diff --git a/wrapper/docker-entrypoint.sh b/wrapper/docker-entrypoint.sh
new file mode 100644
index 0000000..8e9c905
--- /dev/null
+++ b/wrapper/docker-entrypoint.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# --- ENV defaults (can be overridden by compose/Portainer) ---
+REPO_URL="${REPO_URL:-https://git.example.com/owner/shaiwatcher.git}"
+REPO_BRANCH="${REPO_BRANCH:-main}"
+SHAI_CONFIG="${SHAI_CONFIG:-/config/settings.conf}"
+SHAI_DATA="${SHAI_DATA:-/data/data.json}"  # we also honor SHAI_DATA_FILE in the bot
+
+echo "[Wrapper] Repo: $REPO_URL @ $REPO_BRANCH"
+echo "[Wrapper] SHAI_CONFIG: $SHAI_CONFIG"
+echo "[Wrapper] SHAI_DATA:   $SHAI_DATA"
+
+# --- Ensure volumes/dirs exist ---
+mkdir -p "$(dirname "$SHAI_CONFIG")" /data /app/runtime
+touch "$SHAI_CONFIG"
+
+# --- Fetch bot code fresh on every boot (or cache in /app/runtime) ---
+if [ ! -d /app/runtime/repo/.git ]; then
+  echo "[Wrapper] Cloning repo..."
+  git clone --depth=1 -b "$REPO_BRANCH" "$REPO_URL" /app/runtime/repo
+else
+  echo "[Wrapper] Updating repo..."
+  git -C /app/runtime/repo fetch origin "$REPO_BRANCH" --depth=1
+  git -C /app/runtime/repo reset --hard "origin/$REPO_BRANCH"
+fi
+
+cd /app/runtime/repo
+
+# --- Python deps if needed ---
+if [ -f requirements.txt ]; then
+  echo "[Wrapper] Installing requirements..."
+  pip install --no-cache-dir -r requirements.txt
+fi
+
+# --- Export env for child (don’t quote, avoid stray quotes) ---
+export SHAI_CONFIG SHAI_DATA
+
+# --- Last sanity echo to help debugging ---
+echo "[Wrapper] Launching bot..."
+python -u bot.py