diff --git a/docker-env2/README.md b/docker-env2/README.md
index 45b2c2f2..11a58756 100644
--- a/docker-env2/README.md
+++ b/docker-env2/README.md
@@ -73,6 +73,16 @@ bash docker-env2/deploy.sh
 bash docker-env2/seed-sites.sh
 ```
 
+The seed also creates a **native alarm source demo**: a `MxAlarmDemo` template with a
+`GalaxyAlarms` native alarm source bound to the shared MxGateway connection, plus a
+deployed `MxAlarmDemo-1` instance on site-x. This exercises the read-only native alarm
+mirror end-to-end — mirrored alarms appear live in the Central UI Debug View with severity
+and condition badges. Verify the binding with:
+
+```bash
+scadabridge --url http://localhost:9100 template native-alarm-source list --template-id <id>
+```
+
 ### After Code Changes
 
 ```bash
diff --git a/docker-env2/seed-sites.sh b/docker-env2/seed-sites.sh
index b8542bfc..dbb97831 100755
--- a/docker-env2/seed-sites.sh
+++ b/docker-env2/seed-sites.sh
@@ -83,12 +83,65 @@ IF NOT EXISTS (SELECT 1 FROM LdapGroupMappings WHERE Id = 4)
 SET IDENTITY_INSERT LdapGroupMappings OFF;
 "
 
+echo ""
+echo "Creating MxAlarm demo template + native alarm source binding..."
+# Mirrors native MxAccess Gateway alarms (read-only) into ScadaBridge. The
+# binding points at the shared 'ScadaBridge Site X' MxGateway connection and a
+# representative MxAccess area/object. Requires the Design role (granted above).
+if [ -n "$SITE_X_ID" ]; then
+    CONN_NAME="ScadaBridge Site X"
+    TEMPLATE_NAME="MxAlarmDemo"
+    # Representative MxAccess area object to mirror alarms from. Adjust to a real
+    # Galaxy area present on the gateway.
+    NAS_SOURCE_REF="\$Area_001"
+
+    $CLI $URL $AUTH template create \
+        --name "$TEMPLATE_NAME" \
+        --description "Demo: mirrors native MxAccess Gateway alarms (read-only)" \
+    || echo "  ('$TEMPLATE_NAME' may already exist)"
+
+    TEMPLATE_ID=$($CLI $URL $AUTH --format json template list \
+        | python3 -c "import sys,json; print(next((t['id'] for t in json.load(sys.stdin) if t.get('name')=='$TEMPLATE_NAME'), ''))" 2>/dev/null)
+
+    if [ -n "$TEMPLATE_ID" ]; then
+        echo "  template '$TEMPLATE_NAME' (id=$TEMPLATE_ID): adding native alarm source 'GalaxyAlarms'..."
+        $CLI $URL $AUTH template native-alarm-source add \
+            --template-id "$TEMPLATE_ID" \
+            --name "GalaxyAlarms" \
+            --connection "$CONN_NAME" \
+            --source-ref "$NAS_SOURCE_REF" \
+        || echo "    ('GalaxyAlarms' may already exist on the template)"
+
+        echo "  creating instance 'MxAlarmDemo-1' at site-x..."
+        $CLI $URL $AUTH instance create \
+            --name "MxAlarmDemo-1" \
+            --template-id "$TEMPLATE_ID" \
+            --site-id "$SITE_X_ID" \
+        || echo "    ('MxAlarmDemo-1' may already exist)"
+    else
+        echo "  (template '$TEMPLATE_NAME' not found — skipping native alarm source seed)"
+    fi
+else
+    echo "  (site-x not found — skipping native alarm source demo seed)"
+fi
+
 echo ""
 echo "Deploying artifacts to all env2 sites (pushes the data connection so the"
 echo "site establishes it — the MxGateway DataConnectionActor connects eagerly)..."
 $CLI $URL $AUTH deploy artifacts \
 || echo "  (artifact deploy reported an issue — check 'deploy status')"
 
+echo ""
+echo "Deploying the MxAlarm demo instance to site-x..."
+INSTANCE_ID=$($CLI $URL $AUTH --format json instance list \
+    | python3 -c "import sys,json; print(next((i['id'] for i in json.load(sys.stdin) if i.get('uniqueName')=='MxAlarmDemo-1'), ''))" 2>/dev/null)
+if [ -n "$INSTANCE_ID" ]; then
+    $CLI $URL $AUTH instance deploy --instance-id "$INSTANCE_ID" \
+    || echo "  (instance deploy reported an issue — check 'deploy status')"
+else
+    echo "  (MxAlarmDemo-1 not found — skipping instance deploy)"
+fi
+
 echo ""
 echo "=== Env2 site seeding complete ==="
 echo ""