diff --git a/docs/container.md b/docs/container.md
index a2e2bcb92..1e58f35c0 100644
--- a/docs/container.md
+++ b/docs/container.md
@@ -531,6 +531,7 @@ FLAGS
   -p, --project-id=<value>   ID or short ID of a project; this flag is optional if a default project is set in the
                              context
   -q, --quiet                suppress process output and only display a machine-readable summary
+  -s, --stack-id=<value>     ID of the stack to operate on
   -v, --volume=<value>...    bind mount a volume to the container
       --cpus=<value>         set CPU limit for the container
       --create-volumes       automatically create named volumes that do not exist
@@ -568,6 +569,11 @@ FLAG DESCRIPTIONS
     This flag controls if you want to see the process output or only a summary. When using mw non-interactively (e.g. in
     scripts), you can use this flag to easily get the IDs of created resources for further processing.
 
+  -s, --stack-id=<value>  ID of the stack to operate on
+
+    If omitted, the stack set in the CLI context is used; when that is not set either, the project's default stack is
+    used.
+
   -v, --volume=<value>...  bind mount a volume to the container
 
     This flag can be used to add volume mounts to the container. It can be used multiple times to mount multiple
diff --git a/docs/stack.md b/docs/stack.md
index af18d3b14..961e01cea 100644
--- a/docs/stack.md
+++ b/docs/stack.md
@@ -3,6 +3,7 @@
 
 Manage container stacks
 
+* [`mw stack create`](#mw-stack-create)
 * [`mw stack delete [STACK-ID]`](#mw-stack-delete-stack-id)
 * [`mw stack deploy`](#mw-stack-deploy)
 * [`mw stack list`](#mw-stack-list)
@@ -10,9 +11,78 @@ Manage container stacks
 * [`mw stack ps`](#mw-stack-ps)
 * [`mw stack rm [STACK-ID]`](#mw-stack-rm-stack-id)
 * [`mw stack set-update-schedule STACK-ID SCHEDULE`](#mw-stack-set-update-schedule-stack-id-schedule)
+* [`mw stack template install TEMPLATE-ID`](#mw-stack-template-install-template-id)
+* [`mw stack template list`](#mw-stack-template-list)
+* [`mw stack template ls`](#mw-stack-template-ls)
 * [`mw stack unset-update-schedule STACK-ID`](#mw-stack-unset-update-schedule-stack-id)
 * [`mw stack up`](#mw-stack-up)
 
+## `mw stack create`
+
+Create a new container stack
+
+```
+USAGE
+  $ mw stack create -d <value> [--token <value>] [-p <value>] [-q] [--input <value>... --from-template <value>]
+    [-c]
+
+FLAGS
+  -c, --update-context         update the CLI context to use the newly created stack
+  -d, --description=<value>    (required) description of the stack
+  -p, --project-id=<value>     ID or short ID of a project; this flag is optional if a default project is set in the
+                               context
+  -q, --quiet                  suppress process output and only display a machine-readable summary
+      --from-template=<value>  ID of a container template to create the stack from
+      --input=<value>...       user input for a template, in 'name=value' format
+
+AUTHENTICATION FLAGS
+  --token=<value>  API token to use for authentication (overrides environment and config file). NOTE: watch out that
+                   tokens passed via this flag might be logged in your shell history.
+
+DESCRIPTION
+  Create a new container stack
+
+  Creates a new, empty container stack, or a stack based on a container template.
+
+  When --from-template is given, the referenced template may define user inputs. These can be supplied non-interactively
+  with one or more --input flags in 'name=value' format; any required inputs that are neither provided nor have a
+  default value are prompted for interactively.
+
+  Use "mw stack template list" to discover available templates and their IDs. To add a template to a stack that already
+  exists, use "mw stack template install" instead.
+
+EXAMPLES
+  Create an empty stack
+
+    $ mw stack create --description "my stack"
+
+  Create a stack from a template, providing user inputs
+
+    $ mw stack create --description "my n8n" --from-template <template-id> --input DOMAIN=example.com --input \
+      ADMIN_EMAIL=admin@example.com
+
+FLAG DESCRIPTIONS
+  -p, --project-id=<value>  ID or short ID of a project; this flag is optional if a default project is set in the context
+
+    May contain a short ID or a full ID of a project; you can also use the "mw context set --project-id=<VALUE>" command
+    to persistently set a default project for all commands that accept this flag.
+
+  -q, --quiet  suppress process output and only display a machine-readable summary
+
+    This flag controls if you want to see the process output or only a summary. When using mw non-interactively (e.g. in
+    scripts), you can use this flag to easily get the IDs of created resources for further processing.
+
+  --from-template=<value>  ID of a container template to create the stack from
+
+    When set, the stack is created from the given container template. Omit this flag to create an empty stack.
+
+  --input=<value>...  user input for a template, in 'name=value' format
+
+    May be repeated to provide multiple inputs. Only applicable together with --from-template. Required inputs that are
+    not provided (and have no default) are prompted for interactively.
+```
+
+
 ## `mw stack delete [STACK-ID]`
 
 Delete a container stack
@@ -44,6 +114,11 @@ FLAG DESCRIPTIONS
 
     This flag controls if you want to see the process output or only a summary. When using mw non-interactively (e.g. in
     scripts), you can use this flag to easily get the IDs of created resources for further processing.
+
+  -v, --with-volumes  also include remove volumes in removal
+
+    Only relevant for a project's default stack, which is emptied instead of removed; the volumes of any other stack are
+    removed together with the stack itself.
 ```
 
 
@@ -90,6 +165,8 @@ FLAG DESCRIPTIONS
 
   --from-template=<value>  deploy from a GitHub template (e.g., mittwald/n8n)
 
+    DEPRECATED: use "mw stack create --from-template" instead. This flag uses an older, GitHub-based template mechanism.
+
     Fetch and deploy a stack from a GitHub template repository. Template names are automatically converted to repository
     names by prefixing "stack-template-" to the name part.
 
@@ -248,6 +325,11 @@ FLAG DESCRIPTIONS
 
     This flag controls if you want to see the process output or only a summary. When using mw non-interactively (e.g. in
     scripts), you can use this flag to easily get the IDs of created resources for further processing.
+
+  -v, --with-volumes  also include remove volumes in removal
+
+    Only relevant for a project's default stack, which is emptied instead of removed; the volumes of any other stack are
+    removed together with the stack itself.
 ```
 
