diff --git a/.github/workflows/unsloth-sd-prebuilt.yml b/.github/workflows/unsloth-sd-prebuilt.yml
new file mode 100644
index 000000000..36d0d0534
--- /dev/null
+++ b/.github/workflows/unsloth-sd-prebuilt.yml
@@ -0,0 +1,370 @@
+# SPDX-License-Identifier: MIT
+# Copyright 2026-present the Unsloth AI Inc. team.
+
+name: Unsloth SD prebuilt (CPU/Apple)
+
+# Build and publish OUR OWN stable-diffusion.cpp (sd-cli + sd-server) prebuilts for
+# the platforms where the native engine is the FASTER choice: CPU (Linux/WSL/Windows)
+# and Apple (Metal). GPU hosts use diffusers/torch, so no CUDA/ROCm/Vulkan here.
+#
+# Shape mirrors unslothai/llama.cpp's prebuilt pipeline, simplified for a 5-way
+# CPU/Apple matrix:
+#   resolve      -- pick the leejet release tag (supply-chain aged), stamp a source
+#                   tarball from that tag, decide if our release already exists.
+#   build-unix   -- macOS arm64 (Metal) + x64, Linux x64 + arm64 (matrix).
+#   build-windows-- Windows x64 (MSVC + Ninja).
+#   assemble     -- fingerprint gate, sha256 + manifest, coverage gate, atomic
+#                   draft->publish. If ANY build leg fails, assemble is skipped and
+#                   nothing is published (the Studio needs the full asset set).
+#
+# Asset names match the Studio installer's resolve_release_asset (leejet-compatible).
+
+on:
+  schedule:
+    - cron: '17 20 * * *'      # ~1pm PT-ish; daily
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'leejet release tag (master-<n>-<sha>) or "latest"'
+        default: 'latest'
+        required: true
+        type: string
+      min_age_hours:
+        description: 'For "latest": only build a release public for >= this many hours (blank = 6)'
+        default: ''
+        required: false
+        type: string
+      publish:
+        description: 'Publish to GitHub Releases (false = build artifacts only)'
+        default: false
+        required: false
+        type: boolean
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sd-prebuilt-${{ github.event.inputs.tag || 'scheduled' }}
+  cancel-in-progress: false
+
+env:
+  UNSLOTH_SD_MIN_RELEASE_AGE_HOURS: "6"
+
+jobs:
+  resolve:
+    name: Resolve tag + stamp source
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    outputs:
+      tag: ${{ steps.r.outputs.tag }}
+      commit: ${{ steps.r.outputs.commit }}
+      exists: ${{ steps.r.outputs.exists }}
+      source_artifact: ${{ steps.r.outputs.source_artifact }}
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Checkout mirror (for tooling; upstream remote added below)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - id: r
+        run: |
+          set -euo pipefail
+          REQ='${{ github.event.inputs.tag || 'latest' }}'
+          AGE_H='${{ github.event.inputs.min_age_hours }}'
+          [ -n "$AGE_H" ] || AGE_H="${UNSLOTH_SD_MIN_RELEASE_AGE_HOURS:-6}"
+
+          if [ "$REQ" = "latest" ]; then
+            CUTOFF="$(date -u -d "-${AGE_H} hours" +%s)"
+            TAG="$(gh api 'repos/leejet/stable-diffusion.cpp/releases?per_page=100' \
+              --jq "[.[] | select(.draft==false and .prerelease==false) | select((.published_at|fromdateiso8601) <= ${CUTOFF})] | max_by(.published_at|fromdateiso8601) | .tag_name")"
+            [ -n "$TAG" ] && [ "$TAG" != "null" ] || { echo "no leejet release older than ${AGE_H}h" >&2; exit 1; }
+            echo "selected leejet $TAG (aged >= ${AGE_H}h)"
+          else
+            TAG="$REQ"
+          fi
+          printf '%s' "$TAG" | grep -qE '^master-[0-9]+-[0-9a-f]+$' \
+            || { echo "refusing non-release tag '$TAG'" >&2; exit 1; }
+
+          # Does OUR published release already exist? (drafts don't count.)
