diff --git a/DEPLOYMENT_MIGRATION.md b/DEPLOYMENT_MIGRATION.md
index 0f53a1b2..97805925 100644
--- a/DEPLOYMENT_MIGRATION.md
+++ b/DEPLOYMENT_MIGRATION.md
@@ -106,6 +106,8 @@ and running the documented commands produces a working deployment.
 
 ## Operational notes for first-time deploy
 
+> **Updating an existing deploy after `git pull`?** Use `./scripts/redeploy.sh` — it rebuilds the `api` and `web` images, runs migrations + seed, and restarts the stack in the right order. See `replit.md` → "Redeploying after `git pull`".
+
 1. `cp .env.example .env` and fill in every value.
 2. `docker compose build`
 3. `docker compose up -d db minio minio-init` — Postgres + MinIO + create
diff --git a/scripts/redeploy.sh b/scripts/redeploy.sh
new file mode 100755
index 00000000..ea86f24d
--- /dev/null
+++ b/scripts/redeploy.sh
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+# Tx OS — redeploy after `git pull` on the Mac (or any Docker host).
+#
+# Why this exists:
+#   The SPA is baked into the `web` (nginx) image at build time, and the
+#   API binary is baked into the `api` image. `docker compose up -d` on
+#   its own re-uses the existing images, so a plain `git pull` will NOT
+#   pick up new front-end assets (e.g. service tile images), code
+#   changes, or DB-seed updates.
+#
+# What it does:
+#   1. git pull           — fast-forward the working tree (skipped with --no-pull)
+#   2. docker compose build api web
+#                          — rebuild both images so source + static assets are fresh
+#   3. docker compose run --rm migrate
+#                          — apply Drizzle schema + run the seed (idempotent)
+#   4. docker compose up -d
+#                          — restart api + web with the new images
+#
+# Safe to re-run. Each step is idempotent.
+
+set -euo pipefail
+
+PULL=1
+for arg in "$@"; do
+  case "$arg" in
+    --no-pull) PULL=0 ;;
+    -h|--help)
+      sed -n '2,21p' "$0"
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $arg" >&2
+      echo "Usage: $0 [--no-pull]" >&2
+      exit 2
+      ;;
+  esac
+done
+
+# Resolve the repo root so the script works no matter where it's invoked from.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+cd "$REPO_ROOT"
+
+if [ ! -f docker-compose.yml ]; then
+  echo "[redeploy] error: docker-compose.yml not found in $REPO_ROOT" >&2
+  exit 1
+fi
+
+if ! command -v docker >/dev/null 2>&1; then
+  echo "[redeploy] error: docker CLI not found in PATH" >&2
+  exit 1
+fi
+
+# Pick `docker compose` (v2) and fall back to `docker-compose` (v1) so this
+# works on older hosts.
+if docker compose version >/dev/null 2>&1; then
+  DC=(docker compose)
+elif command -v docker-compose >/dev/null 2>&1; then
+  DC=(docker-compose)
+else
+  echo "[redeploy] error: neither 'docker compose' nor 'docker-compose' is available" >&2
+  exit 1
+fi
+
+step() { echo; echo "==> $*"; }
+
+if [ "$PULL" -eq 1 ]; then
+  step "1/4  git pull"
+  git pull --ff-only
+else
+  step "1/4  git pull (skipped via --no-pull)"
+fi
+
+step "2/4  docker compose build api web  (rebuilds SPA + API images)"
+"${DC[@]}" build api web
+
+step "3/4  docker compose run --rm migrate  (schema push + seed)"
+"${DC[@]}" run --rm migrate
+
+step "4/4  docker compose up -d  (restart with the new images)"
+"${DC[@]}" up -d
+
+echo
+echo "[redeploy] done. Verify in a browser; hard-refresh once to bust the SPA cache."