 ## `mw stack set-update-schedule STACK-ID SCHEDULE`
@@ -281,6 +363,150 @@ FLAG DESCRIPTIONS
 ```
 
 
+## `mw stack template install TEMPLATE-ID`
+
+Install a template into an existing container stack
+
+```
+USAGE
+  $ mw stack template install TEMPLATE-ID [--token <value>] [-s <value>] [-q] [--input <value>...]
+
+ARGUMENTS
+  TEMPLATE-ID  ID of the container template to install
+
+FLAGS
+  -q, --quiet             suppress process output and only display a machine-readable summary
+  -s, --stack-id=<value>  ID of a stack; this flag is optional if a default stack is set in the context
+      --input=<value>...  user input for the template, in 'name=value' format
+
+AUTHENTICATION FLAGS
+  --token=<value>  API token to use for authentication (overrides environment and config file). NOTE: watch out that
+                   tokens passed via this flag might be logged in your shell history.
+
+DESCRIPTION
+  Install a template into an existing container stack
+
+  Adds the services and volumes of a container template to a stack that already exists, instead of creating a new stack
+  for it.
+
+  This is intended for templates of type "component"; use "mw stack create --from-template" to create a new stack from a
+  standalone template.
+
+  Template user inputs can be supplied non-interactively with one or more --input flags in 'name=value' format; any
+  required inputs that are neither provided nor have a default value are prompted for interactively.
+
+EXAMPLES
+  Install a template into the stack from the current context
+
+    $ mw stack template install <template-id>
+
+  Install a template into a specific stack, with inputs
+
+    $ mw stack template install <template-id> --stack-id <stack-id> --input DB_NAME=mydb
+
+FLAG DESCRIPTIONS
+  -q, --quiet  suppress process output and only display a machine-readable summary
+
+    This flag controls if you want to see the process output or only a summary. When using mw non-interactively (e.g. in
+    scripts), you can use this flag to easily get the IDs of created resources for further processing.
+
+  -s, --stack-id=<value>  ID of a stack; this flag is optional if a default stack is set in the context
+
+    May contain a ID of a stack; you can also use the "mw context set --stack-id=<VALUE>" command to persistently set a
+    default stack for all commands that accept this flag.
+
+  --input=<value>...  user input for the template, in 'name=value' format
+
+    May be repeated to provide multiple inputs. Required inputs that are not provided (and have no default) are prompted
+    for interactively.
+```
+
+
+## `mw stack template list`
+
+List container templates that stacks can be created from.
+
+```
+USAGE
+  $ mw stack template list -o txt|json|yaml|csv|tsv [--token <value>] [-x] [--no-header] [--no-truncate]
+    [--no-relative-dates] [--csv-separator ,|;] [--category <value>] [--type component|standalone]
+
+FLAGS
+  -o, --output=<option>         (required) [default: txt] output in a more machine friendly format
+                                <options: txt|json|yaml|csv|tsv>
+  -x, --extended                show extended information
+      --category=<value>        only list templates belonging to the given category
+      --csv-separator=<option>  [default: ,] separator for CSV output (only relevant for CSV output)
+                                <options: ,|;>
+      --no-header               hide table header
+      --no-relative-dates       show dates in absolute format, not relative (only relevant for txt output)
+      --no-truncate             do not truncate output (only relevant for txt output)
+      --type=<option>           only list templates of the given type
+                                <options: component|standalone>
+
+AUTHENTICATION FLAGS
+  --token=<value>  API token to use for authentication (overrides environment and config file). NOTE: watch out that
+                   tokens passed via this flag might be logged in your shell history.
+
+DESCRIPTION
+  List container templates that stacks can be created from.
+
+ALIASES
+  $ mw stack template ls
+
+EXAMPLES
+  List all templates of a given category
+
+    $ mw stack template list --category cms
+
+  List only standalone templates
+
+    $ mw stack template list --type standalone
+```
+
+
+## `mw stack template ls`
+
+List container templates that stacks can be created from.
+
+```
+USAGE
+  $ mw stack template ls -o txt|json|yaml|csv|tsv [--token <value>] [-x] [--no-header] [--no-truncate]
+    [--no-relative-dates] [--csv-separator ,|;] [--category <value>] [--type component|standalone]
+
+FLAGS
+  -o, --output=<option>         (required) [default: txt] output in a more machine friendly format
+                                <options: txt|json|yaml|csv|tsv>
+  -x, --extended                show extended information
+      --category=<value>        only list templates belonging to the given category
+      --csv-separator=<option>  [default: ,] separator for CSV output (only relevant for CSV output)
+                                <options: ,|;>
+      --no-header               hide table header
+      --no-relative-dates       show dates in absolute format, not relative (only relevant for txt output)
+      --no-truncate             do not truncate output (only relevant for txt output)
+      --type=<option>           only list templates of the given type
+                                <options: component|standalone>
+
+AUTHENTICATION FLAGS
+  --token=<value>  API token to use for authentication (overrides environment and config file). NOTE: watch out that
+                   tokens passed via this flag might be logged in your shell history.
+
+DESCRIPTION
+  List container templates that stacks can be created from.
+
+ALIASES
+  $ mw stack template ls
+
+EXAMPLES
+  List all templates of a given category
+
+    $ mw stack template ls --category cms
+
+  List only standalone templates
+
+    $ mw stack template ls --type standalone
+```
+
 ## `mw stack unset-update-schedule STACK-ID`
 
 Unset the update schedule of a container stack
@@ -353,6 +579,8 @@ FLAG DESCRIPTIONS
 
   --from-template=<value>  deploy from a GitHub template (e.g., mittwald/n8n)
 
+    DEPRECATED: use "mw stack create --from-template" instead. This flag uses an older, GitHub-based template mechanism.
+
     Fetch and deploy a stack from a GitHub template repository. Template names are automatically converted to repository
     names by prefixing "stack-template-" to the name part.
 
diff --git a/docs/volume.md b/docs/volume.md
index 6b666c1b4..8937d06d3 100644
--- a/docs/volume.md
+++ b/docs/volume.md
@@ -15,7 +15,7 @@ Create a new volume
 
