diff --git a/action.yml b/action.yml
index 26757b3..4dbc812 100644
--- a/action.yml
+++ b/action.yml
@@ -100,7 +100,9 @@ runs:
           echo "🛑 ENABLED=false → tearing down $SLUG"
           docker rm -f "$SLUG" >/dev/null 2>&1 && echo "  container removed" || echo "  no container"
           [ -n "$DOMAIN" ] && rm -rf "/srv/sites/${DOMAIN}"
-          if [ -f "$FRAG" ]; then rm -f "$FRAG"; reload_caddy || true; echo "  fragment removed + caddy reloaded"; fi
+          rm -f "/srv/platform/caddy/sites/${SLUG}-get.caddy" 2>/dev/null || true   # install subdomain, if any
+          [ -f "$FRAG" ] && rm -f "$FRAG"
+          reload_caddy || true; echo "  fragment(s) removed + caddy reloaded"
           echo "✅ $SLUG disabled (404)"
           exit 0
         fi
@@ -176,6 +178,32 @@ runs:
             echo "::endgroup::"
 
             write_fragment "$(printf '%s {\n\troot * /srv/sites/%s\n\tfile_server\n\ttry_files {path} /index.html\n}\n' "$SITE_ADDR" "$DOMAIN")"
+
+            # ---- optional install-script subdomain:  curl get.<domain> | sh ----
+            # Opt-in via .env  INSTALL_SH=<file in build output>  (e.g. install.sh).
+            # Serves that one file as text/plain at get.<domain> (self-managed
+            # fragment ${SLUG}-get.caddy, separate from the main one). Unset the var
+            # → the subdomain is removed on the next deploy. Dev must add the DNS
+            # A-record  get.<domain> → our IP  themselves.
+            GFRAG="/srv/platform/caddy/sites/${SLUG}-get.caddy"
+            if [ -n "${INSTALL_SH:-}" ]; then
+              GDOM="get.${DOMAIN}"
+              [ -f "/srv/sites/${DOMAIN}/${INSTALL_SH}" ] \
+                || echo "::warning::${INSTALL_SH} not in build output — ${GDOM} will 404 until you add public/${INSTALL_SH}"
+              dig +short A "$GDOM" 2>/dev/null | grep -q "$OUR_IP" \
+                || echo "::warning::no A record ${GDOM} → ${OUR_IP} yet — add it; TLS issues once it resolves"
+              GNEW=$(printf '%s {\n\troot * /srv/sites/%s\n\trewrite * /%s\n\theader Content-Type text/plain\n\tfile_server\n}\n' "$GDOM" "$DOMAIN" "$INSTALL_SH")
+              if [ ! -f "$GFRAG" ] || [ "$(cat "$GFRAG")" != "$GNEW" ]; then
+                printf '%s' "$GNEW" > "$GFRAG"
+                reload_caddy && echo "  install subdomain → https://${GDOM} (serves /${INSTALL_SH})" \
+                  || { echo "::error::caddy reload failed for $GFRAG"; rm -f "$GFRAG"; reload_caddy || true; }
+              else
+                echo "  install subdomain fragment unchanged"
+              fi
+            elif [ -f "$GFRAG" ]; then
+              rm -f "$GFRAG"; reload_caddy || true; echo "  install subdomain removed (INSTALL_SH unset)"
+            fi
+
             # Remove any prior container LAST — zero-downtime: a pre-existing
             # container kept serving the domain (via its old fragment) all through
             # the build above, until the file_server fragment took over just now.