diff --git a/scripts/deploy.sh b/scripts/deploy.sh
new file mode 100644
index 0000000..cc3663a
--- /dev/null
+++ b/scripts/deploy.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# One-pass-ish deploy. Assumes aws-cli is configured (creds + region) and docker,
+# terraform, and the AgentCore CLI are installed. Review before running.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+REGION="${REGION:-us-east-1}"
+ACCOUNT="$(aws sts get-caller-identity --query Account --output text)"
+ECR="${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com"
+
+echo "==> Step 1: core infra (DynamoDB + RAG Lambda + IAM)"
+terraform -chdir=terraform init
+terraform -chdir=terraform apply -target=aws_lambda_function.rag -auto-approve
+
+echo "==> Step 2: build + push the Presidio detector image"
+aws ecr describe-repositories --repository-names hncb-presidio --region "$REGION" >/dev/null 2>&1 \
+  || aws ecr create-repository --repository-name hncb-presidio --region "$REGION" >/dev/null
+aws ecr get-login-password --region "$REGION" | docker login --username AWS --password-stdin "$ECR"
+docker build -t "$ECR/hncb-presidio:latest" ./presidio
+docker push "$ECR/hncb-presidio:latest"
+
+echo "==> Step 3: full apply (ECS services for Fusion + Presidio)"
+echo "    Make sure fusion_image_uri is set (you supply the Axway image)."
+terraform -chdir=terraform apply \
+  -var "presidio_image_uri=$ECR/hncb-presidio:latest" \
+  -auto-approve
+
+echo "==> Step 4: seed data"
+export CUSTOMERS_TABLE="$(terraform -chdir=terraform output -raw customers_table)"
+export VAULT_TABLE="$(terraform -chdir=terraform output -raw vault_table)"
+python seed/seed.py --with-demo-token
+
+echo "==> Step 5: AgentCore (Gateway + Runtime)"
+export RAG_LAMBDA_ARN="$(terraform -chdir=terraform output -raw rag_lambda_arn)"
+export REGION
+bash scripts/agentcore_setup.sh
+
+echo ""
+echo "Remaining manual steps:"
+echo "  - Configure Fusion ingress/egress policy  -> fusion/POLICY_SETUP.md"
+echo "  - Point ui/index.html GATEWAY_URL at the Fusion host, then host it (S3/CloudFront or local)"
+echo "Done."