diff --git a/core/installer/tasks/infra.go b/core/installer/tasks/infra.go
index 543cc67..987ff9c 100644
--- a/core/installer/tasks/infra.go
+++ b/core/installer/tasks/infra.go
@@ -48,6 +48,7 @@
 		SetupHeadscale(env, startIP, st),
 		SetupWelcome(env, st),
 		SetupAppStore(env, st),
+		SetupLauncher(env, st),
 	)
 }
 
@@ -422,6 +423,37 @@
 	return &t
 }
 
+func SetupLauncher(env Env, st *state) Task {
+	t := newLeafTask("Application Launcher", func() error {
+		user := fmt.Sprintf("%s-launcher", env.Name)
+		keys, err := installer.NewSSHKeyPair(user)
+		if err != nil {
+			return err
+		}
+		if err := st.ssClient.AddUser(user, keys.AuthorizedKey()); err != nil {
+			return err
+		}
+		if err := st.ssClient.AddReadWriteCollaborator("config", user); err != nil { //TODO(gio): add read only
+			return err
+		}
+		app, err := installer.FindEnvApp(st.appsRepo, "launcher") // TODO(giolekva): configure
+		if err != nil {
+			return err
+		}
+		instanceId := app.Name()
+		appDir := fmt.Sprintf("/apps/%s", instanceId)
+		namespace := fmt.Sprintf("%s%s", env.NamespacePrefix, app.Namespace())
+		if err := st.appManager.Install(app, instanceId, appDir, namespace, map[string]any{
+			"repoAddr":      st.ssClient.GetRepoAddress("config"),
+			"sshPrivateKey": string(keys.RawPrivateKey()),
+		}); err != nil {
+			return err
+		}
+		return nil
+	})
+	return &t
+}
+
 type DNSSecKey struct {
 	Basename string `json:"basename,omitempty"`
 	Key      []byte `json:"key,omitempty"`