diff --git a/.github/workflows/release-packages.yml b/.github/workflows/release-packages.yml
index c828724..4d1df8d 100644
--- a/.github/workflows/release-packages.yml
+++ b/.github/workflows/release-packages.yml
@@ -59,6 +59,13 @@ jobs:
 
   release-deb:
     needs: build-binary
+    strategy:
+      matrix:
+        include:
+          - platform-arch: linux-x64
+            deb-arch: amd64
+          - platform-arch: linux-arm64
+            deb-arch: arm64
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -69,16 +76,16 @@ jobs:
         id: version
         run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
 
-      - name: Download linux-x64 binary
+      - name: Download binary
         uses: robinraju/release-downloader@v1
         with:
           tag: ${{ github.ref_name }}
-          fileName: amesh-${{ steps.version.outputs.VERSION }}-linux-x64.tar.gz
+          fileName: amesh-${{ steps.version.outputs.VERSION }}-${{ matrix.platform-arch }}.tar.gz
 
       - name: Extract binary
         run: |
           mkdir -p packaging/dist
-          tar -xzf amesh-${{ steps.version.outputs.VERSION }}-linux-x64.tar.gz -C packaging/dist/
+          tar -xzf amesh-${{ steps.version.outputs.VERSION }}-${{ matrix.platform-arch }}.tar.gz -C packaging/dist/
 
       - name: Install nfpm
         run: |
@@ -89,14 +96,16 @@ jobs:
       - name: Build .deb
         working-directory: packaging
         run: |
-          VERSION=${{ steps.version.outputs.VERSION }} nfpm pkg \
+          VERSION=${{ steps.version.outputs.VERSION }} \
+          DEB_ARCH=${{ matrix.deb-arch }} \
+          nfpm pkg \
             --packager deb \
-            --target ../amesh_${{ steps.version.outputs.VERSION }}_amd64.deb
+            --target ../amesh_${{ steps.version.outputs.VERSION }}_${{ matrix.deb-arch }}.deb
 
       - name: Upload .deb to GitHub Release
         uses: softprops/action-gh-release@v2
         with:
-          files: amesh_${{ steps.version.outputs.VERSION }}_amd64.deb
+          files: amesh_${{ steps.version.outputs.VERSION }}_${{ matrix.deb-arch }}.deb
 
   update-homebrew:
     needs: build-binary
diff --git a/firebase.json b/firebase.json
index 89f117c..1eb8b4d 100644
--- a/firebase.json
+++ b/firebase.json
@@ -12,6 +12,15 @@
             "value": "public, max-age=31536000, immutable"
           }
         ]
+      },
+      {
+        "source": "/install",
+        "headers": [
+          {
+            "key": "Content-Type",
+            "value": "text/plain; charset=utf-8"
+          }
+        ]
       }
     ]
   }
diff --git a/landpage/src/routes/+page.svelte b/landpage/src/routes/+page.svelte
index f26c4fd..866a0c3 100644
--- a/landpage/src/routes/+page.svelte
+++ b/landpage/src/routes/+page.svelte
@@ -6,8 +6,8 @@
 	// Install tabs
 	const installTabs = [
 		{ label: 'Homebrew', cmd: 'brew install ameshdev/tap/amesh' },
+		{ label: 'Shell', cmd: 'curl -fsSL https://authmesh.dev/install | sh' },
 		{ label: 'npm', cmd: 'npm install @authmesh/sdk' },
-		{ label: 'Binary', cmd: 'curl -sLO https://github.com/ameshdev/amesh/releases/latest/download/amesh-darwin-arm64.tar.gz' },
 	];
 	let activeInstallTab = $state(0);
 	let installCopied = $state(false);
diff --git a/landpage/src/routes/docs/quickstart/+page.svelte b/landpage/src/routes/docs/quickstart/+page.svelte
index bdf6d02..7e4a076 100644
--- a/landpage/src/routes/docs/quickstart/+page.svelte
+++ b/landpage/src/routes/docs/quickstart/+page.svelte
@@ -64,6 +64,10 @@ brew install ameshdev/tap/amesh
 
