diff --git a/apps/npm/build/Dockerfile b/apps/npm/build/Dockerfile
new file mode 100644
index 0000000..dce4059
--- /dev/null
+++ b/apps/npm/build/Dockerfile
@@ -0,0 +1,19 @@
+# INTERIM image for npm:runtipi.
+#
+# Thin fork: upstream jc21/nginx-proxy-manager (Debian bookworm) with network
+# diagnostic tools baked in, so `docker exec npm_runtipi-npm-1 ping|nslookup|
+# dig|traceroute|...` works and SURVIVES container recreation on Runtipi
+# restart/update (an in-container `apt install` does not persist).
+#
+# Stop-gap while the from-source build of the Gitea fork
+# (git.alexzaw.dev/alexz/nginx-proxy-manager) is set up. NPM itself is
+# byte-for-byte upstream here — only diagnostic packages are added, the
+# s6 entrypoint/behaviour is untouched.
+FROM jc21/nginx-proxy-manager:2.13.5
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+      iputils-ping dnsutils traceroute mtr-tiny netcat-openbsd \
+      iproute2 net-tools tcpdump telnet whois nmap wget \
+ && apt-get clean \
+ && rm -rf /var/lib/apt/lists/*
diff --git a/apps/npm/build/README.md b/apps/npm/build/README.md
new file mode 100644
index 0000000..e54feb4
--- /dev/null
+++ b/apps/npm/build/README.md
@@ -0,0 +1,34 @@
+# NPM (Nginx Proxy Manager) — Runtipi app image
+
+This app runs a **fork** of NginxProxyManager tailored for Runtipi.
+
+## Current image: `:2.13.5-interim` (thin fork)
+
+`Dockerfile` here is a stop-gap: upstream `jc21/nginx-proxy-manager:2.13.5` plus
+network diagnostic tools (`ping`, `dig`/`nslookup`, `traceroute`, `mtr`, `nc`,
+`ss`, `netstat`, `tcpdump`, `whois`, `nmap`, `telnet`, `wget`) so they are
+available via `docker exec` and persist across Runtipi restarts/updates. NPM
+itself is unchanged.
+
+Build & push:
+
+    ./build.sh
+
+## Planned: from-source build (`:2.13.5` / `:latest`)
+
+The real fork lives at `git.alexzaw.dev/alexz/nginx-proxy-manager` (mirror of
+upstream NginxProxyManager). Runtipi tailoring (the net tools above, plus future
+custom network-management UI) goes on the `runtipi` branch off the `v2.13.5`
+tag.
+
+The from-source pipeline:
+
+1. `git clone` the fork into `~/projects/nginx-proxy-manager`, checkout `runtipi`.
+2. `scripts/frontend-build` — builds the Vue frontend into `frontend/dist`
+   (needs node/yarn; uses `NODE_OPTIONS=--openssl-legacy-provider`).
+3. `docker buildx build -f docker/Dockerfile` with
+   `BASE_IMAGE=nginxproxymanager/nginx-full:certbot-node` and the `BUILD_*`
+   args, tagging `git.alexzaw.dev/alexz/nginx-proxy-manager:2.13.5` + `:latest`.
+
+Once that builds clean, point `docker-compose.json` at `:2.13.5` and retire the
+interim image.
diff --git a/apps/npm/build/build.sh b/apps/npm/build/build.sh
new file mode 100644
index 0000000..4e109e8
--- /dev/null
+++ b/apps/npm/build/build.sh
@@ -0,0 +1,13 @@
+#!/bin/bash
+# Build & push the INTERIM net-tools NPM image (thin fork of upstream jc21).
+# The from-source build (see README) will later supersede this with :2.13.5.
+set -euo pipefail
+
+IMAGE_NAME="${IMAGE_NAME:-git.alexzaw.dev/alexz/nginx-proxy-manager}"
+IMAGE_TAG="${IMAGE_TAG:-2.13.5-interim}"
+
+cd "$(dirname "$0")"
+docker build "$@" -t "${IMAGE_NAME}:${IMAGE_TAG}" .
+docker push "${IMAGE_NAME}:${IMAGE_TAG}"
+
+echo "Pushed ${IMAGE_NAME}:${IMAGE_TAG}"
diff --git a/apps/npm/config.json b/apps/npm/config.json
index a2f1e11..f10ffa9 100644
--- a/apps/npm/config.json
+++ b/apps/npm/config.json
@@ -10,7 +10,7 @@
     "network"
   ],
   "description": "Nginx Proxy Manager enables you to easily forward to your websites running at home or otherwise, including free SSL, without having to know too much about Nginx or Letsencrypt.",
-  "tipi_version": 2,
+  "tipi_version": 3,
   "version": "2.13.5",
   "source": "https://github.com/NginxProxyManager/nginx-proxy-manager",
   "website": "https://nginxproxymanager.com",
diff --git a/apps/npm/docker-compose.json b/apps/npm/docker-compose.json
index 3dcce07..fdc0eb3 100644
--- a/apps/npm/docker-compose.json
+++ b/apps/npm/docker-compose.json
@@ -3,7 +3,7 @@
   "services": [
     {
       "name": "npm",
-      "image": "jc21/nginx-proxy-manager:2.13.5",
+      "image": "git.alexzaw.dev/alexz/nginx-proxy-manager:2.13.5-interim",
       "isMain": true,
       "internalPort": 81,
       "addPorts": [