diff --git a/butane/cisa_kev_rss.yaml b/butane/cisa_kev_rss.yaml
new file mode 100644
index 0000000..98b21cd
--- /dev/null
+++ b/butane/cisa_kev_rss.yaml
@@ -0,0 +1,52 @@
+variant: flatcar
+version: 1.0.0
+
+# CISA KEV RSS feed. Turns the CISA Known Exploited Vulnerabilities catalog
+# into an RSS 2.0 feed (https://github.com/xsaveopt/cisa-kev-rss).
+#
+# Feed:  http://192.168.7.64:3000/rss
+# Health: http://192.168.7.64:3000/health
+#
+# Stateless: the container refreshes from CISA every ten minutes and keeps
+# nothing on disk, so it is safe to rebuild at any time.
+
+systemd:
+  units:
+    - name: cisa-kev-rss.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=CISA KEV RSS feed
+        After=docker.service
+        Requires=docker.service
+        [Service]
+        TimeoutStartSec=0
+        ExecStartPre=/usr/bin/docker pull ghcr.io/xsaveopt/cisa-kev-rss:latest
+        ExecStartPre=-/usr/bin/docker rm --force cisa-kev-rss
+        ExecStart=/usr/bin/docker run --rm --name cisa-kev-rss \
+          -p 3000:3000 \
+          ghcr.io/xsaveopt/cisa-kev-rss:latest
+        ExecStop=/usr/bin/docker stop cisa-kev-rss
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target
+    - name: dozzle-agent.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Dozzle Agent
+        After=docker.service
+        Requires=docker.service
+        [Service]
+        TimeoutStartSec=0
+        ExecStartPre=-/usr/bin/docker rm --force dozzle-agent
+        ExecStart=/usr/bin/docker run --name dozzle-agent \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -p 7007:7007 \
+          amir20/dozzle:v11.1.1 agent
+        ExecStop=/usr/bin/docker stop dozzle-agent
+        Restart=always
+        RestartSec=5s
+        [Install]
+        WantedBy=multi-user.target
diff --git a/butane/monitor.yaml b/butane/monitor.yaml
index 0734782..397904a 100644
--- a/butane/monitor.yaml
+++ b/butane/monitor.yaml
@@ -40,7 +40,7 @@ systemd:
         # container does. docker run forwards them by bare name below.
         Environment="DOZZLE_HOSTNAME=Oswald Logs"
         Environment="DOZZLE_ENABLE_MCP=true"
-        Environment="DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Goose,192.168.7.61:7007|ai|Goose,192.168.7.62:7007|oswl-connector|Goose"
+        Environment="DOZZLE_REMOTE_AGENT=192.168.7.60:7007|oswald-runner|Goose,192.168.7.61:7007|ai|Goose,192.168.7.62:7007|oswl-connector|Goose,192.168.7.64:7007|cisa-kev-rss|Goose"
         # Pulled up front so a slow first pull is not mistaken for a hung unit.
         ExecStartPre=/usr/bin/docker pull amir20/dozzle:v11.1.1
         # Leading "-" so a missing container is not a failure.
diff --git a/terraform.tfvars b/terraform.tfvars
index d58f2d7..627b4b1 100644
--- a/terraform.tfvars
+++ b/terraform.tfvars
@@ -251,6 +251,19 @@ nodes = {
         qemu_guest_agent = false
         butane_file      = "butane/monitor.yaml"
       }
+      # CISA Known Exploited Vulnerabilities catalog as an RSS feed.
+      # Stateless container; feed at :3000/rss.
+      "cisa-kev-rss" = {
+        hostname         = "cisa-kev-rss"
+        vmid             = 214
+        ip               = "192.168.7.64"
+        vlan             = 7
+        memory           = 1024
+        cores            = 1
+        disk_size        = 16
+        qemu_guest_agent = false
+        butane_file      = "butane/cisa_kev_rss.yaml"
+      }
     }
     machines = {
       "grist" = {