 <span class="text-zinc-500"># SDK (in your project)</span>
 bun add <span class="text-emerald-400">@authmesh/sdk</span>`} />
+		</div>
+		<div class="mt-4">
+			<CodeBlock label="Shell (Linux / macOS)" code={`<span class="text-zinc-500"># Installs amesh + amesh-agent — no runtime needed</span>
+curl -fsSL <span class="text-emerald-400">https://authmesh.dev/install</span> | sh`} />
 		</div>
 		<div class="mt-4">
 			<CodeBlock label="npm" code={`<span class="text-zinc-500"># CLI (global)</span>
diff --git a/landpage/src/routes/docs/remote-shell/+page.svelte b/landpage/src/routes/docs/remote-shell/+page.svelte
index 9d31c6b..1c3ac36 100644
--- a/landpage/src/routes/docs/remote-shell/+page.svelte
+++ b/landpage/src/routes/docs/remote-shell/+page.svelte
@@ -28,9 +28,9 @@
 			server: 'npm install -g @authmesh/agent',
 		},
 		{
-			label: 'Binary',
-			controller: 'curl -sLO https://github.com/ameshdev/amesh/releases/latest/download/amesh-darwin-arm64.tar.gz\ntar xzf amesh-darwin-arm64.tar.gz && sudo mv amesh /usr/local/bin/',
-			server: 'curl -sLO https://github.com/ameshdev/amesh/releases/latest/download/amesh-linux-x64.tar.gz\ntar xzf amesh-linux-x64.tar.gz && sudo mv amesh-agent /usr/local/bin/',
+			label: 'Shell',
+			controller: 'curl -fsSL https://authmesh.dev/install | sh',
+			server: 'curl -fsSL https://authmesh.dev/install | sh',
 		},
 	];
 	let activeInstallMethod = $state(0);
diff --git a/landpage/static/install b/landpage/static/install
new file mode 100644
index 0000000..5ec2f9d
--- /dev/null
+++ b/landpage/static/install
@@ -0,0 +1,155 @@
+#!/bin/sh
+# Install script for amesh — device-bound M2M authentication.
+# Usage: curl -fsSL https://authmesh.dev/install | sh
+#
+# Detects OS and architecture, downloads the latest release from GitHub,
+# and installs amesh + amesh-agent into /usr/local/bin (or ~/.local/bin).
+#
+# Environment variables:
+#   AMESH_VERSION   — install a specific version (e.g., "0.5.1")
+#   AMESH_INSTALL   — custom install directory (default: /usr/local/bin or ~/.local/bin)
+
+set -e
+
+REPO="ameshdev/amesh"
+BASE_URL="https://github.com/${REPO}/releases"
+
+# --- Helpers ---
+
+log() {
+  printf '%s\n' "$1"
+}
+
+err() {
+  printf 'Error: %s\n' "$1" >&2
+  exit 1
+}
+
+need() {
+  command -v "$1" >/dev/null 2>&1 || err "required command not found: $1"
+}
+
+# --- Detect platform ---
+
+detect_os() {
+  case "$(uname -s)" in
+    Linux*)  echo "linux" ;;
+    Darwin*) echo "darwin" ;;
+    *)       err "unsupported OS: $(uname -s)" ;;
+  esac
+}
+
+detect_arch() {
+  case "$(uname -m)" in
+    x86_64|amd64)    echo "x64" ;;
+    aarch64|arm64)   echo "arm64" ;;
+    *)               err "unsupported architecture: $(uname -m)" ;;
+  esac
+}
+
+# --- Resolve version ---
+
+resolve_version() {
+  if [ -n "${AMESH_VERSION}" ]; then
+    echo "${AMESH_VERSION}"
+    return
+  fi
+
+  # Fetch latest release tag from GitHub API
+  need curl
+  tag=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases/latest" \
