diff --git a/Dockerfile b/Dockerfile
index 0fd7ec9..6526cf1 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,3 +32,29 @@ COPY alembic.ini ./
 # Default command is the web app; scheduler container overrides via `command:`.
 EXPOSE 8000
 CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000", "--workers", "1"]
+
+
+# ---------------------------------------------------------------------------
+# Test stage — same Python, same prod deps, plus dev extras (pytest +
+# aiosqlite). Built and run only via docker-compose.test.yml; never shipped.
+# ---------------------------------------------------------------------------
+FROM python:3.13-slim AS test
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PATH="/opt/venv/bin:$PATH" \
+    TZ=UTC \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    PIP_NO_CACHE_DIR=1
+
+COPY --from=builder /opt/venv /opt/venv
+WORKDIR /app
+COPY pyproject.toml ./
+COPY app ./app
+COPY alembic ./alembic
+COPY alembic.ini ./
+COPY tests ./tests
+
+RUN /opt/venv/bin/pip install ".[dev]"
+
+CMD ["pytest", "tests/", "-v"]
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
new file mode 100644
index 0000000..219930c
--- /dev/null
+++ b/docker-compose.test.yml
@@ -0,0 +1,46 @@
+# Ad-hoc test runner.
+#
+# STANDALONE — do not combine with docker-compose.yml. The `name:` field
+# below puts the test container in its own Compose project (`cassandra-test`)
+# so it CANNOT collide with the live prod stack on this host (containers,
+# networks, volumes are all namespaced by project).
+#
+# Usage:
+#   # Run the full suite:
+#   docker compose -f docker-compose.test.yml run --rm test
+#
+#   # Run a specific file or test:
+#   docker compose -f docker-compose.test.yml run --rm test pytest tests/test_email_digest_job.py -v
+#   docker compose -f docker-compose.test.yml run --rm test pytest -k unsubscribe
+#
+#   # Open a shell in the test image (e.g. to poke around with pytest --pdb):
+#   docker compose -f docker-compose.test.yml run --rm test bash
+#
+#   # Rebuild after a pyproject.toml change:
+#   docker compose -f docker-compose.test.yml build test
+#
+# Tests use an in-memory aiosqlite DB (see tests/conftest.py), so there is
+# no MariaDB / Redis dependency and nothing touches the prod database.
+
+name: cassandra-test
+
+services:
+  test:
+    build:
+      context: .
+      target: test
+    # Same volume mounts as the dev override — edits on the host take effect
+    # on the next `run` without rebuilding the image.
+    volumes:
+      - ./app:/app/app
+      - ./tests:/app/tests
+      - ./alembic:/app/alembic
+      - ./alembic.ini:/app/alembic.ini:ro
+      - ./config:/app/config:ro
+      - ./pyproject.toml:/app/pyproject.toml:ro
+    environment:
+      # Sentinels so app.config can be imported without a real .env / DB.
+      # tests/conftest.py also sets these defensively.
+      DATABASE_URL: "sqlite+aiosqlite:///:memory:"
+      CASSANDRA_MOCK: "1"
+      PYTHONDONTWRITEBYTECODE: "1"
diff --git a/pyproject.toml b/pyproject.toml
index 7c058ad..cfa65d6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -30,6 +30,7 @@ dev = [
     "pytest>=8.3",
     "pytest-asyncio>=0.24",
     "pytest-httpx>=0.34",
+    "aiosqlite>=0.20",
     "ruff>=0.7",
 ]