diff --git a/apps/cistech-tunnel/build/build.sh b/apps/cistech-tunnel/build/build.sh
new file mode 100644
index 0000000..e08a4ba
--- /dev/null
+++ b/apps/cistech-tunnel/build/build.sh
@@ -0,0 +1,22 @@
+#!/bin/bash
+# Build and push the Cistech VPN Docker image
+# Run this from the build directory
+
+set -euo pipefail
+
+IMAGE_NAME="${IMAGE_NAME:-git.alexzaw.dev/alexz/cistech-vpn}"
+IMAGE_TAG="${IMAGE_TAG:-latest}"
+
+echo "Building ${IMAGE_NAME}:${IMAGE_TAG}..."
+
+docker build "$@" -t "${IMAGE_NAME}:${IMAGE_TAG}" .
+docker push "${IMAGE_NAME}:${IMAGE_TAG}"
+
+echo ""
+echo "Build complete!"
+echo ""
+echo "To test locally:"
+echo "  docker run -d --privileged --cap-add=NET_ADMIN --device=/dev/net/tun -p 5901:5901 -p 6080:6080 -e VNC_PASSWORD=test ${IMAGE_NAME}:${IMAGE_TAG}"
+echo ""
+echo "Then connect via VNC to localhost:5901 or open noVNC at http://localhost:6080/vnc.html"
+echo ""