diff --git a/deploy/cluster/main.tf b/deploy/cluster/main.tf
new file mode 100644
index 000000000..52041de23
--- /dev/null
+++ b/deploy/cluster/main.tf
@@ -0,0 +1,49 @@
+resource "google_compute_network" "this" {
+  name = "${var.name}-vpc"
+  auto_create_subnetworks = false
+  routing_mode = "REGIONAL"
+}
+
+resource "google_compute_subnetwork" "this" {
+  name = var.name
+  network = google_compute_network.this.id
+}
+
+resource "google_container_cluster" "this" {
+  name = "${var.name}-cluster"
+  location = var.gcp_zone # zonal cluster avoids data transfer costs between zones
+  remove_default_node_pool = true
+  initial_node_count = 1
+  network = google_compute_network.this.self_link
+  subnetwork = google_compute_subnetwork.this.self_link
+  networking_mode = "VPC_NATIVE"
+  deletion_protection = true
+
+  addons_config {
+    http_load_balancing {
+      disabled = false
+    }
+    horizontal_pod_autoscaling {
+      disabled = false
+    }
+  }
+
+  release_channel {
+    channel = "STABLE"
+  }
+
+  workload_identity_config {
+    workload_pool = "${}"
+  }
+
+  ip_allocation_policy {
+    cluster_secondary_range_name = "k8s-pods"
+    services_secondary_range_name = "k8s-services"
+  }
+
+  private_cluster_config {
+    enable_private_nodes = true
+    enable_private_endpoint = false
+    master_ipv4_cidr_block = "192.168.0.0/28"
+  }
+}
diff --git a/deploy/cluster/output.tf b/deploy/cluster/output.tf
new file mode 100644
index 000000000..e69de29bb
diff --git a/deploy/cluster/variables.tf b/deploy/cluster/variables.tf
new file mode 100644
index 000000000..eb481045d
--- /dev/null
+++ b/deploy/cluster/variables.tf
@@ -0,0 +1,9 @@
+variable "name" {
+  description = "Name of this Kubernetes cluster"
+  type = string
+}
+
+variable "gcp_zone" {
+  description = "Google Cloud zone where all nodes are located"
+  type = string
+}
diff --git a/deploy/saturn/main.tf b/deploy/saturn/main.tf
index f999527c4..78ed9efb4 100644
--- a/deploy/saturn/main.tf
+++ b/deploy/saturn/main.tf
@@ -121,10 +121,17 @@ resource "google_compute_instance_template" "this" {
   }
 
   metadata = {
-    gce-container-declaration = module.container.metadata_value
     google-logging-enabled    = true
     google-monitoring-enabled = true
     shutdown-script           = file("${path.module}/shutdown-script.sh")
+    startup-script            = templatefile("${path.module}/startup-script.sh", {
+      image        = jsonencode(var.image)
+      registry     = jsonencode(split("/", var.image)[0])
+      project      = jsonencode(var.gcp_project)
+      secret       = jsonencode(var.secret_id)
+      subscription = jsonencode(google_pubsub_subscription.queue.name)
+      parallelism  = jsonencode(var.parallelism)
+    })
   }
 
   lifecycle {
diff --git a/deploy/saturn/startup-script.sh b/deploy/saturn/startup-script.sh
new file mode 100644
index 000000000..9d06f3d3a
--- /dev/null
+++ b/deploy/saturn/startup-script.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+set -euo pipefail
+
+IMAGE=${image}
+REGISTRY=${registry}
+PROJECT=${project}
+SECRET=${secret}
+SUBSCRIPTION=${subscription}
+PARALLELISM=${parallelism}
+CONTAINER_NAME=saturn
+
+exec >>/var/log/saturn-startup.log 2>&1
+
+echo "Starting Saturn container at $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+
+until docker info >/dev/null 2>&1; do
+  echo "Waiting for Docker..."
+  sleep 2
+done
+
+until TOKEN_RESPONSE="$(curl --fail --silent --show-error \
+  -H 'Metadata-Flavor: Google' \
+  'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token')"; do
+  echo "Waiting for the metadata server..."
+  sleep 2
+done
+
+ACCESS_TOKEN="$(printf '%s' "$TOKEN_RESPONSE" | sed -E 's/.*"access_token":"([^"]+)".*/\1/')"
+if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "$TOKEN_RESPONSE" ]; then
+  echo "Unable to obtain an access token from the metadata server" >&2
+  exit 1
+fi
+
+printf '%s' "$ACCESS_TOKEN" | docker login \
+  --username oauth2accesstoken \
+  --password-stdin "https://$REGISTRY"
+
+docker rm --force "$CONTAINER_NAME" >/dev/null 2>&1 || true
+docker pull "$IMAGE"
+docker run \
+  --detach \
+  --name "$CONTAINER_NAME" \
+  --restart on-failure \
+  "$IMAGE" \
+  "-project=$PROJECT" \
+  "-secret=$SECRET" \
+  "-subscription=$SUBSCRIPTION" \
+  "-parallel=$PARALLELISM"
+
+echo "Saturn container started at $(date -u +%Y-%m-%dT%H:%M:%SZ)"