+          EXISTS=false
+          if [ "$(gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json isDraft --jq .isDraft 2>/dev/null || true)" = "false" ]; then
+            EXISTS=true
+          fi
+
+          # Fetch leejet's source AT THAT TAG and tar it (no .git); the build legs
+          # extract this identical tree. Our own scripts come from the tooling checkout.
+          git remote add upstream https://github.com/leejet/stable-diffusion.cpp.git || true
+          git fetch -q --depth 1 upstream "refs/tags/${TAG}:refs/tags/${TAG}"
+          git checkout -q --detach "refs/tags/${TAG}"
+          # ggml is a REQUIRED submodule; the server frontend + libwebp/libwebm are not
+          # (we build with SD_SERVER_BUILD_FRONTEND / SD_WEBP / SD_WEBM off), so fetch only
+          # ggml to keep the source tarball small and the build self-contained.
+          git submodule update --init --recursive --depth 1 ggml
+          COMMIT="$(git rev-parse HEAD)"
+          SRC_ARTIFACT="sd-source-${TAG}"
+          if [ "$EXISTS" != "true" ] || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            tar --exclude-vcs --exclude=.github -czf "${RUNNER_TEMP}/sd-source-${TAG}.tar.gz" .
+            echo "stamped source for ${TAG} (${COMMIT})"
+          else
+            echo "release ${TAG} already published; skipping source prep"
+          fi
+
+          {
+            echo "tag=$TAG"
+            echo "commit=$COMMIT"
+            echo "exists=$EXISTS"
+            echo "source_artifact=$SRC_ARTIFACT"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Upload source artifact
+        if: ${{ steps.r.outputs.exists != 'true' || github.event_name == 'workflow_dispatch' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ steps.r.outputs.source_artifact }}
+          path: ${{ runner.temp }}/sd-source-${{ steps.r.outputs.tag }}.tar.gz
+          if-no-files-found: error
+          retention-days: 7
+
+  build-unix:
+    name: ${{ matrix.label }}
+    needs: resolve
+    if: ${{ needs.resolve.outputs.exists != 'true' || github.event_name == 'workflow_dispatch' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - label: Darwin-macOS-arm64
+            runner: macos-14
+            arch: arm64
+            defines: "-DSD_METAL=ON -DGGML_METAL_EMBED_LIBRARY=ON -DCMAKE_OSX_DEPLOYMENT_TARGET=14.0"
+            gate: "true"
+          - label: Darwin-macOS-x86_64
+            runner: macos-15-intel
+            arch: x86_64
+            defines: "-DSD_METAL=OFF -DCMAKE_OSX_DEPLOYMENT_TARGET=13.3"
+            gate: "true"
+          - label: Linux-Ubuntu-22.04-x86_64
+            runner: ubuntu-22.04
+            arch: x86_64
+            defines: ""
+            gate: "false"
+          - label: Linux-Ubuntu-24.04-aarch64
+            runner: ubuntu-24.04-arm
+            arch: aarch64
+            defines: ""
+            gate: "false"
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout mirror (tooling)
+        uses: actions/checkout@v4
+        with:
+          path: tooling
+          fetch-depth: 1
+
+      - name: Download source @ ${{ needs.resolve.outputs.tag }}
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.resolve.outputs.source_artifact }}
+          path: srcpkg
+      - name: Extract source
+        run: |
+          set -eux
+          mkdir -p src
+          tar -xzf "srcpkg/sd-source-${{ needs.resolve.outputs.tag }}.tar.gz" -C src
+
+      - name: Build sd-cli + sd-server
+        working-directory: src
+        run: |
+          set -euo pipefail
+          cmake -B build \
+            -DCMAKE_BUILD_TYPE=Release \
+            -DSD_BUILD_EXAMPLES=ON \
+            -DSD_SERVER_BUILD_FRONTEND=OFF \
+            -DSD_WEBP=OFF -DSD_WEBM=OFF \
