diff --git a/deploy/dr-sandbox-worker.service.in b/deploy/dr-sandbox-worker.service.in
new file mode 100644
index 0000000..60f1685
--- /dev/null
+++ b/deploy/dr-sandbox-worker.service.in
@@ -0,0 +1,16 @@
+[Unit]
+Description=dr-sandbox Prefect embedding flow worker
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=@ROOT@
+ExecStart=@ROOT@/.venv/bin/python flows/embedding_flow.py
+Restart=on-failure
+RestartSec=5
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=default.target
diff --git a/makefile b/makefile
index e7abbc5..250a060 100644
--- a/makefile
+++ b/makefile
@@ -10,3 +10,49 @@ demo:
 compile:
 	uv pip compile pyproject.toml -o requirements-frozen.txt
 
+# ------------------------------------------------------------------------
+# systemd user service — persistent equivalent of `make run` (the Prefect
+# worker for the embedding_flow deployment). User-scope, no sudo needed.
+# ------------------------------------------------------------------------
+
+SERVICE_NAME := dr-sandbox-worker.service
+SERVICE_DIR  := $(HOME)/.config/systemd/user
+SERVICE_PATH := $(SERVICE_DIR)/$(SERVICE_NAME)
+SERVICE_TMPL := deploy/dr-sandbox-worker.service.in
+
+.PHONY: service-install service-uninstall service-start service-stop service-restart service-status service-logs
+
+service-install:
+	@mkdir -p $(SERVICE_DIR)
+	sed 's|@ROOT@|$(CURDIR)|g' $(SERVICE_TMPL) > $(SERVICE_PATH)
+	systemctl --user daemon-reload
+	systemctl --user enable --now $(SERVICE_NAME)
+	systemctl --user restart $(SERVICE_NAME)
+	@echo
+	@echo "installed $(SERVICE_NAME) -> $(SERVICE_PATH)"
+	@echo "  status:  make service-status"
+	@echo "  logs:    make service-logs"
+	@loginctl show-user $$USER 2>/dev/null | grep -q "Linger=yes" || \
+	  echo "  linger:  sudo loginctl enable-linger $$USER   # to survive logout / reboot"
+
+service-uninstall:
+	-systemctl --user disable --now $(SERVICE_NAME)
+	-rm -f $(SERVICE_PATH)
+	-systemctl --user daemon-reload
+	@echo "removed $(SERVICE_NAME)"
+
+service-start:
+	systemctl --user start $(SERVICE_NAME)
+
+service-stop:
+	systemctl --user stop $(SERVICE_NAME)
+
+service-restart:
+	systemctl --user restart $(SERVICE_NAME)
+
+service-status:
+	systemctl --user status $(SERVICE_NAME)
+
+service-logs:
+	journalctl --user -u $(SERVICE_NAME) -f
+