diff --git a/dstack/kms/README.md b/dstack/kms/README.md
index f837488d9..49d15e618 100644
--- a/dstack/kms/README.md
+++ b/dstack/kms/README.md
@@ -103,7 +103,7 @@ certificate. `core.onboard.public_key_handover = true` (the default) keeps
 
 ### Deployment
 The first two components are deployed as an dstack app on dstack in Local-Key-Provider mode.
-The docker compose file would look like [this](dstack-app/docker-compose.yaml).
+See [`compose-dev.yaml`](dstack-app/compose-dev.yaml) for the compose file and [`deploy-to-vmm.sh`](dstack-app/deploy-to-vmm.sh) for how to deploy it.
 
 The solidity contracts are deployed on an ethereum compatible chain.
 
diff --git a/dstack/kms/dstack-app/docker-compose.yaml b/dstack/kms/dstack-app/docker-compose.yaml
deleted file mode 100644
index 4fb1b603f..000000000
--- a/dstack/kms/dstack-app/docker-compose.yaml
+++ /dev/null
@@ -1,85 +0,0 @@
-# SPDX-FileCopyrightText: © 2025 Phala Network <dstack@phala.network>
-#
-# SPDX-License-Identifier: Apache-2.0
-
-services:
-  # Helios is a Ethereum light client
-  helios:
-    build:
-      context: .
-      dockerfile_inline: |
-        FROM rust:1.92.0@sha256:48851a839d6a67370c9dbe0e709bedc138e3e404b161c5233aedcf2b717366e4
-        WORKDIR /app
-        RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/* build-base openssl-dev protobuf protobuf-dev perl
-        RUN git clone https://github.com/a16z/helios && \
-            cd helios && \
-            git checkout 5c61864a167c16141a9a12b976c0e9398b332f07
-        WORKDIR /app/helios
-        RUN cargo build --release
-    command: [
-      "./target/release/helios",
-      "ethereum",
-      "--network", "mainnet",
-      "--checkpoint", "0xbee4f32f91e62060d2aa41c652f6c69431829cfb09b02ea3cad92f65bd15dcce",
-      "--rpc-bind-ip", "0.0.0.0",
-      "--rpc-port", "8545",
-      "--consensus-rpc", "https://ethereum.operationsolarstorm.org",
-      "--execution-rpc", "https://ethereum-rpc.publicnode.com"
-    ]
-
-  # Auth API is a webhook server that authenticates KMS instances and Apps launches
-  auth-api:
-    build:
-      context: .
-      dockerfile_inline: |
-        FROM node:22.23.4-bookworm-slim@sha256:de170b39439eb0e5a3444ad7d60b015614a381e10fecae2e30ec9e735122f38d
-        WORKDIR /app
-
-        RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates && rm -rf /var/lib/apt/lists/*
-        RUN git clone https://github.com/Dstack-TEE/dstack.git && \
-            cd dstack && \
-            git checkout 78057c975fe4b9e21f557fb888d72eeecfb21178
-        WORKDIR /app/dstack/kms/auth-eth
-        RUN npm ci && npm run build
-        CMD node dist/main.js
-    environment:
-      - HOST=0.0.0.0
-      - PORT=8000
-      - ETH_RPC_URL=http://helios:8545
-      - KMS_CONTRACT_ADDR=0x515cd0dd984Adc75EE8625131FcC3d2D91f7F140
-    depends_on:
-      - helios
-
-  # KMS handles the TEE Remote Attestation
-  kms:
-    build:
-      context: .
-      dockerfile_inline: |
-        FROM rust:1.92.0@sha256:48851a839d6a67370c9dbe0e709bedc138e3e404b161c5233aedcf2b717366e4
-        WORKDIR /app
-        RUN apt-get update && apt-get install -y \
-            git \
-            build-essential \
-            libssl-dev \
-            protobuf-compiler \
-            libprotobuf-dev \
-            clang \
-            libclang-dev \
-            --no-install-recommends \
-            && rm -rf /var/lib/apt/lists/*
-        RUN git clone https://github.com/Dstack-TEE/dstack.git && \
-            cd dstack && \
-            git checkout 78057c975fe4b9e21f557fb888d72eeecfb21178
-        WORKDIR /app/dstack
-        RUN cargo build --release --locked -p dstack-kms
-        CMD ["./target/release/dstack-kms"]
-    volumes:
-      - kms-volume:/etc/kms
-      - /var/run/dstack.sock:/var/run/dstack.sock
-    ports:
-      - 8000:8000
-    depends_on:
-      - auth-api
-
-volumes:
-  kms-volume: