diff --git a/deploy/push-cache.sh b/deploy/push-cache.sh
new file mode 100755
index 0000000..2abdf9e
--- /dev/null
+++ b/deploy/push-cache.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Build the douro-installed system closure and push all paths to cachix.
+#
+# Run from your dev machine (Arch) after pushing code to the repo.
+# Requires: nix (Determinate), cachix (authenticated via ~/.config/cachix/cachix.dhall)
+#
+# Usage:
+#   ./deploy/push-cache.sh              # build + push douro-installed
+#   ./deploy/push-cache.sh douro        # same as above (default)
+#   ./deploy/push-cache.sh tejo         # build + push tejo live config
+#   ./deploy/push-cache.sh all          # build + push all configs
+set -euo pipefail
+
+CACHE="aiolabs"
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+cd "$SCRIPT_DIR"
+
+target="${1:-douro}"
+
+build_and_push() {
+  local name="$1"
+  local attr="$2"
+
+  echo "==> Building $name ($attr)..."
+  nix build ".#$attr" --no-link --print-out-paths | cachix push "$CACHE"
+  echo "==> Pushed $name to $CACHE.cachix.org"
+}
+
+case "$target" in
+  douro)
+    build_and_push "douro-installed toplevel" "nixosConfigurations.douro-installed.config.system.build.toplevel"
+    ;;
+  douro-live)
+    build_and_push "douro live ISO" "iso-douro"
+    ;;
+  tejo)
+    build_and_push "tejo live ISO" "iso-tejo"
+    ;;
+  sintra)
+    build_and_push "sintra live ISO" "iso-sintra"
+    ;;
+  all)
+    build_and_push "douro-installed toplevel" "nixosConfigurations.douro-installed.config.system.build.toplevel"
+    build_and_push "douro live ISO" "iso-douro"
+    build_and_push "tejo live ISO" "iso-tejo"
+    build_and_push "sintra live ISO" "iso-sintra"
+    ;;
+  *)
+    echo "Usage: $0 [douro|douro-live|tejo|sintra|all]"
+    exit 1
+    ;;
+esac
+
+echo ""
+echo "Done. ATMs will pull binaries from https://$CACHE.cachix.org on next upgrade."