diff --git a/.env.sample b/.env.sample
index 4ac97c2..fdeab41 100644
--- a/.env.sample
+++ b/.env.sample
@@ -7,6 +7,10 @@ LETS_ENCRYPT_ENV=production
 
 ADMIN_USERNAME=admin
 
+# CUSTOM_THEME_ENABLED=1
+# CUSTOM_THEME_URL=
+# CUSTOM_THEME_NAME=
+
 SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_DB_PASSWORD_VERSION=v1
 SECRET_ADMIN_PASSWORD_VERSION=v1
diff --git a/compose.yml b/compose.yml
index 8d56837..2b0840b 100644
--- a/compose.yml
+++ b/compose.yml
@@ -9,6 +9,9 @@ services:
       - admin_password
       - db_password
     environment:
+      - CUSTOM_THEME_ENABLED
+      - CUSTOM_THEME_NAME
+      - CUSTOM_THEME_URL
       - DB_ADDR=db
       - DB_DATABASE=keycloak
       - DB_PASSWORD_FILE=/run/secrets/db_password
diff --git a/entrypoint.sh.tmpl b/entrypoint.sh.tmpl
new file mode 100644
index 0000000..daf0c3c
--- /dev/null
+++ b/entrypoint.sh.tmpl
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -e
+
+{{ if eq (env "CUSTOM_THEME_ENABLED") "1" }}
+git clone "$CUSTOM_THEME_URL" "/opt/jboss/keycloak/themes/$CUSTOM_THEME_NAME"
+{{ end }}
+
+# upstream entrypoint
+# https://github.com/keycloak/keycloak-containers/blob/aa2e5515ccb05116e49ab38839d8fcfdd17c45aa/server/Dockerfile#L30
+/usr/local/bin/entrypoint.sh "$@"