diff --git a/scripts/build.sh b/scripts/build.sh
new file mode 100755
index 0000000..a5133e3
--- /dev/null
+++ b/scripts/build.sh
@@ -0,0 +1,125 @@
+#!/bin/sh
+# build.sh -- single entry point for ISO builds.
+#
+# Local build (default):
+#   sh scripts/build.sh
+#   sh scripts/build.sh --variant nvidia
+#   sh scripts/build.sh --clean-build
+#
+# Remote build (set BUILDER_HOST + BUILDER_USER in .env):
+#   sh scripts/build.sh
+#   sh scripts/build.sh --authorized-keys ~/.ssh/authorized_keys
+#
+# All flags are forwarded to build-in-container.sh.
+
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
+
+ENV_FILE="${REPO_ROOT}/.env"
+if [ -f "$ENV_FILE" ]; then
+    # shellcheck disable=SC1090
+    . "$ENV_FILE"
+fi
+
+BUILDER_HOST="${BUILDER_HOST:-}"
+BUILDER_USER="${BUILDER_USER:-}"
+
+# Cache lives inside the repo under dist/ (gitignored).
+CACHE_DIR="${REPO_ROOT}/dist/container-cache"
+
+# Forward all arguments as-is to the underlying build script.
+EXTRA_ARGS="$*"
+
+# ── Remote build ────────────────────────────────────────────────────────────
+if [ -n "$BUILDER_HOST" ]; then
+    if [ -z "$BUILDER_USER" ]; then
+        echo "ERROR: BUILDER_USER not set. Set it in .env."
+        exit 1
+    fi
+
+    echo "=== bee builder (remote: ${BUILDER_USER}@${BUILDER_HOST}) ==="
+    echo ""
+
+    cd "${REPO_ROOT}"
+    git fetch --quiet origin main
+    LOCAL=$(git rev-parse HEAD)
+    REMOTE=$(git rev-parse origin/main)
+    if [ "$LOCAL" != "$REMOTE" ]; then
+        echo "ERROR: local repo is not in sync with remote."
+        echo "  local:  $LOCAL"
+        echo "  remote: $REMOTE"
+        echo ""
+        echo "Push or pull before building:"
+        echo "  git push   -- if you have unpushed commits"
+        echo "  git pull   -- if remote is ahead"
+        exit 1
+    fi
+    echo "repo: in sync with remote ($LOCAL)"
+    echo ""
+
+    ssh -o StrictHostKeyChecking=no "${BUILDER_USER}@${BUILDER_HOST}" /bin/sh <<ENDSSH
+set -e
+REPO="/home/${BUILDER_USER}/bee"
+LOG=/tmp/bee-build.log
+
+if [ ! -d "\$REPO/.git" ]; then
+    echo "--- cloning bee repo ---"
+    git clone https://git.mchus.pro/reanimator/bee.git "\$REPO"
+fi
+
+cd "\$REPO"
+echo "--- pulling latest ---"
+sudo git checkout -- .
+git pull --ff-only
+chmod +x iso/overlay/usr/local/bin/* 2>/dev/null || true
+
+screen -S bee-build -X quit 2>/dev/null || true
+
+echo "--- starting build in screen session (survives SSH disconnect) ---"
+echo "--- log: \$LOG ---"
+screen -dmS bee-build sh -c "sh iso/builder/build-in-container.sh --cache-dir \$REPO/dist/container-cache ${EXTRA_ARGS} > \$LOG 2>&1; echo \$? > /tmp/bee-build-exit"
+
+echo "--- streaming build log (Ctrl+C safe -- build continues on VM) ---"
+tail -n +1 -f "\$LOG" 2>/dev/null &
+TAIL_PID=\$!
+while screen -list 2>/dev/null | grep -q bee-build; do
+    sleep 2
+done
+sleep 1
+kill \$TAIL_PID 2>/dev/null || true
+
+tail -n 20 "\$LOG" 2>/dev/null || true
+
+EXIT_CODE=\$(cat /tmp/bee-build-exit 2>/dev/null || echo 1)
+exit \$EXIT_CODE
+ENDSSH
+
+    echo ""
+    echo "=== downloading ISO ==="
+    LOCAL_ISO_DIR="${REPO_ROOT}/iso/out"
+    mkdir -p "${LOCAL_ISO_DIR}"
+    if command -v rsync >/dev/null 2>&1 && ssh -o StrictHostKeyChecking=no "${BUILDER_USER}@${BUILDER_HOST}" command -v rsync >/dev/null 2>&1; then
+        rsync -az --progress \
+            -e "ssh -o StrictHostKeyChecking=no" \
+            "${BUILDER_USER}@${BUILDER_HOST}:/home/${BUILDER_USER}/bee/dist/*.iso" \
+            "${LOCAL_ISO_DIR}/"
+    else
+        scp -o StrictHostKeyChecking=no \
+            "${BUILDER_USER}@${BUILDER_HOST}:/home/${BUILDER_USER}/bee/dist/*.iso" \
+            "${LOCAL_ISO_DIR}/"
+    fi
+    echo ""
+    echo "=== build complete ==="
+    echo "ISO saved to: ${LOCAL_ISO_DIR}/"
+    ls -lh "${LOCAL_ISO_DIR}/"*.iso 2>/dev/null || true
+    exit 0
+fi
+
+# ── Local build ─────────────────────────────────────────────────────────────
+echo "=== bee builder (local) ==="
+echo "cache: ${CACHE_DIR}"
+echo ""
+# shellcheck disable=SC2086
+exec sh "${REPO_ROOT}/iso/builder/build-in-container.sh" --cache-dir "${CACHE_DIR}" $EXTRA_ARGS