diff --git a/deploy/setup-broker-tls.sh b/deploy/setup-broker-tls.sh
index 40c745a..be84028 100755
--- a/deploy/setup-broker-tls.sh
+++ b/deploy/setup-broker-tls.sh
@@ -15,6 +15,12 @@ HOST="${BROKER_HOST:-broker.pilotprotocol.network}"
 EMAIL="${CERT_EMAIL:-apps@pilotprotocol.network}"
 ORIGIN="${BROKER_ORIGIN:-http://127.0.0.1:8099}"
 LIVE="/etc/letsencrypt/live/$HOST"
+# Extra nginx location blocks injected before `location /` — verbatim nginx
+# config for sidecar brokers that live behind the same vhost (e.g. a signup
+# broker on another port). Supplied by startup.sh from the `broker-extra-locations`
+# instance-metadata key so a regenerated broker.conf keeps those routes instead of
+# silently dropping them. Empty ⇒ just the default `location /`.
+EXTRA_LOCATIONS="${BROKER_EXTRA_LOCATIONS:-}"
 
 echo "→ installing nginx + certbot"
 export DEBIAN_FRONTEND=noninteractive
@@ -64,6 +70,20 @@ server {
     }
 }
 NGINX
+  # Inject any sidecar location blocks BEFORE `location /` (literal — the value
+  # carries nginx vars like $host/$remote_addr that bash must not expand).
+  if [ -n "$EXTRA_LOCATIONS" ]; then
+    EXTRA_LOCATIONS="$EXTRA_LOCATIONS" python3 - <<'PY'
+import os
+p = "/etc/nginx/sites-available/broker.conf"
+extra = os.environ["EXTRA_LOCATIONS"].strip("\n")
+s = open(p).read()
+if extra and extra not in s:
+    s = s.replace("    location / {", extra + "\n\n    location / {", 1)
+    open(p, "w").write(s)
+    print("  → injected broker-extra-locations")
+PY
+  fi
   ln -sf /etc/nginx/sites-available/broker.conf /etc/nginx/sites-enabled/broker.conf
   # Remove nginx's default site — it binds :80, which publish-server owns, so
   # nginx would fail to start. The broker vhost is :443-only.
diff --git a/deploy/startup.sh b/deploy/startup.sh
index f1d5a56..c0b6954 100755
--- a/deploy/startup.sh
+++ b/deploy/startup.sh
@@ -54,6 +54,8 @@ sudo -u pilot HOME=/opt/pilot bash -c '
   cd app-template
   go build -o /opt/pilot/publish-server ./cmd/publish-server
   go build -o /opt/pilot/broker         ./cmd/broker
+  # Sidecar signup broker (installed below only when its metadata env is set).
+  go build -o /opt/pilot/insforge-signup-broker ./cmd/insforge-signup-broker || true
 '
 install -d -o pilot -g pilot /opt/pilot/registry   # shared: publish-server writes apps.json, broker reads it
 
@@ -127,6 +129,37 @@ RestartSec=3
 WantedBy=multi-user.target
 UNIT
 
+# Sidecar: the InsForge signup broker (provisions a per-user InsForge project via
+# one managed master account). Installed ONLY when the `insforge-signup-env`
+# metadata key is set (a newline-separated INSFORGE_SIGNUP_* KEY=VALUE block,
+# incl. the master refresh token + at-rest enc key), so this is a no-op on VMs
+# that don't run it. Its nginx route is added by setup-broker-tls.sh from
+# `broker-extra-locations`, so a regenerated broker.conf keeps it.
+INSFORGE_SIGNUP_ENV="$(meta insforge-signup-env)"
+if [ -n "$INSFORGE_SIGNUP_ENV" ] && [ -f /opt/pilot/insforge-signup-broker ]; then
+  install -o root -g root -m 0755 /opt/pilot/insforge-signup-broker /usr/local/bin/insforge-signup-broker
+  printf '%s\n' "$INSFORGE_SIGNUP_ENV" >/etc/insforge-signup-broker.env
+  chown root:root /etc/insforge-signup-broker.env && chmod 600 /etc/insforge-signup-broker.env
+  install -d /var/lib/insforge-signup
+  cat >/etc/systemd/system/insforge-signup-broker.service <<'UNIT'
+[Unit]
+Description=InsForge signup broker (provisions a per-user InsForge project)
+After=network-online.target
+[Service]
+EnvironmentFile=/etc/insforge-signup-broker.env
+ExecStart=/usr/local/bin/insforge-signup-broker
+Restart=always
+RestartSec=2
+NoNewPrivileges=true
+[Install]
+WantedBy=multi-user.target
+UNIT
+  systemctl daemon-reload
+  systemctl enable insforge-signup-broker
+  systemctl restart insforge-signup-broker
+  echo "insforge-signup-broker (re)started"
+fi
+
 systemctl daemon-reload
 systemctl enable pilot-publish pilot-broker
 # RESTART (not just enable --now): on a reboot/reset systemd auto-starts the
@@ -141,5 +174,6 @@ echo "pilot-publish + pilot-broker (re)started on freshly built binaries"
 # resolve to this VM yet, it logs and leaves publish/broker untouched.
 BROKER_HOST="$(meta broker-host)"; BROKER_HOST="${BROKER_HOST:-broker.pilotprotocol.network}"
 CERT_EMAIL="$(meta mail-from)"; CERT_EMAIL="${CERT_EMAIL:-apps@pilotprotocol.network}"
+BROKER_EXTRA_LOCATIONS="$(meta broker-extra-locations)" \
 BROKER_HOST="$BROKER_HOST" CERT_EMAIL="$CERT_EMAIL" \
   bash /opt/pilot/app-template/deploy/setup-broker-tls.sh || true