diff --git a/scripts/deploy b/scripts/deploy
index 23e8610..61eed07 100755
--- a/scripts/deploy
+++ b/scripts/deploy
@@ -10,6 +10,8 @@
 #   ./deploy switch  <config> <host>  rebuild + activate on a running host.
 #   ./deploy boot    <config> <host>  stage for next boot, don't activate now.
 #   ./deploy test    <config> <host>  activate without adding a boot entry.
+#   ./deploy image   <config>         build an SD-card image (e.g. rpi mercury).
+#   ./deploy flash   <config> <dev>   build the SD image + write it to <dev>.
 #
 # <config> = a nixosConfigurations name (e.g. jupiter, vps). Its pre-generated
 # SSH host key must be at ~/.config/homelab/<config>/ssh_host_ed25519_key.
@@ -93,6 +95,26 @@ case "$cmd" in
       --use-remote-sudo
     ;;
 
+  image|flash)
+    config="${2:-}"; [ -n "$config" ] || die "usage: ./deploy $cmd <config> [<dev>]"
+
+    echo ">> building SD image for .#$config (aarch64 needs qemu binfmt)"
+    nix build ".#nixosConfigurations.$config.config.system.build.sdImage" -o result-sd
+    img="$(ls result-sd/sd-image/*.img.zst | head -1)"
+    echo ">> image: $img"
+    [ "$cmd" = image ] && exit 0
+
+    dev="${3:-}"; [ -n "$dev" ] || die "usage: ./deploy flash <config> <dev>  (e.g. /dev/sdX)"
+    [ -b "$dev" ] || die "$dev is not a block device"
+    echo ">> TARGET DEVICE — everything on it will be ERASED:"
+    lsblk -o NAME,SIZE,MODEL,TRAN,MOUNTPOINTS "$dev"
+    read -rp ">> type 'yes' to write $config to $dev: " ok
+    [ "$ok" = yes ] || die "aborted"
+    zstdcat "$img" | sudo dd of="$dev" bs=4M status=progress oflag=sync
+    sync
+    echo ">> done — insert the card into the Pi and boot."
+    ;;
+
   *)
     die "unknown command '$cmd' (kexec|install|switch|boot|test)"
     ;;