 ```
 USAGE
-  $ mw volume create NAME [--token <value>] [-p <value>] [-q]
+  $ mw volume create NAME [--token <value>] [-p <value>] [-s <value>] [-q]
 
 ARGUMENTS
   NAME  name of the volume to create
@@ -24,6 +24,7 @@ FLAGS
   -p, --project-id=<value>  ID or short ID of a project; this flag is optional if a default project is set in the
                             context
   -q, --quiet               suppress process output and only display a machine-readable summary
+  -s, --stack-id=<value>    ID of the stack to operate on
 
 AUTHENTICATION FLAGS
   --token=<value>  API token to use for authentication (overrides environment and config file). NOTE: watch out that
@@ -32,7 +33,7 @@ AUTHENTICATION FLAGS
 DESCRIPTION
   Create a new volume
 
-  Creates a new named volume in the project stack. The volume will be available for use by containers.
+  Creates a new named volume in a container stack. The volume will be available for use by containers of that stack.
 
 FLAG DESCRIPTIONS
   -p, --project-id=<value>  ID or short ID of a project; this flag is optional if a default project is set in the context
@@ -44,6 +45,11 @@ FLAG DESCRIPTIONS
 
     This flag controls if you want to see the process output or only a summary. When using mw non-interactively (e.g. in
     scripts), you can use this flag to easily get the IDs of created resources for further processing.
+
+  -s, --stack-id=<value>  ID of the stack to operate on
+
+    If omitted, the stack set in the CLI context is used; when that is not set either, the project's default stack is
+    used.
 ```
 
 
@@ -53,7 +59,7 @@ Remove one or more volumes
 
 ```
 USAGE
-  $ mw volume delete NAME [--token <value>] [-p <value>] [-q] [-f]
+  $ mw volume delete NAME [--token <value>] [-p <value>] [-s <value>] [-q] [-f]
 
 ARGUMENTS
   NAME  name of the volume to remove
@@ -63,6 +69,7 @@ FLAGS
   -p, --project-id=<value>  ID or short ID of a project; this flag is optional if a default project is set in the
                             context
   -q, --quiet               suppress process output and only display a machine-readable summary
+  -s, --stack-id=<value>    ID of the stack to operate on
 
 AUTHENTICATION FLAGS
   --token=<value>  API token to use for authentication (overrides environment and config file). NOTE: watch out that
@@ -71,7 +78,7 @@ AUTHENTICATION FLAGS
 DESCRIPTION
   Remove one or more volumes
 
-  Removes named volumes from the project stack. Be careful as this will permanently delete the volume data.
+  Removes named volumes from a container stack. Be careful as this will permanently delete the volume data.
 
 ALIASES
   $ mw volume rm
@@ -86,6 +93,11 @@ FLAG DESCRIPTIONS
 
     This flag controls if you want to see the process output or only a summary. When using mw non-interactively (e.g. in
     scripts), you can use this flag to easily get the IDs of created resources for further processing.
+
+  -s, --stack-id=<value>  ID of the stack to operate on
+
+    If omitted, the stack set in the CLI context is used; when that is not set either, the project's default stack is
+    used.
 ```
 
 
@@ -172,7 +184,7 @@ Remove one or more volumes
 
 ```
 USAGE
-  $ mw volume rm NAME [--token <value>] [-p <value>] [-q] [-f]
+  $ mw volume rm NAME [--token <value>] [-p <value>] [-s <value>] [-q] [-f]
 
 ARGUMENTS
   NAME  name of the volume to remove
@@ -182,6 +194,7 @@ FLAGS
   -p, --project-id=<value>  ID or short ID of a project; this flag is optional if a default project is set in the
                             context
   -q, --quiet               suppress process output and only display a machine-readable summary
+  -s, --stack-id=<value>    ID of the stack to operate on
 
 AUTHENTICATION FLAGS
   --token=<value>  API token to use for authentication (overrides environment and config file). NOTE: watch out that
@@ -190,7 +203,7 @@ AUTHENTICATION FLAGS
 DESCRIPTION
   Remove one or more volumes
 
-  Removes named volumes from the project stack. Be careful as this will permanently delete the volume data.
+  Removes named volumes from a container stack. Be careful as this will permanently delete the volume data.
 