+    | grep '"tag_name"' | head -1 | sed 's/.*"v\(.*\)".*/\1/')
+  [ -n "$tag" ] || err "could not determine latest version"
+  echo "$tag"
+}
+
+# --- Choose install directory ---
+
+choose_install_dir() {
+  if [ -n "${AMESH_INSTALL}" ]; then
+    echo "${AMESH_INSTALL}"
+    return
+  fi
+
+  if [ -w /usr/local/bin ]; then
+    echo "/usr/local/bin"
+  elif command -v sudo >/dev/null 2>&1; then
+    echo "/usr/local/bin"
+  else
+    mkdir -p "${HOME}/.local/bin"
+    echo "${HOME}/.local/bin"
+  fi
+}
+
+needs_sudo() {
+  [ ! -w "$1" ] && command -v sudo >/dev/null 2>&1
+}
+
+# --- Main ---
+
+main() {
+  need curl
+  need tar
+
+  OS=$(detect_os)
+  ARCH=$(detect_arch)
+  VERSION=$(resolve_version)
+  INSTALL_DIR=$(choose_install_dir)
+
+  TARBALL="amesh-${VERSION}-${OS}-${ARCH}.tar.gz"
+  URL="${BASE_URL}/download/v${VERSION}/${TARBALL}"
+
+  log "Installing amesh v${VERSION} (${OS}/${ARCH})"
+  log "  from: ${URL}"
+  log "  to:   ${INSTALL_DIR}"
+
+  # Download and extract to a temp directory
+  TMPDIR=$(mktemp -d)
+  trap 'rm -rf "$TMPDIR"' EXIT
+
+  curl -fsSL "$URL" -o "${TMPDIR}/${TARBALL}" \
+    || err "download failed — check that v${VERSION} exists for ${OS}-${ARCH}"
+
+  tar -xzf "${TMPDIR}/${TARBALL}" -C "$TMPDIR"
+
+  # Install binaries
+  if needs_sudo "$INSTALL_DIR"; then
+    sudo install -m 755 "${TMPDIR}/amesh" "${INSTALL_DIR}/amesh"
+    sudo install -m 755 "${TMPDIR}/amesh-agent" "${INSTALL_DIR}/amesh-agent"
+    # macOS Secure Enclave helper (only present in darwin tarballs)
+    if [ -f "${TMPDIR}/amesh-se-helper" ]; then
+      sudo install -m 755 "${TMPDIR}/amesh-se-helper" "${INSTALL_DIR}/amesh-se-helper"
+    fi
+  else
+    install -m 755 "${TMPDIR}/amesh" "${INSTALL_DIR}/amesh"
+    install -m 755 "${TMPDIR}/amesh-agent" "${INSTALL_DIR}/amesh-agent"
+    if [ -f "${TMPDIR}/amesh-se-helper" ]; then
+      install -m 755 "${TMPDIR}/amesh-se-helper" "${INSTALL_DIR}/amesh-se-helper"
+    fi
+  fi
+
+  # Verify
+  if "${INSTALL_DIR}/amesh" --version >/dev/null 2>&1; then
+    INSTALLED_VERSION=$("${INSTALL_DIR}/amesh" --version 2>&1)
+    log ""
+    log "amesh installed: ${INSTALLED_VERSION}"
+  else
+    log ""
+    log "amesh installed to ${INSTALL_DIR}/amesh"
+  fi
+
+  # Warn if install dir is not in PATH
+  case ":${PATH}:" in
+    *":${INSTALL_DIR}:"*) ;;
+    *)
+      log ""
+      log "Note: ${INSTALL_DIR} is not in your PATH."
+      log "  Add it with: export PATH=\"${INSTALL_DIR}:\$PATH\""
+      ;;
+  esac
+
+  log ""
+  log "Get started: amesh init"
+}
+
+main
diff --git a/packaging/nfpm.yaml b/packaging/nfpm.yaml
index 49b7e1c..58d702f 100644
--- a/packaging/nfpm.yaml
+++ b/packaging/nfpm.yaml
@@ -1,5 +1,5 @@
 name: amesh
-arch: amd64
+arch: "${DEB_ARCH}"
 platform: linux
 version: "${VERSION}"
 maintainer: "amesh <hello@authmesh.dev>"
@@ -11,3 +11,7 @@ contents:
     dst: /usr/bin/amesh
     file_info:
       mode: 0755
+  - src: ./dist/amesh-agent
+    dst: /usr/bin/amesh-agent
+    file_info:
+      mode: 0755