diff --git a/.gitignore b/.gitignore
index ee2b291..818fecd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 node_modules/
 dist/
+dist-bundle/
 .env
 data/
 
diff --git a/INTEGRATION.md b/INTEGRATION.md
index cbabf3f..6fe53f5 100644
--- a/INTEGRATION.md
+++ b/INTEGRATION.md
@@ -31,6 +31,42 @@ A deploy identity should almost always be granted **read-only** access
 needs to `pull`, and a read-only grant means a compromised deploy box
 can't also rotate the vault or add itself more recipients.
 
+## Getting the `keep` CLI onto a machine
+
+Chicken-and-egg: every pattern below assumes `keep` is already a runnable
+command on the machine doing the pulling. Two ways to get there, pick
+based on whether you're fine with a git checkout existing on that
+machine:
+
+**A machine you're already developing on, or don't mind cloning onto**
+(your laptop, a VPS you administer directly):
+
+```bash
+git clone <this repo>
+cd keep
+npm install
+./scripts/install-cli.sh   # builds, symlinks dist/cli/index.js onto PATH as `keep`
+```
+
+Symlinked rather than copied — a future `git pull && npm run build` is
+the entire upgrade story, no need to re-run the install script.
+
+**A deploy target you'd rather not clone a git repo onto** — bundle the
+CLI into a single portable file and ship just that, over SSH, the same
+way flit/waste-go's `deploy-*.sh` scripts ship a compiled binary:
+
+```bash
+HOST=user@your-vps ./deploy-cli.sh
+```
+
+This bundles `src/cli` (esbuild, single file, ~18kb — the CLI only
+touches Node builtins and libsodium-wrappers, no native addons, so it's
+fully portable) and `cat`s it straight to `~/bin/keep` on the target over
+SSH — no git, no npm install, no node_modules on that machine at all,
+just a `node` runtime (already there, if it's running any of the other
+Node-based projects in this family) and the one file. Re-run it any time
+the CLI changes; it's a single file, safe to overwrite.
+
 ## Pattern: several docker-compose projects on one or more VPSes
 
 The common shape once more than one or two projects are on `keep`:
diff --git a/deploy-cli.sh b/deploy-cli.sh
new file mode 100755
index 0000000..2138a25
--- /dev/null
+++ b/deploy-cli.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# deploy-cli.sh — bundle the keep CLI into a single portable file and ship
+# it straight to a host over SSH. No git clone, no npm install on the
+# target — the bundle only touches Node builtins and libsodium-wrappers
+# (pure JS/WASM, no native compilation), so the file itself is the whole
+# artifact. Mirrors flit/deploy-daemon.sh's ssh-cat-chmod pattern.
+#
+# Usage: HOST=user@host ./deploy-cli.sh
+set -euo pipefail
+
+HOST="${HOST:?usage: HOST=user@host ./deploy-cli.sh}"
+BIN_DIR="${BIN_DIR:-~/bin}"
+
+echo "→ bundling keep CLI…"
+npm run build:cli-bundle
+
+echo "→ uploading to $HOST:$BIN_DIR/keep…"
+ssh "$HOST" "mkdir -p $BIN_DIR && cat > $BIN_DIR/keep && chmod +x $BIN_DIR/keep" < dist-bundle/keep
+
+echo "→ verifying…"
+ssh "$HOST" "$BIN_DIR/keep --help" | head -1
+
+echo "✓ done — re-run this script any time the CLI changes; it's one file, safe to overwrite."
diff --git a/package-lock.json b/package-lock.json
index 92b16a0..476465f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -21,6 +21,7 @@
         "@types/express": "^4.17.21",
         "@types/libsodium-wrappers": "^0.7.14",
         "@types/node": "^22.0.0",
+        "esbuild": "^0.28.1",
         "tsx": "^4.15.0",
         "typescript": "^5.5.0"
       }
diff --git a/package.json b/package.json
index 8180032..e5109ef 100644
--- a/package.json
+++ b/package.json
@@ -10,18 +10,20 @@
     "dev:server": "tsx watch --env-file=.env src/server/index.ts",
     "cli": "tsx src/cli/index.ts",
     "build": "tsc",
+    "build:cli-bundle": "esbuild src/cli/index.ts --bundle --platform=node --format=esm --outfile=dist-bundle/keep --external:node:*",
     "start": "node --env-file=.env dist/server/index.js"
   },
   "dependencies": {
-    "express": "^4.19.2",
     "better-sqlite3": "^11.3.0",
+    "express": "^4.19.2",
     "libsodium-wrappers": "^0.7.15"
   },
   "devDependencies": {
-    "@types/express": "^4.17.21",
-    "@types/node": "^22.0.0",
     "@types/better-sqlite3": "^7.6.11",
+    "@types/express": "^4.17.21",
     "@types/libsodium-wrappers": "^0.7.14",
+    "@types/node": "^22.0.0",
+    "esbuild": "^0.28.1",
     "tsx": "^4.15.0",
     "typescript": "^5.5.0"
   }