidc_redirect_url "/ccp-ovis*"
+  OVIS_AUTH_COOKIE_SECRET="$(generate_simple_password 'ovisCookieSecret' | head -c 16)"
+  if [ -z "$OVIS_SUPERADMIN_EMAILS" ]; then
+    log WARN "OVIS is enabled but OVIS_SUPERADMIN_EMAILS is not set -- nobody will be able to administrate OVIS."
+  fi
+fi
diff --git a/versions/acceptance b/versions/acceptance
index 648e371..aa9f5d7 100644
--- a/versions/acceptance
+++ b/versions/acceptance
@@ -5,3 +5,4 @@ POSTGRES_TAG=15.13-alpine
 TEILER_DASHBOARD_TAG=develop
 MTBA_TAG=develop
 DATA_QUALITY_AGENT_TAG=latest
+OVIS_TAG=main
diff --git a/versions/prod b/versions/prod
index a336e12..7026c65 100644
--- a/versions/prod
+++ b/versions/prod
@@ -5,3 +5,4 @@ POSTGRES_TAG=15.13-alpine
 TEILER_DASHBOARD_TAG=main
 MTBA_TAG=main
 DATA_QUALITY_AGENT_TAG=0.1
+OVIS_TAG=main
diff --git a/versions/test b/versions/test
index 648e371..aa9f5d7 100644
--- a/versions/test
+++ b/versions/test
@@ -5,3 +5,4 @@ POSTGRES_TAG=15.13-alpine
 TEILER_DASHBOARD_TAG=develop
 MTBA_TAG=develop
 DATA_QUALITY_AGENT_TAG=latest
+OVIS_TAG=main