 ALIASES
   $ mw volume rm
@@ -205,4 +218,9 @@ FLAG DESCRIPTIONS
 
     This flag controls if you want to see the process output or only a summary. When using mw non-interactively (e.g. in
     scripts), you can use this flag to easily get the IDs of created resources for further processing.
+
+  -s, --stack-id=<value>  ID of the stack to operate on
+
+    If omitted, the stack set in the CLI context is used; when that is not set either, the project's default stack is
+    used.
 ```
diff --git a/package.json b/package.json
index ad8dde446..5aec85f20 100644
--- a/package.json
+++ b/package.json
@@ -252,7 +252,12 @@
         "description": "Manage SSH users of your projects"
       },
       "stack": {
-        "description": "Manage container stacks"
+        "description": "Manage container stacks",
+        "subtopics": {
+          "template": {
+            "description": "Browse container templates that stacks can be created from"
+          }
+        }
       },
       "user": {
         "description": "Manage your own user account",
diff --git a/src/commands/container/run.tsx b/src/commands/container/run.tsx
index 018dc9793..3bc8b6c4b 100644
--- a/src/commands/container/run.tsx
+++ b/src/commands/container/run.tsx
@@ -6,6 +6,10 @@ import {
   processFlags,
 } from "../../rendering/process/process_flags.js";
 import { projectFlags } from "../../lib/resources/project/flags.js";
+import {
+  optionalStackFlags,
+  withStackIdOrDefault,
+} from "../../lib/resources/stack/flags.js";
 import dockerNames from "docker-names";
 import { assertStatus, MittwaldAPIV2 } from "@mittwald/api-client";
 import {
@@ -43,6 +47,7 @@ export class Run extends ExecRenderBaseCommand<typeof Run, Result> {
   static flags = {
     ...processFlags,
     ...projectFlags,
+    ...optionalStackFlags,
     env: Flags.string({
       summary: "set environment variables in the container",
       description:
@@ -158,7 +163,12 @@ export class Run extends ExecRenderBaseCommand<typeof Run, Result> {
     const p = makeProcessRenderer(this.flags, "Creating a container");
 
     const projectId = await this.withProjectId(Run);
-    const stackId = projectId;
+    const stackId = await withStackIdOrDefault(
+      this.apiClient,
+      this.flags,
+      projectId,
+      this.config,
+    );
     const serviceName = this.getServiceName();
 
     const { image, meta: imageMeta } = await p.runStep(
diff --git a/src/commands/stack/create.tsx b/src/commands/stack/create.tsx
new file mode 100644
index 000000000..1cb0d847b
--- /dev/null
+++ b/src/commands/stack/create.tsx
@@ -0,0 +1,140 @@
+import { ExecRenderBaseCommand } from "../../lib/basecommands/ExecRenderBaseCommand.js";
+import {
+  makeProcessRenderer,
+  processFlags,
+} from "../../rendering/process/process_flags.js";
+import { ReactNode } from "react";
+import { assertStatus } from "@mittwald/api-client-commons";
+import { Success } from "../../rendering/react/components/Success.js";
+import { Value } from "../../rendering/react/components/Value.js";
+import { projectFlags } from "../../lib/resources/project/flags.js";
+import { Flags } from "@oclif/core";
+import type { MittwaldAPIV2 } from "@mittwald/api-client";
+import Context from "../../lib/context/Context.js";
+import { parseEnvironmentVariablesFromArray } from "../../lib/util/parser.js";
+import { collectTemplateUserInputs } from "../../lib/resources/stack/template-inputs.js";
+
+type ContainerCreateStack =
+  MittwaldAPIV2.Components.Schemas.ContainerCreateStack;
+
+type Result = {
+  stackId: string;
+};
+
+export class Create extends ExecRenderBaseCommand<typeof Create, Result> {
+  static summary = "Create a new container stack";
+  static description = `\
+Creates a new, empty container stack, or a stack based on a container template.
+
+When --from-template is given, the referenced template may define user inputs. These can be supplied non-interactively with one or more --input flags in 'name=value' format; any required inputs that are neither provided nor have a default value are prompted for interactively.
+
+Use "<%= config.bin %> stack template list" to discover available templates and their IDs. To add a template to a stack that already exists, use "<%= config.bin %> stack template install" instead.`;
+
+  static examples = [
+    {
+      description: "Create an empty stack",
+      command: '<%= config.bin %> <%= command.id %> --description "my stack"',
+    },
+    {
+      description: "Create a stack from a template, providing user inputs",
+      command:
+        '<%= config.bin %> <%= command.id %> --description "my n8n" --from-template <template-id> --input DOMAIN=example.com --input ADMIN_EMAIL=admin@example.com',
+    },
+  ];
+
+  static flags = {
+    ...projectFlags,
+    ...processFlags,
+    description: Flags.string({
+      char: "d",
+      summary: "description of the stack",
+      required: true,
+    }),
+    "from-template": Flags.string({
+      summary: "ID of a container template to create the stack from",
+      description:
+        "When set, the stack is created from the given container template. Omit this flag to create an empty stack.",
+    }),
+    input: Flags.string({
+      summary: "user input for a template, in 'name=value' format",
+      description:
+        "May be repeated to provide multiple inputs. Only applicable together with --from-template. Required inputs that are not provided (and have no default) are prompted for interactively.",
+      multiple: true,
+      dependsOn: ["from-template"],
+    }),
+    "update-context": Flags.boolean({
+      char: "c",
+      summary: "update the CLI context to use the newly created stack",
+    }),
+  };
+
+  protected async exec(): Promise<Result> {
+    const process = makeProcessRenderer(
+      this.flags,
+      "Creating a new container stack",
+    );
+    const projectId = await this.withProjectId(Create);
+    const { description, "from-template": fromTemplate } = this.flags;
+
+    const data: ContainerCreateStack = { description };
+
+    if (fromTemplate) {
+      const template = await process.runStep(
+        "retrieving container template",
+        async () => {
+          const r = await this.apiClient.container.getTemplate({
+            templateId: fromTemplate,
+          });
+          assertStatus(r, 200);
+          return r.data;
+        },
+      );
+
+      const providedInputs = parseEnvironmentVariablesFromArray(
