diff --git a/README.md b/README.md
index 27440196e..27ba149fc 100644
--- a/README.md
+++ b/README.md
@@ -93,6 +93,25 @@ After the first deploy is done, any subsequent steps won't need to do that initi
 bin/kamal deploy
 ```
 
+## File storage (Active Storage)
+
+Production uses the local disk service by default. To use any other service defined in `config/storage.yml`, set `ACTIVE_STORAGE_SERVICE`.
+
+To use the included `s3` service, set:
+
+- `ACTIVE_STORAGE_SERVICE=s3`
+- `S3_ACCESS_KEY_ID`
+- `S3_BUCKET` (defaults to `fizzy-#{Rails.env}-activestorage`)
+- `S3_REGION` (defaults to `us-east-1`)
+- `S3_SECRET_ACCESS_KEY`
+
+Optional for S3-compatible endpoints:
+
+- `S3_ENDPOINT`
+- `S3_FORCE_PATH_STYLE=true`
+- `S3_REQUEST_CHECKSUM_CALCULATION` (defaults to `when_supported`)
+- `S3_RESPONSE_CHECKSUM_VALIDATION` (defaults to `when_supported`)
+
 ## Development
 
 ### Setting up
diff --git a/config/environments/production.rb b/config/environments/production.rb
index 3c676693f..6398d14d0 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -42,6 +42,12 @@ Rails.application.configure do
     "Cache-Control" => "public, max-age=#{1.year.to_i}"
   }
 
+  # Select Active Storage service via env var; default to local disk.
+  # Don't overwrite if it's already been set (e.g. by fizzy-saas)
+  if config.active_storage.service.blank?
+    config.active_storage.service = ENV.fetch("ACTIVE_STORAGE_SERVICE", "local").to_sym
+  end
+
   # Enable serving of images, stylesheets, and JavaScripts from an asset server.
   # config.asset_host = "http://assets.example.com"
 
diff --git a/config/storage.oss.yml b/config/storage.oss.yml
index e50debd34..37052e6c5 100644
--- a/config/storage.oss.yml
+++ b/config/storage.oss.yml
@@ -16,3 +16,14 @@ devminio:
   region: us-east-1 # default region required for signer
   access_key_id: minioadmin
   secret_access_key: minioadmin
+
+s3:
+  service: S3
+  access_key_id: <%= ENV["S3_ACCESS_KEY_ID"] %>
+  bucket: <%= ENV["S3_BUCKET"] || "fizzy-#{Rails.env}-activestorage" %>
+  endpoint: <%= ENV["S3_ENDPOINT"] %>
+  force_path_style: <%= ENV["S3_FORCE_PATH_STYLE"] == "true" %>
+  region: <%= ENV.fetch("S3_REGION", "us-east-1") %>
+  request_checksum_calculation: <%= ENV.fetch("S3_REQUEST_CHECKSUM_CALCULATION", "when_supported") %>
+  response_checksum_validation: <%= ENV.fetch("S3_RESPONSE_CHECKSUM_VALIDATION", "when_supported") %>
+  secret_access_key: <%= ENV["S3_SECRET_ACCESS_KEY"] %>