diff --git a/scripts/build-boringtun.sh b/scripts/build-boringtun.sh
new file mode 100644
index 0000000..5929d43
--- /dev/null
+++ b/scripts/build-boringtun.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# scripts/build-boringtun.sh
+#
+# Clones cloudflare/boringtun and compiles it as a static C library.
+# The resulting libboringtun.a (macOS) is placed in deps/boringtun/.
+#
+# Prerequisites:
+#   brew install rustup   (or install Rust via https://rustup.rs)
+#   rustup target add aarch64-apple-darwin x86_64-apple-darwin
+#
+# Usage:
+#   bash scripts/build-boringtun.sh          # current arch only
+#   bash scripts/build-boringtun.sh --universal  # fat binary (arm64 + x86_64)
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(dirname "$SCRIPT_DIR")"
+DEPS_DIR="$REPO_ROOT/deps/boringtun"
+BT_SRC="$DEPS_DIR/src"
+BT_REPO="https://github.com/cloudflare/boringtun.git"
+BT_TAG="v0.6.0"   # Update as needed
+
+UNIVERSAL=false
+for arg in "$@"; do
+    [[ "$arg" == "--universal" ]] && UNIVERSAL=true
+done
+
+echo "==> Checking Rust toolchain..."
+if ! command -v cargo &>/dev/null; then
+    echo "ERROR: cargo not found.  Install Rust: https://rustup.rs"
+    exit 1
+fi
+rustup show active-toolchain || true
+
+echo "==> Cloning boringtun $BT_TAG..."
+mkdir -p "$DEPS_DIR"
+if [[ ! -d "$BT_SRC/.git" ]]; then
+    git clone --depth 1 --branch "$BT_TAG" "$BT_REPO" "$BT_SRC"
+else
+    echo "    (already cloned, skipping)"
+fi
+
+build_for_target() {
+    local TARGET="$1"
+    echo "==> Building for $TARGET..."
+    pushd "$BT_SRC" >/dev/null
+    cargo build \
+        --release \
+        --features ffi \
+        --target "$TARGET"
+    popd >/dev/null
+}
+
+if $UNIVERSAL; then
+    rustup target add aarch64-apple-darwin x86_64-apple-darwin
+    build_for_target aarch64-apple-darwin
+    build_for_target x86_64-apple-darwin
+
+    ARM_LIB="$BT_SRC/target/aarch64-apple-darwin/release/libboringtun.a"
+    X86_LIB="$BT_SRC/target/x86_64-apple-darwin/release/libboringtun.a"
+    OUT_LIB="$DEPS_DIR/libboringtun.a"
+
+    echo "==> Creating universal (fat) binary..."
+    lipo -create "$ARM_LIB" "$X86_LIB" -output "$OUT_LIB"
+else
+    NATIVE_TARGET="$(rustc -vV | awk '/host:/ { print $2 }')"
+    build_for_target "$NATIVE_TARGET"
+    OUT_LIB="$DEPS_DIR/libboringtun.a"
+    cp "$BT_SRC/target/$NATIVE_TARGET/release/libboringtun.a" "$OUT_LIB"
+fi
+
+# Copy the FFI header from boringtun into our source tree.
+BT_HEADER="$BT_SRC/boringtun/src/ffi/wireguard_ffi.h"
+APP_HEADER="$REPO_ROOT/app/vpn/boringtun_ffi.h"
+if [[ -f "$BT_HEADER" ]]; then
+    echo "==> Updating boringtun_ffi.h from upstream source..."
+    cp "$BT_HEADER" "$APP_HEADER"
+else
+    echo "    (upstream header not found at expected path — keeping bundled copy)"
+fi
+
+echo ""
+echo "==> Done!  Library: $OUT_LIB"
+echo "    Size:  $(du -sh "$OUT_LIB" | cut -f1)"
+echo ""
+echo "    Add to your CMakeLists.txt:"
+echo "      target_link_libraries(moonlight-qt PRIVATE \"\${CMAKE_SOURCE_DIR}/deps/boringtun/libboringtun.a\")"