diff --git a/tenants/plataforma/26-downloads.yaml b/tenants/plataforma/26-downloads.yaml
new file mode 100644
index 0000000..7c3ae96
--- /dev/null
+++ b/tenants/plataforma/26-downloads.yaml
@@ -0,0 +1,100 @@
+# Downloads dos apps (06/10/2026): https://plataforma.athleticmap.com/downloads/<versao>/<arquivo>
+# O portal (/portal dos tenants) aponta para ca. Os arquivos NAO estao no Git (dezenas de MB): moram no volume
+# `downloads-app` e sao copiados a mao, com o SHA256SUMS conferido (ver pendencias/2026-10-06.md, "Downloads").
+# Tudo sai como anexo, com nosniff; .apk com o tipo do Android, para o celular oferecer a instalacao.
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: downloads-app
+  namespace: plataforma-prod
+spec:
+  accessModes: [ReadWriteOnce]
+  resources: { requests: { storage: 2Gi } }
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: downloads-app-nginx
+  namespace: plataforma-prod
+data:
+  default.conf: |
+    server {
+      listen 8080;
+      server_tokens off;
+      root /srv;
+      autoindex off;
+      types {
+        application/vnd.android.package-archive apk;
+        application/octet-stream exe msi dmg AppImage deb rpm;
+        text/plain txt;
+      }
+      default_type text/plain;
+      location = /saude { access_log off; return 200 "ok\n"; }
+      location /downloads/ {
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Content-Disposition "attachment" always;
+        add_header Cache-Control "public, max-age=300" always;
+        try_files $uri =404;
+      }
+      location / { return 404; }
+    }
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: downloads-app
+  namespace: plataforma-prod
+  labels: { app: downloads-app }
+spec:
+  replicas: 1
+  strategy: { type: Recreate }
+  selector: { matchLabels: { app: downloads-app } }
+  template:
+    metadata:
+      labels: { app: downloads-app }
+    spec:
+      containers:
+        - name: nginx
+          image: docker.io/library/nginx:alpine
+          imagePullPolicy: IfNotPresent
+          ports: [{ containerPort: 8080 }]
+          resources:
+            requests: { cpu: 10m, memory: 16Mi }
+            limits: { cpu: 200m, memory: 64Mi }
+          readinessProbe: { httpGet: { path: /saude, port: 8080 }, periodSeconds: 10 }
+          volumeMounts:
+            - { name: conf, mountPath: /etc/nginx/conf.d }
+            - { name: arquivos, mountPath: /srv/downloads }
+      volumes:
+        - name: conf
+          configMap: { name: downloads-app-nginx }
+        - name: arquivos
+          persistentVolumeClaim: { claimName: downloads-app }
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: downloads-app
+  namespace: plataforma-prod
+spec:
+  selector: { app: downloads-app }
+  ports: [{ name: http, port: 80, targetPort: 8080 }]
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: plataforma-downloads
+  namespace: plataforma-prod
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: plataforma-prod-redirect-https@kubernetescrd
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts: [plataforma.athleticmap.com]
+      secretName: plataforma-tls
+  rules:
+    - host: plataforma.athleticmap.com
+      http:
+        paths:
+          - { path: /downloads, pathType: Prefix, backend: { service: { name: downloads-app, port: { number: 80 } } } }