diff --git a/scripts/build-boringtun.sh b/scripts/build-boringtun.sh
new file mode 100644
index 0000000..e56cfd3
--- /dev/null
+++ b/scripts/build-boringtun.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# scripts/build-boringtun.sh — Build the boringtun WireGuard FFI library for Artemis.
+#
+# Usage:
+#   bash scripts/build-boringtun.sh              # native target
+#   bash scripts/build-boringtun.sh --universal  # macOS fat binary (x86_64 + arm64)
+#
+# Output:
+#   deps/boringtun/libboringtun.a   — static library
+#   deps/boringtun/wireguard_ffi.h  — C ABI header (for reference)
+#
+# Prerequisites:
+#   • Rust toolchain  (https://rustup.rs)
+#   • git
+
+set -euo pipefail
+
+REPO="https://github.com/cloudflare/boringtun.git"
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+SRC="$ROOT/build/boringtun-src"
+OUT="$ROOT/deps/boringtun"
+UNIVERSAL=false
+
+while [[ $# -gt 0 ]]; do
+    case "$1" in
+        --universal) UNIVERSAL=true; shift ;;
+        *) echo "Unknown flag: $1"; exit 1 ;;
+    esac
+done
+
+info()  { echo "  $*"; }
+ok()    { echo "  ✓ $*"; }
+fail()  { echo "  ✗ $*" >&2; exit 1; }
+
+# ── Prerequisites ─────────────────────────────────────────────────────────────
+
+command -v cargo &>/dev/null || fail "cargo not found. Install Rust from https://rustup.rs"
+command -v git   &>/dev/null || fail "git not found"
+
+if $UNIVERSAL; then
+    rustup target add x86_64-apple-darwin aarch64-apple-darwin 2>/dev/null || true
+fi
+
+# ── Clone / update ────────────────────────────────────────────────────────────
+
+if [[ ! -d "$SRC" ]]; then
+    info "Cloning boringtun..."
+    git clone --depth 1 "$REPO" "$SRC"
+else
+    info "Updating boringtun..."
+    git -C "$SRC" pull --ff-only
+fi
+ok "Source ready"
+
+# ── Build ─────────────────────────────────────────────────────────────────────
+
+if $UNIVERSAL && [[ "$(uname)" == "Darwin" ]]; then
+    info "Building for x86_64-apple-darwin..."
+    (cd "$SRC" && cargo build --release --target x86_64-apple-darwin --features ffi-bindings)
+    info "Building for aarch64-apple-darwin..."
+    (cd "$SRC" && cargo build --release --target aarch64-apple-darwin --features ffi-bindings)
+    ok "Both slices built"
+else
+    info "Building boringtun (release)..."
+    (cd "$SRC" && cargo build --release --features ffi-bindings)
+    ok "Build complete"
+fi
+
+# ── Copy artifacts ────────────────────────────────────────────────────────────
+
+mkdir -p "$OUT"
+
+if $UNIVERSAL && [[ "$(uname)" == "Darwin" ]]; then
+    X86="$SRC/target/x86_64-apple-darwin/release/libboringtun.a"
+    ARM="$SRC/target/aarch64-apple-darwin/release/libboringtun.a"
+    [[ -f "$X86" ]] || fail "x86_64 library not found: $X86"
+    [[ -f "$ARM" ]] || fail "arm64 library not found:  $ARM"
+    lipo -create "$X86" "$ARM" -output "$OUT/libboringtun.a"
+    ok "Created universal fat binary"
+else
+    LIB="$SRC/target/release/libboringtun.a"
+    [[ -f "$LIB" ]] || fail "Library not found: $LIB"
+    cp "$LIB" "$OUT/libboringtun.a"
+    ok "Copied libboringtun.a"
+fi
+
+# Copy reference header if present
+HDR="$SRC/boringtun/src/ffi/wireguard_ffi.h"
+if [[ -f "$HDR" ]]; then
+    cp "$HDR" "$OUT/wireguard_ffi.h"
+    ok "Copied wireguard_ffi.h"
+fi
+
+echo ""
+echo "  Build successful.  Library at:"
+echo "    $OUT/libboringtun.a"
+echo ""
+echo "  Next: cmake -B build && cmake --build build"