diff --git a/scripts/build.sh b/scripts/build.sh
index 2f3c0a2..8c335f1 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -1,6 +1,13 @@
 #!/usr/bin/env bash
+# Build the hsa binary into the repo root.
+#
+# CGO_ENABLED=0 makes a fully static binary (the SQLite driver is pure Go, so no
+# C toolchain is needed): it runs on any linux/<arch> — glibc or musl/Alpine,
+# scratch containers, etc. — with no shared-library dependencies.
+# Cross-compile for another arch by setting GOARCH, e.g.:
+#   GOARCH=arm64 ./scripts/build.sh
 set -euo pipefail
 cd "$(dirname "$0")/.."
 source scripts/go-env.sh
-go build -o hsa ./cmd/hsa
-echo "Built ./hsa"
+CGO_ENABLED=0 go build -ldflags "-s -w" -o hsa ./cmd/hsa
+echo "Built ./hsa ($(go env GOOS)/$(go env GOARCH), static)"
diff --git a/scripts/hsa-app.sh b/scripts/hsa-app.sh
new file mode 100755
index 0000000..6c2d2a3
--- /dev/null
+++ b/scripts/hsa-app.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Launch the hsa-app binary with its environment loaded from an env file.
+#
+# Usage:
+#   hsa-app.sh [ENV_FILE]
+#
+# ENV_FILE resolves to, in order: the first argument, then $HSA_ENV_FILE, then
+# /etc/hsa-app/hsa-app.env. The binary defaults to ./hsa next to this script;
+# override with $HSA_BIN (e.g. HSA_BIN=/usr/local/bin/hsa).
+#
+# Designed as a systemd ExecStart: it exports every KEY=VALUE in the env file and
+# then exec's the binary, so the binary becomes the unit's main process (signals
+# and exit codes propagate correctly). The env file should use ABSOLUTE paths for
+# DB_PATH / STORAGE_DIR / BACKUP_DIR / CONFIG_PATH, since the app resolves relative
+# paths from the working directory.
+set -euo pipefail
+
+ENV_FILE="${1:-${HSA_ENV_FILE:-/etc/hsa-app/hsa-app.env}}"
+HERE="$(cd "$(dirname "$(readlink -f "$0")")" && pwd)"
+BIN="${HSA_BIN:-$HERE/hsa}"
+
+if [[ ! -r "$ENV_FILE" ]]; then
+  echo "hsa-app: env file not found or unreadable: $ENV_FILE" >&2
+  exit 1
+fi
+if [[ ! -x "$BIN" ]]; then
+  echo "hsa-app: binary not found or not executable: $BIN" >&2
+  exit 1
+fi
+
+# Export every assignment in the env file (KEY=VALUE lines; '#' comments and blank
+# lines are fine). set -a marks all subsequently-set vars for export.
+set -a
+# shellcheck disable=SC1090
+source "$ENV_FILE"
+set +a
+
+exec "$BIN"