+        this.flags.input,
+      );
+      const userInputs = await collectTemplateUserInputs(
+        template.userInputs ?? [],
+        providedInputs,
+        process,
+      );
+
+      data.templateConfig = {
+        templateId: fromTemplate,
+        userInputs,
+      };
+    }
+
+    const { id: stackId } = await process.runStep(
+      "creating container stack",
+      async () => {
+        const r = await this.apiClient.container.createStack({
+          projectId,
+          data,
+        });
+        assertStatus(r, 201);
+        return r.data;
+      },
+    );
+
+    if (this.flags["update-context"]) {
+      await process.runStep("updating CLI context", async () => {
+        await new Context(this.apiClient, this.config).setStackId(stackId);
+      });
+    }
+
+    await process.complete(
+      <Success>
+        The container stack <Value>{stackId}</Value> was successfully created.
+      </Success>,
+    );
+
+    return { stackId };
+  }
+
+  protected render({ stackId }: Result): ReactNode {
+    if (this.flags.quiet) {
+      return stackId;
+    }
+  }
+}
diff --git a/src/commands/stack/delete.ts b/src/commands/stack/delete.ts
index a906faf1a..33632cb1b 100644
--- a/src/commands/stack/delete.ts
+++ b/src/commands/stack/delete.ts
@@ -13,6 +13,8 @@ export default class Delete extends DeleteBaseCommand<typeof Delete> {
     ...DeleteBaseCommand.baseFlags,
     "with-volumes": Flags.boolean({
       summary: "also include remove volumes in removal",
+      description:
+        "Only relevant for a project's default stack, which is emptied instead of removed; the volumes of any other stack are removed together with the stack itself.",
       default: false,
       char: "v",
     }),
@@ -24,23 +26,29 @@ export default class Delete extends DeleteBaseCommand<typeof Delete> {
     const stackResponse = await this.apiClient.container.getStack({ stackId });
     assertStatus(stackResponse, 200);
 
-    if (stackResponse.data.projectId !== stackResponse.data.id) {
-      throw new Error("not implemented");
-    }
+    const { id, projectId } = stackResponse.data;
 
-    const resp = await this.apiClient.container.declareStack({
-      stackId,
-      data: {
-        services: {},
-        volumes: {},
-      },
-    });
+    // A project's default stack cannot be removed; it is emptied instead by
+    // declaring it without any services or volumes.
+    if (id === projectId) {
+      const resp = await this.apiClient.container.declareStack({
+        stackId,
+        data: {
+          services: {},
+          volumes: {},
+        },
+      });
+      assertSuccess(resp);
 
-    assertSuccess(resp);
+      if (this.flags["with-volumes"]) {
+        await this.deleteVolumes(stackId, projectId);
+      }
 
-    if (this.flags["with-volumes"]) {
-      await this.deleteVolumes(stackId, stackResponse.data.projectId);
+      return;
     }
+
+    const resp = await this.apiClient.container.deleteStack({ stackId });
+    assertSuccess(resp);
   }
 
   protected async deleteVolumes(
diff --git a/src/commands/stack/deploy.tsx b/src/commands/stack/deploy.tsx
index c59ec97ce..6522fa5b7 100644
--- a/src/commands/stack/deploy.tsx
+++ b/src/commands/stack/deploy.tsx
@@ -58,7 +58,14 @@ export class Deploy extends ExecRenderBaseCommand<typeof Deploy, DeployResult> {
     }),
     "from-template": Flags.string({
       summary: "deploy from a GitHub template (e.g., mittwald/n8n)",
+      deprecated: {
+        message:
+          'The "--from-template" flag of "stack deploy" is deprecated. Use "stack create --from-template" to create a stack from a container template instead.',
+        to: "stack create --from-template",
+      },
       description: `\
+DEPRECATED: use "mw stack create --from-template" instead. This flag uses an older, GitHub-based template mechanism.
+
 Fetch and deploy a stack from a GitHub template repository. Template names are automatically converted to repository names by prefixing "stack-template-" to the name part.
 
 For example, "mittwald/n8n" resolves to the repository "mittwald/stack-template-n8n". The command fetches both docker-compose.yml and .env files from the main branch.
diff --git a/src/commands/stack/list.ts b/src/commands/stack/list.ts
index 66c456c17..3f057d599 100644
--- a/src/commands/stack/list.ts
+++ b/src/commands/stack/list.ts
@@ -34,6 +34,12 @@ export class List extends ListBaseCommand<typeof List, ListItem, ListResponse> {
     return {
       id,
       description: {},
+      template: {
+        header: "Template",
+        get(stack) {
+          return stack.templateId ?? "no template";
+        },
+      },
       services: {
         get(stack) {
           if (stack.services === undefined || stack.services.length === 0) {
diff --git a/src/commands/stack/template/install.tsx b/src/commands/stack/template/install.tsx
new file mode 100644
index 000000000..788056833
--- /dev/null
+++ b/src/commands/stack/template/install.tsx
@@ -0,0 +1,121 @@
+import { Args, Flags } from "@oclif/core";
+import { ExecRenderBaseCommand } from "../../../lib/basecommands/ExecRenderBaseCommand.js";
+import { ReactNode } from "react";
+import {
+  makeProcessRenderer,
+  processFlags,
+} from "../../../rendering/process/process_flags.js";
+import { Success } from "../../../rendering/react/components/Success.js";
+import { Value } from "../../../rendering/react/components/Value.js";
+import { stackFlags } from "../../../lib/resources/stack/flags.js";
+import { assertStatus } from "@mittwald/api-client";
+import assertSuccess from "../../../lib/apiutil/assert_success.js";
+import { parseEnvironmentVariablesFromArray } from "../../../lib/util/parser.js";
+import { collectTemplateUserInputs } from "../../../lib/resources/stack/template-inputs.js";
+
+type Result = {
+  stackId: string;
+  templateId: string;
+};
+
+export default class Install extends ExecRenderBaseCommand<
+  typeof Install,
+  Result
+> {
+  static summary = "Install a template into an existing container stack";
+  static description = `\
+Adds the services and volumes of a container template to a stack that already exists, instead of creating a new stack for it.
+
+This is intended for templates of type "component"; use "<%= config.bin %> stack create --from-template" to create a new stack from a standalone template.
+
