diff --git a/deploy_firmware.sh b/deploy_firmware.sh
new file mode 100755
index 0000000..e10722b
--- /dev/null
+++ b/deploy_firmware.sh
@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Upload firmware to localiserd, optionally triggering
+# a fleet-wide OTA push immediately after upload.
+#
+# Usage:
+#   ./deploy_firmware.sh <firmware_path> <version> <localiserd_url> <token> [--ota]
+#
+# Example:
+#   ./deploy_firmware.sh ./build/esp-anchor.bin 1.2.0 http://192.168.1.10:4000 <jwt> --ota
+
+set -euo pipefail
+
+FIRMWARE_PATH="${1:?Usage: $0 <firmware_path> <version> <localiserd_url> <token> [--ota]}"
+VERSION="${2:?}"
+SERVER="${3:?}"
+TOKEN="${4:?}"
+OTA="${5:-}"
+
+if [[ ! -f "$FIRMWARE_PATH" ]]; then
+  echo "ERROR: firmware not found at $FIRMWARE_PATH" >&2
+  exit 1
+fi
+
+SIZE=$(wc -c < "$FIRMWARE_PATH")
+echo "==> Built: $FIRMWARE_PATH ($SIZE bytes)"
+
+# Upload
+echo "==> Uploading version $VERSION to $SERVER..."
+curl -fsS \
+  -H "Authorization: Bearer $TOKEN" \
+  -F "version=$VERSION" \
+  -F "firmware=@$FIRMWARE_PATH;type=application/octet-stream" \
+  "$SERVER/api/firmware" \
+  | jq .
+
+# Fleet OTA
+if [[ "$OTA" == "--ota" ]]; then
+  echo "==> Pushing fleet OTA for version $VERSION..."
+  curl -fsS -X POST \
+    -H "Authorization: Bearer $TOKEN" \
+    -H "Content-Type: application/json" \
+    "$SERVER/api/firmware/$VERSION/ota" \
+    | jq .
+fi
+
+echo "==> Done."