diff --git a/dockerfiles/Dockerfile.hecate-node-helper b/dockerfiles/Dockerfile.hecate-node-helper
new file mode 100644
index 00000000..16e2d517
--- /dev/null
+++ b/dockerfiles/Dockerfile.hecate-node-helper
@@ -0,0 +1,12 @@
+FROM debian:bookworm-slim
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        bash \
+        ca-certificates \
+        curl \
+        util-linux \
+        zstd \
+    && rm -rf /var/lib/apt/lists/*
+
+CMD ["/bin/sh"]
diff --git a/scripts/bootstrap/harbor-bootstrap-images.txt b/scripts/bootstrap/harbor-bootstrap-images.txt
new file mode 100644
index 00000000..fae7a6f6
--- /dev/null
+++ b/scripts/bootstrap/harbor-bootstrap-images.txt
@@ -0,0 +1,9 @@
+# Harbor cold-start bootstrap images.
+registry.bstein.dev/infra/harbor-core:v2.14.1-arm64
+registry.bstein.dev/infra/harbor-jobservice:v2.14.1-arm64
+registry.bstein.dev/infra/harbor-portal:v2.14.1-arm64
+registry.bstein.dev/infra/harbor-registry:v2.14.1-arm64
+registry.bstein.dev/infra/harbor-registryctl:v2.14.1-arm64
+registry.bstein.dev/infra/harbor-redis:v2.14.1-arm64
+registry.bstein.dev/infra/harbor-nginx:v2.14.1-arm64
+registry.bstein.dev/infra/harbor-prepare:v2.14.1-arm64
diff --git a/scripts/build_harbor_bootstrap_bundle.sh b/scripts/build_harbor_bootstrap_bundle.sh
new file mode 100755
index 00000000..ff64e55b
--- /dev/null
+++ b/scripts/build_harbor_bootstrap_bundle.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGES_FILE="scripts/bootstrap/harbor-bootstrap-images.txt"
+BUNDLE_FILE="artifacts/harbor-bootstrap-v2.14.1-arm64.tar.zst"
+DOCKER_CONFIG_PATH=""
+PLATFORM="linux/arm64"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --images-file)
+      IMAGES_FILE="${2:?missing images file}"
+      shift 2
+      ;;
+    --bundle-file)
+      BUNDLE_FILE="${2:?missing bundle file}"
+      shift 2
+      ;;
+    --docker-config)
+      DOCKER_CONFIG_PATH="${2:?missing docker config path}"
+      shift 2
+      ;;
+    --platform)
+      PLATFORM="${2:?missing platform}"
+      shift 2
+      ;;
+    -h|--help)
+      cat <<USAGE
+Usage: scripts/build_harbor_bootstrap_bundle.sh [--images-file <path>] [--bundle-file <path>] [--docker-config <path>] [--platform <linux/arm64>]
+USAGE
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -n "${DOCKER_CONFIG_PATH}" ]]; then
+  export DOCKER_CONFIG="${DOCKER_CONFIG_PATH}"
+fi
+
+mapfile -t IMAGES < <(grep -v '^[[:space:]]*#' "${IMAGES_FILE}" | sed '/^[[:space:]]*$/d')
+if [[ ${#IMAGES[@]} -eq 0 ]]; then
+  echo "No images found in ${IMAGES_FILE}" >&2
+  exit 1
+fi
+
+mkdir -p "$(dirname "${BUNDLE_FILE}")"
+for image in "${IMAGES[@]}"; do
+  echo "Pulling ${image}" >&2
+  docker pull --platform "${PLATFORM}" "${image}" >/dev/null
+
+done
+
+docker save "${IMAGES[@]}" | zstd -T0 -19 -o "${BUNDLE_FILE}"
+echo "Wrote ${BUNDLE_FILE}" >&2
diff --git a/scripts/build_hecate_node_helper.sh b/scripts/build_hecate_node_helper.sh
new file mode 100755
index 00000000..148f51c5
--- /dev/null
+++ b/scripts/build_hecate_node_helper.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE="registry.bstein.dev/bstein/hecate-node-helper:0.1.0"
+DOCKER_CONFIG_PATH=""
+PLATFORMS="linux/amd64,linux/arm64"
+BUILDER_NAME="hecate-node-helper-builder"
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --image)
+      IMAGE="${2:?missing image}"
+      shift 2
+      ;;
+    --docker-config)
+      DOCKER_CONFIG_PATH="${2:?missing docker config path}"
+      shift 2
+      ;;
+    --platforms)
+      PLATFORMS="${2:?missing platforms}"
+      shift 2
+      ;;
+    --builder)
+      BUILDER_NAME="${2:?missing builder}"
+      shift 2
+      ;;
+    -h|--help)
+      cat <<USAGE
+Usage: scripts/build_hecate_node_helper.sh [--image <image>] [--docker-config <path>] [--platforms <csv>] [--builder <name>]
+USAGE
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [[ -n "${DOCKER_CONFIG_PATH}" ]]; then
+  export DOCKER_CONFIG="${DOCKER_CONFIG_PATH}"
+fi
+
+if ! docker buildx inspect "${BUILDER_NAME}" >/dev/null 2>&1; then
+  docker buildx create --name "${BUILDER_NAME}" --driver docker-container --use >/dev/null
+else
+  docker buildx use "${BUILDER_NAME}" >/dev/null
+fi
+
+docker buildx inspect --bootstrap >/dev/null
+docker buildx build \
+  --platform "${PLATFORMS}" \
+  -f dockerfiles/Dockerfile.hecate-node-helper \
+  -t "${IMAGE}" \
+  --push \
+  .