+Template user inputs can be supplied non-interactively with one or more --input flags in 'name=value' format; any required inputs that are neither provided nor have a default value are prompted for interactively.`;
+
+  static examples = [
+    {
+      description: "Install a template into the stack from the current context",
+      command: "<%= config.bin %> <%= command.id %> <template-id>",
+    },
+    {
+      description: "Install a template into a specific stack, with inputs",
+      command:
+        "<%= config.bin %> <%= command.id %> <template-id> --stack-id <stack-id> --input DB_NAME=mydb",
+    },
+  ];
+
+  static args = {
+    "template-id": Args.string({
+      description: "ID of the container template to install",
+      required: true,
+    }),
+  };
+
+  static flags = {
+    ...stackFlags,
+    ...processFlags,
+    input: Flags.string({
+      summary: "user input for the template, in 'name=value' format",
+      description:
+        "May be repeated to provide multiple inputs. Required inputs that are not provided (and have no default) are prompted for interactively.",
+      multiple: true,
+    }),
+  };
+
+  protected async exec(): Promise<Result> {
+    const process = makeProcessRenderer(
+      this.flags,
+      "Installing template into container stack",
+    );
+    const stackId = await this.withStackId(Install);
+    const templateId = this.args["template-id"];
+
+    const template = await process.runStep(
+      "retrieving container template",
+      async () => {
+        const r = await this.apiClient.container.getTemplate({ templateId });
+        assertStatus(r, 200);
+        return r.data;
+      },
+    );
+
+    if (template.type !== "component") {
+      process.addInfo(
+        `template '${templateId}' is of type '${template.type}'; installing it into an existing stack may not be supported. Consider "${this.config.bin} stack create --from-template" instead.`,
+      );
+    }
+
+    const providedInputs = parseEnvironmentVariablesFromArray(this.flags.input);
+    const userInputs = await collectTemplateUserInputs(
+      template.userInputs ?? [],
+      providedInputs,
+      process,
+    );
+
+    await process.runStep("installing template into stack", async () => {
+      const r = await this.apiClient.container.addTemplateComponent({
+        stackId,
+        data: {
+          templateConfig: {
+            templateId,
+            userInputs,
+          },
+        },
+      });
+      assertSuccess(r);
+    });
+
+    await process.complete(
+      <Success>
+        The template <Value>{template.name.en}</Value> was successfully
+        installed into stack <Value>{stackId}</Value>.
+      </Success>,
+    );
+
+    return { stackId, templateId };
+  }
+
+  protected render({ stackId }: Result): ReactNode {
+    if (this.flags.quiet) {
+      return stackId;
+    }
+  }
+}
diff --git a/src/commands/stack/template/list.ts b/src/commands/stack/template/list.ts
new file mode 100644
index 000000000..3857b785c
--- /dev/null
+++ b/src/commands/stack/template/list.ts
@@ -0,0 +1,71 @@
+import { Response, Simplify } from "@mittwald/api-client-commons";
+import { assertStatus, type MittwaldAPIV2 } from "@mittwald/api-client";
+import { ListBaseCommand } from "../../../lib/basecommands/ListBaseCommand.js";
+import { ListColumns } from "../../../rendering/formatter/Table.js";
+import { Flags } from "@oclif/core";
+
+type Template = MittwaldAPIV2.Components.Schemas.ContainerTemplate;
+type TemplateType = Template["type"];
+
+type ListResponse = Response<Template[]>;
+type ListItem = Simplify<Template>;
+
+export class List extends ListBaseCommand<typeof List, ListItem, ListResponse> {
+  static description =
+    "List container templates that stacks can be created from.";
+  static aliases = ["stack:template:ls"];
+
+  static examples = [
+    {
+      description: "List all templates of a given category",
+      command: "<%= config.bin %> <%= command.id %> --category cms",
+    },
+    {
+      description: "List only standalone templates",
+      command: "<%= config.bin %> <%= command.id %> --type standalone",
+    },
+  ];
+
+  static args = {};
+  static flags = {
+    ...ListBaseCommand.baseFlags,
+    category: Flags.string({
+      summary: "only list templates belonging to the given category",
+    }),
+    type: Flags.custom<TemplateType>({
+      summary: "only list templates of the given type",
+      options: ["component", "standalone"],
+    })(),
+  };
+
+  public async getData(): Promise<ListResponse> {
+    const { category, type } = this.flags;
+    const response = await this.apiClient.container.listTemplates({
+      queryParameters: { category, type },
+    });
+
+    assertStatus(response, 200);
+    return response;
+  }
+
+  protected getColumns(): ListColumns<ListItem> {
+    return {
+      id: {
+        header: "ID",
+      },
+      name: {
+        get(template) {
+          return template.name.en;
+        },
+      },
+      type: {},
+      version: {},
+      developer: {},
+      categories: {
+        get(template) {
+          return template.categories.join(", ");
+        },
+      },
+    };
+  }
+}
diff --git a/src/commands/volume/create.tsx b/src/commands/volume/create.tsx
index 79b1fa1ec..fce5e705c 100644
--- a/src/commands/volume/create.tsx
+++ b/src/commands/volume/create.tsx
@@ -9,6 +9,10 @@ import { assertStatus } from "@mittwald/api-client-commons";
 import { Success } from "../../rendering/react/components/Success.js";
 import { Value } from "../../rendering/react/components/Value.js";
 import { projectFlags } from "../../lib/resources/project/flags.js";
+import {
+  optionalStackFlags,
+  withStackIdOrDefault,
+} from "../../lib/resources/stack/flags.js";
 
 type Result = {
   volumeName: string;
@@ -18,10 +22,11 @@ type Result = {
 export class Create extends ExecRenderBaseCommand<typeof Create, Result> {
   static summary = "Create a new volume";
   static description =
-    "Creates a new named volume in the project stack. The volume will be available for use by containers.";
+    "Creates a new named volume in a container stack. The volume will be available for use by containers of that stack.";
 
   static flags = {
     ...projectFlags,
+    ...optionalStackFlags,
     ...processFlags,
   };
 
@@ -35,7 +40,12 @@ export class Create extends ExecRenderBaseCommand<typeof Create, Result> {
   protected async exec(): Promise<Result> {
