diff --git a/.gitignore b/.gitignore
index 4ef2785..bb25190 100644
--- a/.gitignore
+++ b/.gitignore
@@ -39,4 +39,5 @@ Cargo.lock.bak*
 .DS_Store
 Thumbs.db
 compose.env
+compose.testnet.env
 docker-compose.override.yml
diff --git a/compose.testnet.env.example b/compose.testnet.env.example
new file mode 100644
index 0000000..51d5f6f
--- /dev/null
+++ b/compose.testnet.env.example
@@ -0,0 +1,40 @@
+# indexer-rs dual-run config TEMPLATE — testnet, on the build/deploy host.
+# Copy to `compose.testnet.env` (gitignored) and fill in real values.
+#
+# Used together with:
+#   docker compose -f docker-compose.yml -f docker-compose.testnet.yml \
+#                  --env-file compose.testnet.env \
+#                  --project-name indexer-rs-testnet \
+#                  up -d
+#
+# Postgres on :5437 (avoids :5432 used by TS indexer's pg and :5436
+# used by the mainnet indexer-rs override). API on :8089.
+#
+# GRPC_URL — keep this as the local loopback URL on the same host as
+# the testnet fullnode-1 gRPC server. The public Cloudflare-proxied
+# `grpc-testnet.sentrixchain.com` URL gets its long-running tail
+# subscription reset every ~130s by Cloudflare's HTTP/2 stream
+# timeout; loopback bypasses Cloudflare entirely.
+# Verified 2026-05-26: 0 h2 errors after switch, was 4-5/min before.
+
+DATABASE_URL=postgres://indexer:CHANGE_ME@127.0.0.1:5437/indexer
+
+RPC_URL=http://127.0.0.1:9545/rpc
+REST_URL=http://127.0.0.1:9545
+INDEXER_NETWORK=testnet
+INDEXER_BACKFILL_LOOP_SECS=5
+INDEXER_BACKFILL_CONCURRENCY=100
+INDEXER_BACKFILL_BATCH=100
+
+# Local loopback — testnet fullnode-1's gRPC bind. Caddy reverse-proxies
+# the public `grpc-testnet.sentrixchain.com` to this same port for
+# external dApps; same-host services skip the proxy hop.
+GRPC_URL=http://127.0.0.1:50055
+
+INDEXER_API_BIND=127.0.0.1:8089
+INDEXER_API_METRICS_BIND=127.0.0.1:9081
+
+RUST_LOG=indexer=debug,indexer_sync=debug,sqlx=warn,hyper=warn,tower_http=info
+POSTGRES_PASSWORD=CHANGE_ME
+POSTGRES_USER=indexer
+POSTGRES_DB=indexer
diff --git a/docker-compose.testnet.yml b/docker-compose.testnet.yml
new file mode 100644
index 0000000..f7a662f
--- /dev/null
+++ b/docker-compose.testnet.yml
@@ -0,0 +1,39 @@
+# Testnet override for indexer-rs.
+#
+# Usage:
+#   docker compose -f docker-compose.yml -f docker-compose.testnet.yml \
+#                  --env-file compose.testnet.env \
+#                  --project-name indexer-rs-testnet \
+#                  up -d
+#
+# Postgres on :5437 (avoids :5432 used by TS indexer's pg, and :5436
+# used by the mainnet indexer-rs override). API on :8089 (avoids :8080
+# from mainnet override + code-server on :8080).
+#
+# Restored 2026-05-26 after the gRPC tail reconnect-loop incident.
+# Original file was deleted at some point during the 2026-05-22 testnet
+# stack reshuffles; the running testnet container was orphaned from its
+# compose context until this restore. compose.testnet.env carries the
+# canonical GRPC_URL fix (`http://127.0.0.1:50055` instead of the public
+# Cloudflare-proxied URL — see that file for the why).
+
+services:
+  postgres:
+    ports: !override
+      - "127.0.0.1:5437:5432"
+
+  indexer:
+    image: indexer-rs:erc20-handler
+    # network_mode: host so 127.0.0.1:50055 (testnet fullnode-1 gRPC)
+    # resolves to the host's loopback instead of the container's own.
+    # Same reason GRPC_URL is the local URL in compose.testnet.env.
+    network_mode: host
+    env_file:
+      - ./compose.testnet.env
+
+  api:
+    image: indexer-rs:erc20-handler
+    ports: !override
+      - "127.0.0.1:8089:8080"
+    env_file:
+      - ./compose.testnet.env