diff --git a/deploy/README.md b/deploy/README.md
index 62995c6..b82741e 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -136,6 +136,17 @@ Push multi-arch images to the Gitea registry:
 They tag `:latest` and `:<commit-sha>` and expect `docker login
 gitea.rainbow-herring.ts.net` to succeed.
 
+Build the desktop installers without publishing anything:
+
+```bash
+./build_desktop.sh           # Arch + Debian + Windows -> desktop/release/
+./build_desktop.sh --linux   # Arch + Debian only
+./build_desktop.sh --win     # Windows installer only
+```
+
+Hand the files out or attach them to a Gitea release manually — the script
+prints sizes and SHA-256 sums for the release notes.
+
 Push the desktop builds and their update metadata to the frontend's feed:
 
 ```bash
diff --git a/deploy/build_desktop.sh b/deploy/build_desktop.sh
new file mode 100755
index 0000000..ebb9f65
--- /dev/null
+++ b/deploy/build_desktop.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+# Build the J621 desktop packages into desktop/release/ — Arch (.pkg.tar.zst),
+# Debian (.deb) and the Windows NSIS installer. Nothing is published: install
+# the package locally, hand the files out, or attach them to a Gitea release
+# manually. Use push_desktop.sh when the in-app update feed should get them.
+#
+# Usage: ./build_desktop.sh [--linux | --win | --all]
+#   --linux   Arch + Debian packages only
+#   --win     Windows installer only (cross-built with wine)
+#   --all     everything (default)
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+TARGET="${1:---all}"
+case "$TARGET" in
+    --linux) TARGET=linux ;;
+    --win) TARGET=win ;;
+    --all) TARGET=all ;;
+    *)
+        echo "usage: $0 [--linux|--win|--all]" >&2
+        exit 2
+        ;;
+esac
+
+if [ ! -d desktop/node_modules ]; then
+    echo "==> Installing desktop dependencies ..."
+    npm --prefix desktop ci --no-audit --no-fund
+fi
+
+if [ "$TARGET" != "linux" ] && ! command -v wine >/dev/null 2>&1; then
+    echo "==> wine is not installed; the Windows installer needs it." >&2
+    exit 1
+fi
+
+case "$TARGET" in
+    linux) npm --prefix desktop run dist:linux ;;
+    win) npm --prefix desktop run dist:win ;;
+    all) npm --prefix desktop run dist:all ;;
+esac
+
+VERSION="$(node -p "require('./desktop/package.json').version")"
+
+case "$TARGET" in
+    linux) ARTIFACTS=(-name "*.deb" -o -name "*.pkg.tar.zst") ;;
+    win) ARTIFACTS=(-name "*.exe") ;;
+    all) ARTIFACTS=(-name "*.deb" -o -name "*.pkg.tar.zst" -o -name "*.exe") ;;
+esac
+
+echo
+echo "==> Artifacts in desktop/release/:"
+find desktop/release -maxdepth 1 -type f \( "${ARTIFACTS[@]}" \) \
+    -printf '%s\t%p\n' |
+    sort -rn |
+    while IFS=$'\t' read -r size file; do
+        printf '    %8s  %s\n' "$(numfmt --to=iec "$size")" "$file"
+    done
+
+echo
+echo "==> SHA-256 (for release notes):"
+find desktop/release -maxdepth 1 -type f \( "${ARTIFACTS[@]}" \) \
+    -exec sha256sum {} + | sed 's/^/    /'
+
+echo
+echo "==> J621 desktop $VERSION built."
+echo "    Install here:        sudo pacman -U desktop/release/j621-desktop-*.pkg.tar.zst"
+echo "    Gitea release tag:   desktop-v$VERSION"
diff --git a/desktop/README.md b/desktop/README.md
index 59576d1..7aac79d 100644
--- a/desktop/README.md
+++ b/desktop/README.md
@@ -42,6 +42,10 @@ npm run dist:win     # release/J621 Setup 0.1.0.exe (cross-built with wine; unte
 npm run dist:all
 ```
 
+`deploy/build_desktop.sh` wraps the same commands, installs dependencies on
+first run and prints sizes plus SHA-256 sums for release notes. Nothing is
+published by it; `deploy/push_desktop.sh` is the one that feeds auto-updates.
+
 The Arch package can be installed and removed with pacman:
 
 ```bash