diff --git a/CloudronManifest.json b/CloudronManifest.json
index 0f720c0..90ffa62 100644
--- a/CloudronManifest.json
+++ b/CloudronManifest.json
@@ -7,7 +7,7 @@
   "contactEmail": "contact@ente.io",
   "tagline": "Open Source End-to-End Encrypted Photos & Authentication",
   "upstreamVersion": "1.0.0",
-  "version": "0.1.122",
+  "version": "0.1.123",
   "healthCheckPath": "/ping",
   "httpPort": 3080,
   "memoryLimit": 1073741824,
diff --git a/Dockerfile b/Dockerfile
index e28e52e..1930082 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -150,6 +150,12 @@ COPY --from=web-builder /build/web/accounts /app/web/accounts
 COPY --from=web-builder /build/web/auth /app/web/auth
 COPY --from=web-builder /build/web/cast /app/web/cast
 
+# Build Ente CLI and place binary in /app/code
+WORKDIR /app/code/cli
+RUN env GOFLAGS= GOMODCACHE=/tmp/cli-go-cache GO111MODULE=on go build -o /app/code/ente . && chmod +x /app/code/ente
+
+WORKDIR /app/code
+
 # Copy Museum server binary from builder stage to app directory (not data volume)
 RUN mkdir -p /app/museum-bin
 COPY --from=museum-builder /ente/server/museum /app/museum-bin/museum
diff --git a/POSTINSTALL.md b/POSTINSTALL.md
index 46a26bd..d1860f7 100644
--- a/POSTINSTALL.md
+++ b/POSTINSTALL.md
@@ -19,3 +19,9 @@ Before you can use Ente, you need to configure an S3-compatible storage service:
 1. Once S3 is configured, visit your app URL to create an admin account
 2. Configure your mobile apps to use your custom self-hosted server (Settings → Advanced → Custom Server)
 3. Enjoy your private, end-to-end encrypted photo storage! 
+
+## Ente CLI
+
+- The Ente CLI binary is pre-built at `/app/code/ente` inside the app container.
+- Open the Cloudron web terminal (working directory `/app/code`) and run commands with `./ente ...` or add `/app/code` to your `PATH`.
+- A writable CLI config template lives at `/app/data/home/.ente/config.yaml` for pointing the CLI to your instance.
diff --git a/start.sh b/start.sh
index 73b92e6..b33a321 100644
--- a/start.sh
+++ b/start.sh
@@ -22,6 +22,11 @@ log() {
 log "INFO" "Starting Ente Cloudron app"
 log "INFO" "Running in Cloudron environment with domain: ${CLOUDRON_APP_DOMAIN}"
 
+# Ensure HOME is writable (needed for CLI usage)
+HOME_DIR="/app/data/home"
+export HOME="$HOME_DIR"
+mkdir -p "$HOME"
+
 # Prevent infinite loops through startup flag
 if [ -f "/app/data/startup_in_progress" ]; then
   if [ "$(find /app/data/startup_in_progress -mmin +2)" ]; then
@@ -140,6 +145,19 @@ else
   write_default_s3_template
 fi
 
+# Seed Ente CLI configuration directory
+ENTE_CLI_CONFIG_DIR="$HOME/.ente"
+ENTE_CLI_CONFIG_FILE="$ENTE_CLI_CONFIG_DIR/config.yaml"
+if [ ! -f "$ENTE_CLI_CONFIG_FILE" ]; then
+  mkdir -p "$ENTE_CLI_CONFIG_DIR"
+  cat > "$ENTE_CLI_CONFIG_FILE" << EOF
+# Ente CLI configuration
+# Uncomment and set the host to point the CLI to this Cloudron deployment.
+#host: https://${CLOUDRON_APP_DOMAIN:-localhost}
+EOF
+  chown -R cloudron:cloudron "$HOME_DIR" || true
+fi
+
 S3_ACCESS_KEY="${S3_ACCESS_KEY:-$DEFAULT_S3_ACCESS_KEY}"
 S3_SECRET_KEY="${S3_SECRET_KEY:-$DEFAULT_S3_SECRET_KEY}"
 S3_ENDPOINT="${S3_ENDPOINT:-$DEFAULT_S3_ENDPOINT}"