diff --git a/plays/paperless-migration.yml b/plays/paperless-migration.yml
new file mode 100644
index 00000000..6c0b0ae9
--- /dev/null
+++ b/plays/paperless-migration.yml
@@ -0,0 +1,8 @@
+---
+- name: Migrate Paperless-ngx to new Docker Compose structure
+  hosts: paperless.srv.renner.uno
+  become: true
+  gather_facts: true
+
+  roles:
+    - paperless-migration
diff --git a/roles/paperless-migration/defaults/main.yml b/roles/paperless-migration/defaults/main.yml
new file mode 100644
index 00000000..28cb24fe
--- /dev/null
+++ b/roles/paperless-migration/defaults/main.yml
@@ -0,0 +1,8 @@
+---
+paperless_dir: /opt/paperless-ngx
+paperless_port: 8000
+paperless_time_zone: "Europe/Berlin"
+paperless_ocr_language: "deu+eng"
+paperless_secret_key: "rBDG[p>l]H#=f,1y_e1+zxb;)]wO^@&uX])_l|P>#tt3M~{phE95s6urw?jX+V0f"
+paperless_url: "https://docs.renner.uno"
+postgres_password: "paperless"
diff --git a/roles/paperless-migration/tasks/main.yml b/roles/paperless-migration/tasks/main.yml
new file mode 100644
index 00000000..f0ac0ba2
--- /dev/null
+++ b/roles/paperless-migration/tasks/main.yml
@@ -0,0 +1,37 @@
+---
+- name: Ensure paperless directory exists
+  file:
+    path: "{{ paperless_dir }}"
+    state: directory
+    mode: '0755'
+
+- name: Check for existing docker-compose.yml
+  stat:
+    path: "{{ paperless_dir }}/docker-compose.yml"
+  register: old_compose
+
+- name: Backup existing docker-compose.yml
+  copy:
+    src: "{{ paperless_dir }}/docker-compose.yml"
+    dest: "{{ paperless_dir }}/docker-compose.yml.bak.{{ ansible_date_time.iso8601 }}"
+    remote_src: yes
+  when: old_compose.stat.exists
+
+- name: Deploy docker-compose.yml
+  template:
+    src: docker-compose.yml.j2
+    dest: "{{ paperless_dir }}/docker-compose.yml"
+    mode: '0644'
+
+- name: Deploy docker-compose.env
+  template:
+    src: docker-compose.env.j2
+    dest: "{{ paperless_dir }}/docker-compose.env"
+    mode: '0644'
+
+- name: Pull and update Paperless-ngx
+  shell: |
+    docker compose pull
+    docker compose up -d --remove-orphans
+  args:
+    chdir: "{{ paperless_dir }}"
diff --git a/roles/paperless-migration/templates/docker-compose.env.j2 b/roles/paperless-migration/templates/docker-compose.env.j2
new file mode 100644
index 00000000..8391d5aa
--- /dev/null
+++ b/roles/paperless-migration/templates/docker-compose.env.j2
@@ -0,0 +1,13 @@
+PAPERLESS_URL={{ paperless_url }}
+USERMAP_UID=1001
+USERMAP_GID=1001
+PAPERLESS_TIME_ZONE={{ paperless_time_zone }}
+PAPERLESS_OCR_LANGUAGE={{ paperless_ocr_language }}
+PAPERLESS_OCR_ROTATE_PAGES=false
+PAPERLESS_OCR_COLOR_CONVERSION_STRATEGY=LeaveColorUnchanged
+PAPERLESS_SECRET_KEY={{ paperless_secret_key }}
+PAPERLESS_CONSUMER_RECURSIVE=true
+PAPERLESS_CONSUMER_DELETE_DUPLICATES=true
+PAPERLESS_CONSUMER_ENABLE_BARCODES=true
+PAPERLESS_CONSUMER_ENABLE_ASN_BARCODE=true
+PAPERLESS_CONSUMER_BARCODE_SCANNER=ZXING
diff --git a/roles/paperless-migration/templates/docker-compose.yml.j2 b/roles/paperless-migration/templates/docker-compose.yml.j2
new file mode 100644
index 00000000..e6f17287
--- /dev/null
+++ b/roles/paperless-migration/templates/docker-compose.yml.j2
@@ -0,0 +1,87 @@
+#version: "3.4"
+services:
+  broker:
+    image: docker.io/library/redis:7
+    restart: unless-stopped
+    volumes:
+      - redisdata:/data
+
+  db:
+    image: docker.io/library/postgres:15
+    restart: unless-stopped
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    ports:
+      - "5432:5432"
+    environment:
+      POSTGRES_DB: paperless
+      POSTGRES_USER: paperless
+      POSTGRES_PASSWORD: {{ postgres_password }}
+
+  webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
+    restart: unless-stopped
+    depends_on:
+      - db
+      - broker
+      - gotenberg
+      - tika
+      - protonmail-bridge
+    ports:
+      - "{{ paperless_port }}:8000"
+    volumes:
+      - data:/usr/src/paperless/data
+      - media:/usr/src/paperless/media
+      - {{ paperless_dir }}/export:/usr/src/paperless/export
+      - {{ paperless_dir }}/consume:/usr/src/paperless/consume
+    env_file: docker-compose.env
+    environment:
+      PAPERLESS_REDIS: redis://broker:6379
+      PAPERLESS_DBHOST: db
+      PAPERLESS_TIKA_ENABLED: 1
+      PAPERLESS_TIKA_GOTENBERG_ENDPOINT: http://gotenberg:3000 
+      PAPERLESS_TIKA_ENDPOINT: http://tika:9998
+      PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
+      PAPERLESS_SOCIALACCOUNT_PROVIDERS: >
+        {
+          "openid_connect": {
+            "APPS": [
+              {
+                "provider_id": "authentik",
+                "name": "Authentik",
+                "client_id": "3jhutuBrnJUm0ezzx8OuhKsfnXGgXcpmniFt3NNy",
+                "secret": "lTJaaYpQqQfPdRz9XDhuLSvRRiktEkkAF1hUhiTxwrpXYGaEGlFOMK9CmqeXjHHQDSi6Ar3M1S4bBtapLhFkzFFrKFjp25qwmvAkFFd10OYmCDdAlmo9QlZVH5tmyFFn",
+                "settings": {
+                  "server_url": "https://auth.renner.uno/application/o/paperless/.well-known/openid-configuration"
+                }
+              }
+            ],
+            "OAUTH_PKCE_ENABLED": "True"
+          }
+        }
+
+  gotenberg:
+    image: docker.io/gotenberg/gotenberg:8
+    restart: unless-stopped
+    command:
+      - "gotenberg"
+      - "--chromium-disable-javascript=true"
+      - "--chromium-allow-list=file:///tmp/.*"
+
+  tika:
+    image: docker.io/apache/tika:latest
+    restart: unless-stopped
+
+  protonmail-bridge:
+    image: shenxn/protonmail-bridge
+    restart: unless-stopped
+    volumes:
+      - protonmail:/root
+
+volumes:
+  data:
+  media:
+  pgdata:
+  redisdata:
+  protonmail:
+    name: protonmail