diff --git a/check.sh b/check.sh
new file mode 100755
index 0000000..ace71a8
--- /dev/null
+++ b/check.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+# Static checks for everything in the bundle. Run before committing / deploying.
+set -uo pipefail
+cd "$(dirname "$0")"
+fail=0
+say() { printf '%-28s %s\n' "$1" "$2"; }
+
+for f in install.sh addCommunityMediaServer.sh installJellyfinPlugin.sh registerGiteaRunner.sh createGiteaDb.sh deployLive.sh firewall/firewall.sh bin/*.sh home/*.sh bot/entrypoint.sh mariadb/init/*.sh; do
+  [[ -f $f ]] || continue
+  bash -n "$f" && say "$f" ok || { say "$f" "BASH SYNTAX"; fail=1; }
+done
+for f in configure.py bin/dumpd.py; do
+  python3 -m py_compile "$f" && say "$f" ok || { say "$f" "PYTHON SYNTAX"; fail=1; }
+done
+rm -rf __pycache__ bin/__pycache__
+python3 -c "import yaml,sys; [yaml.safe_load(open(f)) for f in sys.argv[1:]]" docker-compose.yml mediamtx.example.yml && say "yaml" ok || { say "yaml" "INVALID"; fail=1; }
+node -e "
+const fs=require('fs');const html=fs.readFileSync('dock/index.html','utf8');
+for (const m of html.matchAll(/<script(?:[^>]*)>([\s\S]*?)<\/script>/g)) new Function(m[1]);" && say "dock/index.html JS" ok || { say "dock/index.html JS" "SYNTAX ERROR"; fail=1; }
+# generated Caddyfile / mediamtx / copyparty from a dry configure run must at least be produced + parse
+T=$(mktemp -d); cp configure.py "$T/"; ( cd "$T" && VG_DRY=1 python3 -c "
+import configure as c, yaml
+c.write_caddy('ovh1.example.com','auth.example.com','watch.example.com','git.example.com','bot.example.com','live.example.com')
+c.write_mediamtx('ovh1.example.com'); yaml.safe_load(open('mediamtx.yml')); c.write_copyparty()
+assert 'authMethod: http' in open('mediamtx.yml').read(); assert 'idp-h-usr' in open('copyparty.conf').read()
+" ) && say "configure.py generators" ok || { say "configure.py generators" "FAILED"; fail=1; }
+rm -rf "$T"
+if command -v caddy >/dev/null; then
+  T=$(mktemp -d); cp configure.py "$T/"; ( cd "$T" && VG_DRY=1 python3 -c "import configure as c; c.write_caddy('ovh1.example.com','a.example.com','w.example.com','g.example.com','b.example.com','l.example.com')" && caddy validate --adapter caddyfile --config Caddyfile >/dev/null 2>&1 ) && say "Caddyfile (caddy validate)" ok || { say "Caddyfile (caddy validate)" "INVALID"; fail=1; }
+  rm -rf "$T"
+fi
+[[ -d live/node_modules ]] && ( cd live && npx --no-install vite build --logLevel error >/dev/null 2>&1 ) && say "live portal build" ok || say "live portal build" "(skipped or failed — run npm run build in live/)"
+exit $fail