+            -DGGML_NATIVE=OFF \
+            ${{ matrix.defines }}
+          if [ "$(uname -s)" = "Darwin" ]; then J="$(sysctl -n hw.logicalcpu)"; else J="$(nproc)"; fi
+          cmake --build build --config Release -j "$J" --target sd-cli sd-server
+
+      - name: macOS load gate
+        if: ${{ matrix.gate == 'true' }}
+        run: |
+          set -eux
+          # deploy target is the trailing number in defines
+          DT="$(echo '${{ matrix.defines }}' | sed -E 's/.*CMAKE_OSX_DEPLOYMENT_TARGET=([0-9.]+).*/\1/')"
+          bash tooling/scripts/unsloth/assert_macho_minos.sh src/build/bin "${{ matrix.arch }}" "$DT"
+
+      - name: Package bundle
+        env:
+          BIN_DIR: ${{ github.workspace }}/src/build/bin
+          OUT_DIR: ${{ github.workspace }}/dist
+          TAG: ${{ needs.resolve.outputs.tag }}
+          LABEL: ${{ matrix.label }}
+          COMMIT: ${{ needs.resolve.outputs.commit }}
+          SOURCE_REPO: leejet/stable-diffusion.cpp
+          LICENSE_FILE: ${{ github.workspace }}/src/LICENSE
+        run: python3 tooling/scripts/unsloth/package_bundle.py
+
+      - name: Upload bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: sd-${{ needs.resolve.outputs.tag }}-bin-${{ matrix.label }}
+          path: dist/sd-${{ needs.resolve.outputs.tag }}-bin-${{ matrix.label }}.zip
+          if-no-files-found: error
+
+  build-windows:
+    name: win-cpu-x64
+    needs: resolve
+    if: ${{ needs.resolve.outputs.exists != 'true' || github.event_name == 'workflow_dispatch' }}
+    runs-on: windows-2022
+    steps:
+      - name: Checkout mirror (tooling)
+        uses: actions/checkout@v4
+        with:
+          path: tooling
+          fetch-depth: 1
+
+      - name: Download source @ ${{ needs.resolve.outputs.tag }}
+        uses: actions/download-artifact@v4
+        with:
+          name: ${{ needs.resolve.outputs.source_artifact }}
+          path: srcpkg
+
+      - name: Extract source
+        shell: bash
+        run: |
+          set -eux
+          mkdir -p src
+          tar -xzf "srcpkg/sd-source-${{ needs.resolve.outputs.tag }}.tar.gz" -C src
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install Ninja
+        run: choco install ninja --no-progress
+      - name: Setup MSVC
+        uses: ilammy/msvc-dev-cmd@v1
+
+      - name: Build sd-cli + sd-server
+        shell: pwsh
+        working-directory: src
+        run: |
+          cmake -S . -B build -G Ninja `
+            -DCMAKE_BUILD_TYPE=Release `
+            -DCMAKE_CXX_FLAGS='/bigobj' `
+            -DSD_BUILD_EXAMPLES=ON `
+            -DSD_SERVER_BUILD_FRONTEND=OFF `
+            -DSD_WEBP=OFF -DSD_WEBM=OFF `
+            -DGGML_NATIVE=OFF
+          cmake --build build --config Release -j 3 --target sd-cli sd-server
+
+      - name: Package bundle
+        shell: pwsh
+        env:
+          BIN_DIR: ${{ github.workspace }}/src/build/bin
+          OUT_DIR: ${{ github.workspace }}/dist
+          TAG: ${{ needs.resolve.outputs.tag }}
+          LABEL: win-cpu-x64
+          COMMIT: ${{ needs.resolve.outputs.commit }}
+          SOURCE_REPO: leejet/stable-diffusion.cpp
+          LICENSE_FILE: ${{ github.workspace }}/src/LICENSE
+        run: python tooling/scripts/unsloth/package_bundle.py
+
+      - name: Upload bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: sd-${{ needs.resolve.outputs.tag }}-bin-win-cpu-x64
+          path: dist/sd-${{ needs.resolve.outputs.tag }}-bin-win-cpu-x64.zip
+          if-no-files-found: error
+
+  assemble:
+    name: Assemble + publish
+    needs: [resolve, build-unix, build-windows]
+    if: ${{ needs.resolve.outputs.exists != 'true' || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Checkout mirror (tooling)