     const process = makeProcessRenderer(this.flags, "Creating a new volume");
     const projectId = await this.withProjectId(Create);
-    const stackId = projectId; // In mStudio, project and stack are the same for volumes
+    const stackId = await withStackIdOrDefault(
+      this.apiClient,
+      this.flags,
+      projectId,
+      this.config,
+    );
     const { name: volumeName } = this.args;
 
     // Get current stack state
diff --git a/src/commands/volume/delete.tsx b/src/commands/volume/delete.tsx
index da37e1747..c85fb1310 100644
--- a/src/commands/volume/delete.tsx
+++ b/src/commands/volume/delete.tsx
@@ -9,6 +9,10 @@ import { assertStatus } from "@mittwald/api-client-commons";
 import { Success } from "../../rendering/react/components/Success.js";
 import { Value } from "../../rendering/react/components/Value.js";
 import { projectFlags } from "../../lib/resources/project/flags.js";
+import {
+  optionalStackFlags,
+  withStackIdOrDefault,
+} from "../../lib/resources/stack/flags.js";
 
 type Result = {
   volumeName: string;
@@ -17,12 +21,13 @@ type Result = {
 export class Delete extends ExecRenderBaseCommand<typeof Delete, Result> {
   static summary = "Remove one or more volumes";
   static description =
-    "Removes named volumes from the project stack. Be careful as this will permanently delete the volume data.";
+    "Removes named volumes from a container stack. Be careful as this will permanently delete the volume data.";
 
   static aliases = ["volume:rm"];
 
   static flags = {
     ...projectFlags,
+    ...optionalStackFlags,
     ...processFlags,
     force: Flags.boolean({
       summary: "force removal without confirmation",
@@ -41,7 +46,12 @@ export class Delete extends ExecRenderBaseCommand<typeof Delete, Result> {
   protected async exec(): Promise<Result> {
     const process = makeProcessRenderer(this.flags, "Removing volume");
     const projectId = await this.withProjectId(Delete);
-    const stackId = projectId; // In mStudio, project and stack are the same for volumes
+    const stackId = await withStackIdOrDefault(
+      this.apiClient,
+      this.flags,
+      projectId,
+      this.config,
+    );
     const { name: volumeName } = this.args;
 
     // Get current stack state
diff --git a/src/lib/resources/stack/flags.ts b/src/lib/resources/stack/flags.ts
index 528ed783a..9328c0878 100644
--- a/src/lib/resources/stack/flags.ts
+++ b/src/lib/resources/stack/flags.ts
@@ -1,5 +1,20 @@
 import FlagSetBuilder from "../../context/FlagSetBuilder.js";
-import { assertStatus } from "@mittwald/api-client";
+import { assertStatus, MittwaldAPIV2Client } from "@mittwald/api-client";
+import { Config, Flags } from "@oclif/core";
+import Context from "../../context/Context.js";
+
+/**
+ * Stack selection for commands that operate on a project's default stack unless
+ * told otherwise. Resolve these with `withStackIdOrDefault`.
+ */
+export const optionalStackFlags = {
+  "stack-id": Flags.string({
+    char: "s",
+    summary: "ID of the stack to operate on",
+    description:
+      "If omitted, the stack set in the CLI context is used; when that is not set either, the project's default stack is used.",
+  }),
+};
 
 export const {
   flags: stackFlags,
@@ -23,3 +38,31 @@ export const {
     return null;
   },
 }).build();
+
+/**
+ * Resolves the stack that a project-scoped command should operate on.
+ *
+ * Unlike `withStackId`, this does not fail when no stack can be determined; it
+ * falls back to the project's default stack (whose ID is identical to the
+ * project ID). This keeps commands that used to be hard-wired to the default
+ * stack working as before, while allowing any other stack to be addressed
+ * explicitly.
+ */
+export async function withStackIdOrDefault(
+  apiClient: MittwaldAPIV2Client,
+  flags: { [k: string]: unknown },
+  projectId: string,
+  cfg: Config,
+): Promise<string> {
+  const fromFlags = flags["stack-id"];
+  if (typeof fromFlags === "string") {
+    return fromFlags;
+  }
+
+  const fromContext = await new Context(apiClient, cfg).stackId();
+  if (fromContext) {
+    return fromContext.value;
+  }
+
+  return projectId;
+}
diff --git a/src/lib/resources/stack/template-inputs.test.ts b/src/lib/resources/stack/template-inputs.test.ts
new file mode 100644
index 000000000..414cdeea5
--- /dev/null
+++ b/src/lib/resources/stack/template-inputs.test.ts
@@ -0,0 +1,170 @@
+import { describe, it, expect, jest } from "@jest/globals";
+import {
+  collectTemplateUserInputs,
+  isSensitiveInput,
+} from "./template-inputs.js";
+import type { MittwaldAPIV2 } from "@mittwald/api-client";
+import { ProcessRenderer } from "../../../rendering/process/process.js";
+
+type TemplateUserInputDefinition = NonNullable<
+  MittwaldAPIV2.Components.Schemas.ContainerTemplate["userInputs"]
+>[number];
+
+function makeRenderer(inputAnswers: string[] = []): {
+  renderer: ProcessRenderer;
+  addInput: jest.Mock;
+  addInfo: jest.Mock;
+} {
+  const answers = [...inputAnswers];
+  const addInput = jest.fn(() => Promise.resolve(answers.shift() ?? ""));
+  const addInfo = jest.fn();
+  const renderer = { addInput, addInfo } as unknown as ProcessRenderer;
+  return { renderer, addInput, addInfo };
+}
+
+describe("collectTemplateUserInputs", () => {
+  it("uses provided values over defaults and prompts", async () => {
+    const definitions: TemplateUserInputDefinition[] = [
+      { name: "DOMAIN", required: true, defaultValue: "example.org" },
+    ];
+    const { renderer, addInput } = makeRenderer();
+
+    const result = await collectTemplateUserInputs(
+      definitions,
+      { DOMAIN: "example.com" },
+      renderer,
+    );
+
+    expect(result).toEqual([{ name: "DOMAIN", value: "example.com" }]);
+    expect(addInput).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the default value for required inputs", async () => {
+    const definitions: TemplateUserInputDefinition[] = [
+      { name: "PORT", required: true, defaultValue: "8080" },
+    ];
+    const { renderer, addInput } = makeRenderer();
+
+    const result = await collectTemplateUserInputs(definitions, {}, renderer);
+
+    expect(result).toEqual([{ name: "PORT", value: "8080" }]);
+    expect(addInput).not.toHaveBeenCalled();
+  });
+
+  it("prompts for required inputs without a value or default", async () => {
+    const definitions: TemplateUserInputDefinition[] = [
+      {
