diff --git a/packaging/finish-tanin-repo.sh b/packaging/finish-tanin-repo.sh
new file mode 100755
index 0000000..b48336b
--- /dev/null
+++ b/packaging/finish-tanin-repo.sh
@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Complete the [tanin] repo — the steps that need sudo + network:
+#   1) build taninux (installs its python build deps)
+#   2) rebuild the AUR-only deps into the repo: eww, tiramisu, waypaper
+#      (cliphist + cage are in extra -> not rebuilt)
+#   3) refresh the DB
+# Run as YOUR user (NOT root); it will sudo where needed:
+#   ./finish-tanin-repo.sh
+set -uo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+OUT="${TANIN_REPO_DIR:-$HOME/projects/tanin-repo}"
+mkdir -p "$OUT"
+
+echo "==> taninux (+ build deps)"
+sudo pacman -S --needed --noconfirm python-build python-installer python-hatchling
+( cd "$HERE/taninux" && makepkg -sf --noconfirm ) \
+  && cp "$HERE/taninux/"*.pkg.tar.zst "$OUT/" && echo "   ok" || echo "   FAILED (taninux)"
+
+echo "==> AUR rebuilds: eww tiramisu waypaper"
+tmp="$(mktemp -d)"
+for p in eww tiramisu waypaper; do
+  echo "  -- $p"
+  if git clone --depth=1 "https://aur.archlinux.org/$p.git" "$tmp/$p" >/dev/null 2>&1 \
+     && ( cd "$tmp/$p" && makepkg -sf --noconfirm ); then
+    cp "$tmp/$p/"*.pkg.tar.zst "$OUT/" && echo "     ok"
+  else
+    echo "     FAILED ($p)"
+  fi
+done
+rm -rf "$tmp"
+
+echo "==> refresh DB"
+( cd "$OUT" && repo-add -q "$OUT/tanin.db.tar.zst" "$OUT"/*.pkg.tar.zst )
+echo "== [tanin] now contains =="
+ls -1 "$OUT" | grep -E '\.pkg\.tar\.zst$|tanin\.db$'
+echo
+echo "Next: host it. Gitea (1.26) has an Arch registry on git.openbureau.ch —"
+echo "Claude can upload these with the existing token, or use a static dir behind taninux.kgva.ch."