+        uses: actions/checkout@v4
+        with:
+          path: tooling
+          fetch-depth: 1
+
+      - name: Download bundles
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          pattern: sd-*-bin-*
+          merge-multiple: true
+
+      - name: Fingerprint gate (every bundle carries the Unsloth mark)
+        run: |
+          set -euo pipefail
+          MARK='Compiled by the Unsloth team'
+          shopt -s nullglob
+          tmp="$(mktemp -d)"; fail=0; checked=0
+          for z in dist/sd-*-bin-*.zip; do
+            rm -rf "$tmp/x"; mkdir -p "$tmp/x"
+            unzip -qo "$z" -d "$tmp/x"
+            if grep -arq "$MARK" "$tmp/x"; then checked=$((checked+1)); else echo "ERROR: $(basename "$z") missing fingerprint" >&2; fail=1; fi
+          done
+          rm -rf "$tmp"
+          [ "$checked" -gt 0 ] || { echo "ERROR: no bundles to verify" >&2; exit 1; }
+          [ "$fail" = 0 ] || exit 1
+          echo "fingerprint verified in $checked bundles"
+
+      - name: Generate manifest + sha256 index
+        run: |
+          set -eux
+          python3 tooling/scripts/unsloth/assemble_metadata.py \
+            --tag '${{ needs.resolve.outputs.tag }}' \
+            --source-repo 'leejet/stable-diffusion.cpp' \
+            --commit '${{ needs.resolve.outputs.commit }}' \
+            --dist dist --out dist \
+            --publish-repo "$GITHUB_REPOSITORY"
+          ls -la dist
+
+      - name: Coverage gate (all 5 CPU/Apple assets present)
+        run: |
+          set -eu
+          TAG='${{ needs.resolve.outputs.tag }}'
+          fail=0
+          for f in \
+            "sd-${TAG}-bin-Darwin-macOS-arm64.zip" \
+            "sd-${TAG}-bin-Darwin-macOS-x86_64.zip" \
+            "sd-${TAG}-bin-Linux-Ubuntu-22.04-x86_64.zip" \
+            "sd-${TAG}-bin-Linux-Ubuntu-24.04-aarch64.zip" \
+            "sd-${TAG}-bin-win-cpu-x64.zip"; do
+            [ -s "dist/$f" ] || { echo "ERROR: missing $f" >&2; fail=1; }
+          done
+          [ "$fail" = 0 ] || { echo "ERROR: refusing to publish a partial release" >&2; exit 1; }
+
+      - name: Upload full set (artifact fallback)
+        uses: actions/upload-artifact@v4
+        with:
+          name: unsloth-sd-prebuilt-${{ needs.resolve.outputs.tag }}
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 7
+
+      - name: Publish GitHub release
+        if: ${{ (github.event_name == 'schedule' || inputs.publish) && needs.resolve.outputs.exists != 'true' }}
+        run: |
+          set -eux
+          TAG='${{ needs.resolve.outputs.tag }}'
+          REPO="$GITHUB_REPOSITORY"
+          NOTES="Automated Unsloth stable-diffusion.cpp CPU + Apple prebuild (sd-cli + sd-server) for upstream [${TAG}](https://github.com/leejet/stable-diffusion.cpp/releases/tag/${TAG}). GPU hosts use diffusers/torch; this native engine targets CPU (Linux/WSL/Windows) and Apple (Metal)."
+          if [ "$(gh release view "$TAG" --repo "$REPO" --json isDraft --jq .isDraft 2>/dev/null || true)" = "true" ]; then
+            gh release delete "$TAG" --repo "$REPO" --yes
+          fi
+          gh release create "$TAG" --repo "$REPO" --draft \
+            --title "stable-diffusion.cpp prebuilt $TAG" \
+            --notes "$NOTES" \
+            dist/*
+          gh release edit "$TAG" --repo "$REPO" --draft=false
diff --git a/scripts/unsloth/assemble_metadata.py b/scripts/unsloth/assemble_metadata.py
new file mode 100755
index 000000000..1017c6719
--- /dev/null
+++ b/scripts/unsloth/assemble_metadata.py
@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+# Copyright 2026-present the Unsloth AI Inc. team.
+
+"""Generate the release metadata for an Unsloth stable-diffusion.cpp prebuild.