+        name: "ADMIN_EMAIL",
+        required: true,
+        label: { en: "Admin e-mail", de: "Admin-E-Mail" },
+      },
+    ];
+    const { renderer, addInput } = makeRenderer(["admin@example.com"]);
+
+    const result = await collectTemplateUserInputs(definitions, {}, renderer);
+
+    expect(result).toEqual([
+      { name: "ADMIN_EMAIL", value: "admin@example.com" },
+    ]);
+    expect(addInput).toHaveBeenCalledTimes(1);
+    expect(addInput).toHaveBeenCalledWith(expect.any(String), false);
+  });
+
+  it("masks the prompt for inputs with a password validation schema", async () => {
+    const definitions: TemplateUserInputDefinition[] = [
+      {
+        name: "ADMIN_PASSWORD",
+        required: true,
+        validationSchema: JSON.stringify({
+          type: "string",
+          format: "password",
+        }),
+      },
+      {
+        name: "ADMIN_EMAIL",
+        required: true,
+        validationSchema: JSON.stringify({
+          type: "string",
+          format: "email",
+        }),
+      },
+    ];
+    const { renderer, addInput } = makeRenderer(["s3cret", "a@example.com"]);
+
+    await collectTemplateUserInputs(definitions, {}, renderer);
+
+    expect(addInput).toHaveBeenNthCalledWith(
+      1,
+      expect.stringContaining("ADMIN_PASSWORD"),
+      true,
+    );
+    expect(addInput).toHaveBeenNthCalledWith(
+      2,
+      expect.stringContaining("ADMIN_EMAIL"),
+      false,
+    );
+  });
+
+  it("omits optional inputs without a provided value", async () => {
+    const definitions: TemplateUserInputDefinition[] = [
+      { name: "OPTIONAL", required: false, defaultValue: "from-template" },
+    ];
+    const { renderer } = makeRenderer();
+
+    const result = await collectTemplateUserInputs(definitions, {}, renderer);
+
+    expect(result).toEqual([]);
+  });
+
+  it("warns about inputs that are not defined by the template", async () => {
+    const definitions: TemplateUserInputDefinition[] = [
+      { name: "KNOWN", required: false },
+    ];
+    const { renderer, addInfo } = makeRenderer();
+
+    await collectTemplateUserInputs(
+      definitions,
+      { KNOWN: "a", UNKNOWN: "b" },
+      renderer,
+    );
+
+    expect(addInfo).toHaveBeenCalledTimes(1);
+    expect(addInfo).toHaveBeenCalledWith(expect.stringContaining("UNKNOWN"));
+  });
+});
+
+describe("isSensitiveInput", () => {
+  it("detects a password format", () => {
+    expect(
+      isSensitiveInput({
+        name: "PASSWORD",
+        required: true,
+        validationSchema: '{"type":"string","format":"password"}',
+      }),
+    ).toBe(true);
+  });
+
+  it("does not treat other formats as sensitive", () => {
+    expect(
+      isSensitiveInput({
+        name: "EMAIL",
+        required: true,
+        validationSchema: '{"type":"string","format":"email"}',
+      }),
+    ).toBe(false);
+  });
+
+  it("is not sensitive without a validation schema", () => {
+    expect(isSensitiveInput({ name: "PASSWORD", required: true })).toBe(false);
+  });
+
+  it("tolerates a malformed validation schema", () => {
+    expect(
+      isSensitiveInput({
+        name: "PASSWORD",
+        required: true,
+        validationSchema: "not json",
+      }),
+    ).toBe(false);
+  });
+});
diff --git a/src/lib/resources/stack/template-inputs.ts b/src/lib/resources/stack/template-inputs.ts
new file mode 100644
index 000000000..cac4a2437
--- /dev/null
+++ b/src/lib/resources/stack/template-inputs.ts
@@ -0,0 +1,96 @@
+import type { MittwaldAPIV2 } from "@mittwald/api-client";
+import { ProcessRenderer } from "../../../rendering/process/process.js";
+
+type ContainerTemplate = MittwaldAPIV2.Components.Schemas.ContainerTemplate;
+type TemplateUserInputDefinition = NonNullable<
+  ContainerTemplate["userInputs"]
+>[number];
+
+export interface TemplateUserInput {
+  name: string;
+  value: string;
+}
+
+/**
+ * Determines whether an input holds a sensitive value, and should therefore be
+ * masked when prompting for it. Templates mark these inputs with a validation
+ * schema of format "password".
+ */
+export function isSensitiveInput(
+  definition: TemplateUserInputDefinition,
+): boolean {
+  const { validationSchema } = definition;
+  if (!validationSchema) {
+    return false;
+  }
+
+  try {
+    const parsed: unknown = JSON.parse(validationSchema);
+    return (
+      typeof parsed === "object" &&
+      parsed !== null &&
+      "format" in parsed &&
+      parsed.format === "password"
+    );
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Resolves the concrete user inputs that should be sent to the API when
+ * creating a stack from a template.
+ *
+ * Values are resolved in the following order of precedence:
+ *
+ * 1. Values explicitly provided by the user (e.g. via `--input name=value`).
+ * 2. For required inputs without a provided value: the template's default value
+ *    (if present) or an interactive prompt.
+ *
+ * Optional inputs without a provided value are omitted entirely; the API fills
+ * them from the template defaults.
+ */
+export async function collectTemplateUserInputs(
+  definitions: TemplateUserInputDefinition[],
+  providedInputs: Record<string, string>,
+  renderer: ProcessRenderer,
+): Promise<TemplateUserInput[]> {
+  const knownNames = new Set(definitions.map((d) => d.name));
+  for (const name of Object.keys(providedInputs)) {
+    if (!knownNames.has(name)) {
+      renderer.addInfo(
+        `ignoring input '${name}', which is not defined by the template`,
+      );
+    }
+  }
+
+  const result: TemplateUserInput[] = [];
+
+  for (const definition of definitions) {
+    const providedValue = providedInputs[definition.name];
+    if (providedValue !== undefined) {
+      result.push({ name: definition.name, value: providedValue });
+      continue;
+    }
+
+    // Optional inputs are filled from template defaults by the API.
+    if (!definition.required) {
+      continue;
+    }
+
+    if (definition.defaultValue !== undefined) {
+      result.push({ name: definition.name, value: definition.defaultValue });
+      continue;
+    }
+
+    const label = definition.label?.en;
+    const suffix = label ? ` (${label})` : "";
+    const value = await renderer.addInput(
+      `enter value for required template input '${definition.name}'${suffix}`,
+      isSensitiveInput(definition),
+    );
+    result.push({ name: definition.name, value });
+  }
+
+  return result;
+}