diff --git a/life-church/playbooks/thinkcenter-helvum.yml b/life-church/playbooks/thinkcenter-helvum.yml
new file mode 100644
index 0000000..02fe99e
--- /dev/null
+++ b/life-church/playbooks/thinkcenter-helvum.yml
@@ -0,0 +1,114 @@
+---
+# ============================================================================
+# life-church/playbooks/thinkcenter-helvum.yml
+# Install Helvum (GTK PipeWire patchbay) on thinkcenter via apt.
+# thinkcenter ONLY. Idempotent. Native package (no flatpak).
+# become password from Infisical /lc-hosts at runtime.
+#
+# Helvum is a lightweight visual patchbay for PipeWire — complements qpwgraph
+# (installed by thinkcenter-audio). Requires a running PipeWire, which the
+# audio playbook provides.
+#
+# UNDO:  sudo apt remove --purge helvum
+# ============================================================================
+
+# --- Play 1 (localhost): fetch thinkcenter sudo pass from Infisical ----------
+- name: "thinkcenter Helvum — resolve become password from Infisical"
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: "[resolve] Infisical creds from env"
+      ansible.builtin.set_fact:
+        infisical_client_id: "{{ lookup('env','INFISICAL_CLIENT_ID') }}"
+        infisical_client_secret: "{{ lookup('env','INFISICAL_CLIENT_SECRET') }}"
+        infisical_project_id: "{{ lookup('env','INFISICAL_PROJECT_ID') }}"
+        infisical_url: "{{ lookup('env','INFISICAL_API_URL') | default('http://192.168.122.41:8080', true) }}"
+        infisical_env_slug: "{{ lookup('env','INFISICAL_ENV_SLUG') | default('prod', true) }}"
+
+    - name: "[resolve] Assert Infisical creds present"
+      ansible.builtin.assert:
+        that:
+          - infisical_client_id | length > 0
+          - infisical_client_secret | length > 0
+          - infisical_project_id | length > 0
+        fail_msg: "Infisical creds missing from Semaphore environment 'infisical-dev'."
+
+    - name: "[infisical] Log in"
+      infisical.vault.login:
+        url: "{{ infisical_url }}"
+        auth_method: universal_auth
+        universal_auth_client_id: "{{ infisical_client_id }}"
+        universal_auth_client_secret: "{{ infisical_client_secret }}"
+      register: infisical_login
+      no_log: true
+
+    - name: "[infisical] Read /lc-hosts"
+      infisical.vault.read_secrets:
+        login_data: "{{ infisical_login.login_data }}"
+        project_id: "{{ infisical_project_id }}"
+        env_slug: "{{ infisical_env_slug }}"
+        path: "/lc-hosts"
+        as_dict: true
+      register: lc_secrets
+      no_log: true
+
+    - name: "[set] Stash thinkcenter sudo pass"
+      ansible.builtin.set_fact:
+        thinkcenter_become_pass: "{{ lc_secrets.secrets['THINKCENTER_SUDO_PASS'] }}"
+      no_log: true
+
+# --- Play 2: Helvum on thinkcenter ONLY --------------------------------------
+- name: "Install Helvum on thinkcenter"
+  hosts: thinkcenter
+  gather_facts: true
+  become: true
+  vars:
+    ansible_become_pass: "{{ hostvars['localhost'].thinkcenter_become_pass }}"
+  tasks:
+    - name: "[safety] Confirm we are on thinkcenter"
+      ansible.builtin.assert:
+        that: inventory_hostname == 'thinkcenter'
+        fail_msg: "Refusing to run — this play is scoped to thinkcenter only."
+
+    - name: "[safety] Confirm Ubuntu-family host"
+      ansible.builtin.assert:
+        that: ansible_facts.os_family == 'Debian'
+        fail_msg: "This playbook targets Debian/Ubuntu (Mint). Host is {{ ansible_facts.os_family }}."
+
+    - name: "[apt] Update cache (retry on transient failure)"
+      ansible.builtin.apt:
+        update_cache: true
+        cache_valid_time: 3600
+      register: apt_cache
+      until: apt_cache is succeeded
+      retries: 3
+      delay: 15
+
+    - name: "[apt] Install Helvum (retry on dpkg lock)"
+      ansible.builtin.apt:
+        name: helvum
+        state: present
+      register: helvum_install
+      until: helvum_install is succeeded
+      retries: 3
+      delay: 15
+
+    - name: "[verify] helvum binary present"
+      ansible.builtin.command: which helvum
+      register: helvum_which
+      changed_when: false
+      failed_when: false
+
+    - name: "[verify] Assert Helvum installed"
+      ansible.builtin.assert:
+        that: helvum_which.rc == 0
+        fail_msg: "Helvum binary not found after install."
+        success_msg: "Helvum installed at {{ helvum_which.stdout | trim }}."
+
+    - name: "[report] Helvum summary"
+      ansible.builtin.debug:
+        msg:
+          - "===== thinkcenter Helvum ====="
+          - "packages changed this run : {{ helvum_install.changed }}"
+          - "helvum path               : {{ helvum_which.stdout | default('n/a') | trim }}"
+          - "NOTE: Helvum needs a running PipeWire session (see thinkcenter-audio). Launch from the app menu."