+
+Writes two files next to the bundles:
+  * sd-prebuilt-sha256.json  -- {asset_name: sha256_hex} for every sd-*.zip
+  * sd-prebuilt-manifest.json -- tag / source / commit / per-asset {size, sha256, label}
+
+The Studio installer already verifies each asset against the GitHub-provided
+``digest``; the sha256 index is a second, self-hosted integrity source and the
+manifest is the authoritative bundle set (mirrors llama.cpp's prebuilt manifest).
+"""
+
+from __future__ import annotations
+
+import argparse
+import datetime as _dt
+import hashlib
+import json
+import re
+from pathlib import Path
+
+# Map an asset filename back to a host label, for the manifest (informational).
+_LABEL_RE = re.compile(r"^sd-.*-bin-(?P<label>.+)\.zip$")
+
+
+def _sha256(path: Path) -> str:
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        for chunk in iter(lambda: f.read(1 << 20), b""):
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--tag", required = True)
+    ap.add_argument("--source-repo", required = True)
+    ap.add_argument("--commit", required = True)
+    ap.add_argument("--dist", required = True, help = "dir holding the sd-*.zip bundles")
+    ap.add_argument("--out", required = True, help = "dir to write the metadata json into")
+    ap.add_argument("--publish-repo", required = True)
+    args = ap.parse_args()
+
+    dist = Path(args.dist)
+    out = Path(args.out)
+    out.mkdir(parents = True, exist_ok = True)
+
+    bundles = sorted(dist.glob("sd-*-bin-*.zip"))
+    if not bundles:
+        raise SystemExit(f"assemble_metadata: no sd-*-bin-*.zip found in {dist}")
+
+    sha_index: dict[str, str] = {}
+    assets: list[dict] = []
+    for b in bundles:
+        digest = _sha256(b)
+        sha_index[b.name] = digest
+        m = _LABEL_RE.match(b.name)
+        assets.append(
+            {
+                "name": b.name,
+                "label": m.group("label") if m else "",
+                "size": b.stat().st_size,
+                "sha256": digest,
+            }
+        )
+
+    manifest = {
+        "schema": 1,
+        "tag": args.tag,
+        "source_repo": args.source_repo,
+        "source_commit": args.commit,
+        "publish_repo": args.publish_repo,
+        "generated_at": _dt.datetime.now(_dt.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+        "assets": assets,
+    }
+
+    (out / "sd-prebuilt-sha256.json").write_text(json.dumps(sha_index, indent = 2) + "\n")
+    (out / "sd-prebuilt-manifest.json").write_text(json.dumps(manifest, indent = 2) + "\n")
+    print(f"assemble_metadata: {len(bundles)} bundles indexed for {args.tag}", flush = True)
+    for a in assets:
+        print(f"  {a['name']}  {a['size']} B  {a['sha256'][:12]}", flush = True)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/unsloth/assert_macho_minos.sh b/scripts/unsloth/assert_macho_minos.sh
new file mode 100755
index 000000000..69ffb11fb
--- /dev/null
+++ b/scripts/unsloth/assert_macho_minos.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MIT
+# Copyright 2026-present the Unsloth AI Inc. team.
+#
+# macOS load gate for the sd-cli / sd-server Mach-O binaries. Owning the build lets
+# us pin CMAKE_OSX_DEPLOYMENT_TARGET so the binary declares a load floor OLD enough
+# to run on the macOS versions we support; this asserts that actually happened, that
+# the arch is what we intended, and that the binary launches. Fails the job otherwise
+# so we never publish a bundle that dyld refuses to load on a supported macOS.
+#
+# Usage: assert_macho_minos.sh <bin_dir> <expect_arch: arm64|x86_64> <deploy_target: e.g. 14.0>
+
+set -euo pipefail
+
+BIN_DIR="${1:?usage: assert_macho_minos.sh <bin_dir> <expect_arch> <deploy_target>}"
+EXPECT_ARCH="${2:?expected arch (arm64|x86_64)}"
+DEPLOY_TARGET="${3:?deploy target, e.g. 14.0}"
+
+# a <= b using version sort.
