diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b10a7d0..0d2149f 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -654,6 +654,12 @@ importers:
 
   packages/ui: {}
 
+  scripts:
+    devDependencies:
+      '@types/node':
+        specifier: 'catalog:'
+        version: 22.19.17
+
 packages:
 
   '@adobe/css-tools@4.4.4':
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 3a860bb..68d71bd 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -1,6 +1,7 @@
 packages:
   - "apps/*"
   - "packages/*"
+  - "scripts"
 
 catalog:
   react: ^19.2.5
diff --git a/scripts/README.md b/scripts/README.md
new file mode 100644
index 0000000..525a3ce
--- /dev/null
+++ b/scripts/README.md
@@ -0,0 +1,31 @@
+# scripts
+
+One-off CLIs for maintenance tasks that don't belong inside any of the
+apps or packages. Small enough to live in a single file each.
+
+This folder is a pnpm workspace (`@trails-cool/scripts`) purely so TypeScript
+has a home to resolve `@types/node` from — it isn't published, bundled, or
+deployed. Each script is a self-contained `.ts` file run with
+`node --experimental-strip-types`.
+
+## Contents
+
+| Script | Purpose |
+|---|---|
+| `render-legal.ts` | Render a legal page (Terms / Privacy / Imprint) from its TSX source to plain markdown for `docs/legal-archive/`. See [`docs/legal-archive/README.md`](../docs/legal-archive/README.md). |
+| `check-dockerfiles.sh` | Bash script run in CI to verify every workspace package is COPY'd into each app's Dockerfile. |
+
+## Adding a script
+
+1. Drop the file in this folder (`.ts` preferred; shell is fine for
+   filesystem/docker glue).
+2. For TypeScript, `tsconfig.json` already picks up every `*.ts` in this
+   directory.
+3. Run it with `node --experimental-strip-types scripts/<name>.ts <args>`.
+4. Document purpose + invocation in the table above.
+
+## Why not per-package scripts?
+
+Some things (Dockerfile audits, legal-archive rendering, DB one-offs) don't
+belong inside any single workspace. Keeping them here avoids cross-package
+dependencies and keeps the app/package roots focused on product code.
diff --git a/scripts/package.json b/scripts/package.json
new file mode 100644
index 0000000..586b341
--- /dev/null
+++ b/scripts/package.json
@@ -0,0 +1,13 @@
+{
+  "name": "@trails-cool/scripts",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint ."
+  },
+  "devDependencies": {
+    "@types/node": "catalog:"
+  }
+}
diff --git a/scripts/tsconfig.json b/scripts/tsconfig.json
new file mode 100644
index 0000000..fed7cdc
--- /dev/null
+++ b/scripts/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../tsconfig.base.json",
+  "compilerOptions": {
+    "types": ["node"],
+    "noEmit": true
+  },
+  "include": ["*.ts"]
+}