diff --git a/manifests/core/kustomization.yaml b/manifests/core/kustomization.yaml
index 67f0244..7817aee 100644
--- a/manifests/core/kustomization.yaml
+++ b/manifests/core/kustomization.yaml
@@ -12,6 +12,7 @@ resources:
   - core-config.yaml
   - worker-script.yaml
   - workers.yaml
+  - worker-notifications.yaml
   - worker-pdb.yaml
   - ingress-unified.yaml
   # traefik-middlewares.yaml intentionally excluded - this cluster's
diff --git a/manifests/core/worker-notifications.yaml b/manifests/core/worker-notifications.yaml
new file mode 100644
index 0000000..401e6b6
--- /dev/null
+++ b/manifests/core/worker-notifications.yaml
@@ -0,0 +1,122 @@
+# Reconstructed manifest - this StatefulSet was originally deployed
+# manually outside of git, and was lost when the core namespace got
+# recreated during the Flux removal incident on 2026-07-20. Rebuilt from
+# its confirmed runtime config (NATS_STREAM/NATS_CONSUMER/FILTER_SUBJECT
+# seen in its own logs) plus the same pattern as its sibling workers.
+# Resource requests/limits and WORKER_CONCURRENCY are best-guess matches
+# to the lightest sibling worker (worker-rider-logs) - adjust if the
+# original values are known.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: worker-notifications
+  namespace: core
+  labels:
+    app.kubernetes.io/name: worker-notifications
+    app.kubernetes.io/component: worker
+spec:
+  serviceName: "worker-notifications"
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: worker-notifications
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: worker-notifications
+        app.kubernetes.io/component: worker
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "9090"
+        prometheus.io/path: "/metrics"
+    spec:
+      terminationGracePeriodSeconds: 45
+      tolerations:
+      - key: dedicated
+        operator: Equal
+        value: workers
+        effect: NoSchedule
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: node-role.workolik/worker
+                operator: In
+                values:
+                - "true"
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+          - weight: 100
+            podAffinityTerm:
+              labelSelector:
+                matchExpressions:
+                - key: app.kubernetes.io/name
+                  operator: In
+                  values:
+                  - worker-notifications
+              topologyKey: kubernetes.io/hostname
+      topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: ScheduleAnyway
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: worker-notifications
+      containers:
+      - name: worker
+        image: workolik360/nats-worker:v1.1.0
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+        command: ["python3", "-u", "/scripts/worker.py"]
+        volumeMounts:
+        - name: worker-script-vol
+          mountPath: /scripts
+        envFrom:
+        - configMapRef:
+            name: core-config
+        env:
+        - name: NATS_STREAM
+          value: "NOTIFICATIONS"
+        - name: NATS_CONSUMER
+          value: "notifications-worker"
+        - name: FILTER_SUBJECT
+          value: "api.v1.notifications.push"
+        - name: WORKER_CONCURRENCY
+          value: "10"
+        - name: NATS_USER
+          valueFrom:
+            secretKeyRef:
+              name: nats-credentials
+              key: username
+        - name: NATS_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: nats-credentials
+              key: password
+        - name: EXTERNAL_ENDPOINT_API_KEY
+          valueFrom:
+            secretKeyRef:
+              name: external-endpoint-secrets
+              key: api_key
+              optional: true
+        - name: EXTERNAL_BASE_URL
+          value: "http://10.43.224.63"
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "40m"
+          limits:
+            memory: "128Mi"
+            cpu: "200m"
+        ports:
+        - containerPort: 9090
+          name: metrics
+      volumes:
+      - name: worker-script-vol
+        configMap:
+          name: worker-script