+ver_le() { [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]; }
+
+fail=0
+checked=0
+
+for name in sd-cli sd-server; do
+  bin="$BIN_DIR/$name"
+  if [ ! -f "$bin" ]; then
+    echo "note: $name not present in $BIN_DIR; skipping"
+    continue
+  fi
+  checked=$((checked + 1))
+  echo "== $name =="
+
+  # Architecture.
+  archs="$(lipo -archs "$bin" 2>/dev/null || echo unknown)"
+  case " $archs " in
+    *" $EXPECT_ARCH "*) echo "  arch: $archs (ok)" ;;
+    *) echo "  ERROR: arch [$archs] does not contain $EXPECT_ARCH"; fail=1 ;;
+  esac
+
+  # Minimum OS: LC_BUILD_VERSION 'minos', or the legacy LC_VERSION_MIN_MACOSX 'version'.
+  minos="$(otool -l "$bin" 2>/dev/null | awk '
+    /LC_BUILD_VERSION/     {inbv=1}
+    /LC_VERSION_MIN_MACOSX/{invm=1}
+    inbv && $1=="minos"    {print $2; exit}
+    invm && $1=="version"  {print $2; exit}
+  ')"
+  if [ -n "$minos" ]; then
+    if ver_le "$minos" "$DEPLOY_TARGET"; then
+      echo "  minos: $minos <= $DEPLOY_TARGET (ok)"
+    else
+      echo "  ERROR: minos $minos > deploy target $DEPLOY_TARGET (won't load on older macOS)"
+      fail=1
+    fi
+  else
+    echo "  WARNING: no minos load command found"
+  fi
+
+  # Launch check: the runner is the same arch we built for, so this exercises dyld.
+  # sd-cli may exit non-zero on --help; treat a clean or usage exit as launched, and
+  # only warn (not fail) so a help-text convention change doesn't block a release.
+  if "$bin" --help >/dev/null 2>&1 || "$bin" -h >/dev/null 2>&1 || "$bin" >/dev/null 2>&1; then
+    echo "  launch: ok"
+  else
+    rc=$?
+    if [ "$rc" -ge 126 ]; then
+      echo "  ERROR: $name failed to launch (exit $rc: dyld/exec error)"; fail=1
+    else
+      echo "  launch: exited $rc (usage/no-args; treated as launched)"
+    fi
+  fi
+done
+
+[ "$checked" -gt 0 ] || { echo "ERROR: no binaries found in $BIN_DIR"; exit 1; }
+[ "$fail" = 0 ] || { echo "ERROR: macOS load gate failed"; exit 1; }
+echo "macOS load gate passed ($checked binaries, arch=$EXPECT_ARCH, floor<=$DEPLOY_TARGET)"
diff --git a/scripts/unsloth/package_bundle.py b/scripts/unsloth/package_bundle.py
new file mode 100755
index 000000000..4886a4dc2
--- /dev/null
+++ b/scripts/unsloth/package_bundle.py
@@ -0,0 +1,119 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: MIT
+# Copyright 2026-present the Unsloth AI Inc. team.
+
+"""Package a built stable-diffusion.cpp bin directory into a release zip.
+
+Mirrors the asset naming the Unsloth Studio installer's ``resolve_release_asset``
+(studio/install_sd_cpp_prebuilt.py) already expects, so the Studio can point at
+this mirror with only a repo/tag flip. Reads everything from env so the same
+script serves every OS matrix leg:
+
+    BIN_DIR   build output dir holding sd-cli / sd-server (and any sibling libs)
+    OUT_DIR   where to write the .zip
+    TAG       release tag, e.g. master-741-484baa4
+    LABEL     asset label, e.g. Darwin-macOS-arm64 / Linux-Ubuntu-24.04-x86_64 / win-cpu-x64
+    COMMIT    source commit SHA (provenance)
+    SOURCE_REPO   e.g. leejet/stable-diffusion.cpp
+    LICENSE_FILE  path to the LICENSE to include (optional)
+
+The zip unpacks into a single named dir ``sd-<TAG>-bin-<LABEL>/`` containing the
+binaries, their sibling runtime libs, LICENSE, and an UNSLOTH_BUILD.txt provenance
+file (also the fingerprint the assemble step greps for). The Studio finder rglobs
+for sd-cli / sd-server, so the internal layout is not load-bearing.
+"""
+
+from __future__ import annotations
+
+import datetime as _dt
+import os
+import sys
+import zipfile
+from pathlib import Path
+
+# Binaries we ship, plus the runtime-library extensions to sweep in alongside them
+# (static builds usually have none; Metal / a shared ggml can add a few).
+_BINARIES = ("sd-cli", "sd-server", "sd-cli.exe", "sd-server.exe")
+_LIB_SUFFIXES = (".dylib", ".so", ".dll", ".metal", ".metallib")
+
+_FINGERPRINT = "Compiled by the Unsloth team"
+
+
+def _env(name: str) -> str:
+    val = os.environ.get(name, "").strip()
+    if not val:
+        print(f"package_bundle: missing required env {name}", file = sys.stderr)
+        raise SystemExit(2)
+    return val
+
+
+def _collect(bin_dir: Path) -> list[Path]:
+    """The binaries + sibling runtime libs to ship. Recurse so a nested bin/ layout
+    (some generators emit build/bin/, some build/bin/Release/) is still captured."""
+    found: list[Path] = []
+    for p in sorted(bin_dir.rglob("*")):
+        if not p.is_file():
+            continue
+        if p.name in _BINARIES or p.suffix.lower() in _LIB_SUFFIXES:
+            found.append(p)
+    return found
+
+
+def main() -> int:
+    bin_dir = Path(_env("BIN_DIR"))
+    out_dir = Path(_env("OUT_DIR"))
+    tag = _env("TAG")
+    label = _env("LABEL")
+    commit = os.environ.get("COMMIT", "").strip() or "unknown"
+    source_repo = os.environ.get("SOURCE_REPO", "").strip() or "leejet/stable-diffusion.cpp"
+    license_file = os.environ.get("LICENSE_FILE", "").strip()
+
+    if not bin_dir.is_dir():
+        print(f"package_bundle: BIN_DIR {bin_dir} is not a directory", file = sys.stderr)
+        return 2
+
+    files = _collect(bin_dir)
+    have_cli = any(f.name in ("sd-cli", "sd-cli.exe") for f in files)
+    if not have_cli:
+        print(f"package_bundle: no sd-cli under {bin_dir}; refusing to package", file = sys.stderr)
+        return 1
+    have_server = any(f.name in ("sd-server", "sd-server.exe") for f in files)
+
+    out_dir.mkdir(parents = True, exist_ok = True)
+    stem = f"sd-{tag}-bin-{label}"
+    zip_path = out_dir / f"{stem}.zip"
+
+    built_at = _dt.datetime.now(_dt.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    provenance = (
+        f"{_FINGERPRINT}.\n"
+        f"stable-diffusion.cpp prebuilt (Unsloth mirror)\n"
+        f"tag: {tag}\n"
+        f"label: {label}\n"
+        f"source_repo: {source_repo}\n"
+        f"source_commit: {commit}\n"
+        f"built_at: {built_at}\n"
+        f"binaries: {'sd-cli' + (' sd-server' if have_server else '')}\n"
+    )
+
+    # Deterministic-ish: sort members; drop the archive if it already exists.
+    zip_path.unlink(missing_ok = True)
+    with zipfile.ZipFile(zip_path, "w", compression = zipfile.ZIP_DEFLATED) as zf:
+        for f in files:
+            # Flatten under the named top-level dir; keep just the basename so the
+            # binaries sit at sd-<tag>-bin-<label>/<name> regardless of build layout.
+            zf.write(f, arcname = f"{stem}/{f.name}")
+        zf.writestr(f"{stem}/UNSLOTH_BUILD.txt", provenance)
+        if license_file and Path(license_file).is_file():
+            zf.write(license_file, arcname = f"{stem}/LICENSE")
+
+    size_mb = zip_path.stat().st_size / (1024 * 1024)
+    print(
+        f"package_bundle: wrote {zip_path} ({size_mb:.1f} MiB); "
+        f"sd-cli=yes sd-server={'yes' if have_server else 'no'} files={len(files)}",
+        flush = True,
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())