diff --git a/configs/nym/.gitignore b/configs/nym/.gitignore
new file mode 100644
index 0000000..d5945aa
--- /dev/null
+++ b/configs/nym/.gitignore
@@ -0,0 +1,3 @@
+nym-node
+.env
+data/
diff --git a/configs/nym/Containerfile b/configs/nym/Containerfile
index ac6f003..3f4f504 100644
--- a/configs/nym/Containerfile
+++ b/configs/nym/Containerfile
@@ -1,39 +1,26 @@
 # koopa-nym — nym-node (nym.com mixnet / NymVPN network)
-# Docs: https://nym.com/docs/operators/nodes/nym-node
+# Fetch binary on host first (see scripts/nym/build.sh), then:
+#   podman build -t localhost/koopa-nym:latest -f Containerfile .
 FROM docker.io/library/debian:bookworm-slim
 
 ENV DEBIAN_FRONTEND=noninteractive \
     NYM_HOME=/var/lib/nym \
     PATH=/usr/local/bin:$PATH
 
-# Pin via build-arg when a new binary is released:
-#   https://github.com/nymtech/nym/releases
-ARG NYM_NODE_VERSION=1.35.0
-ARG NYM_NODE_URL=""
-
 RUN apt-get update \
  && apt-get install -y --no-install-recommends \
-      ca-certificates curl ca-certificates-java \
-      libssl3 \
+      ca-certificates libssl3 \
  && rm -rf /var/lib/apt/lists/* \
  && mkdir -p /var/lib/nym /usr/local/bin
 
-# Prefer explicit URL; else GitHub release asset pattern for linux x86_64.
-RUN set -eux; \
-  if [ -n "$NYM_NODE_URL" ]; then \
-    curl -fsSL -o /usr/local/bin/nym-node "$NYM_NODE_URL"; \
-  else \
-    curl -fsSL -o /usr/local/bin/nym-node \
-      "https://github.com/nymtech/nym/releases/download/nym-binaries-v${NYM_NODE_VERSION}/nym-node"; \
-  fi; \
-  chmod +x /usr/local/bin/nym-node; \
-  /usr/local/bin/nym-node --version || true
+# Pre-downloaded on host into build context as ./nym-node
+COPY nym-node /usr/local/bin/nym-node
+RUN chmod +x /usr/local/bin/nym-node \
+ && /usr/local/bin/nym-node --version || true
 
 COPY entrypoint.sh /usr/local/bin/nym-entrypoint
 RUN chmod +x /usr/local/bin/nym-entrypoint
 
-# Defaults inside container (host maps different ports — see compose.yml)
 EXPOSE 1789/udp 1789/tcp 1790 8080 9000 51822/udp
-
 WORKDIR /var/lib/nym
 ENTRYPOINT ["/usr/local/bin/nym-entrypoint"]
diff --git a/configs/nym/entrypoint.sh b/configs/nym/entrypoint.sh
index 191d575..374e90c 100755
--- a/configs/nym/entrypoint.sh
+++ b/configs/nym/entrypoint.sh
@@ -15,7 +15,7 @@ VERLOC_BIND="${NYMNODE_VERLOC_BIND_ADDRESS:-[::]:1790}"
 ENTRY_BIND="${NYMNODE_ENTRY_BIND_ADDRESS:-[::]:9000}"
 ACCEPT_TC="${NYMNODE_ACCEPT_OPERATOR_TERMS:-true}"
 
-ARGS=(run --id "$ID" --mode "$MODE" --no-banner)
+ARGS=(run --id "$ID" --mode "$MODE")
 ARGS+=(--http-bind-address "$HTTP_BIND")
 ARGS+=(--mixnet-bind-address "$MIX_BIND")
 ARGS+=(--verloc-bind-address "$VERLOC_BIND")
@@ -32,14 +32,12 @@ if [ -n "$HOSTNAME_OPT" ]; then
 fi
 if [ "$WG" = "true" ] || [ "$WG" = "1" ]; then
   ARGS+=(--wireguard-enabled true)
-  # containers often lack kernel WG
   ARGS+=(--wireguard-userspace true)
 fi
 if [ "$ACCEPT_TC" = "true" ] || [ "$ACCEPT_TC" = "1" ]; then
   ARGS+=(--accept-operator-terms-and-conditions)
 fi
 
-# Extra flags from operator (space-separated)
 if [ -n "${NYMNODE_EXTRA_ARGS:-}" ]; then
   # shellcheck disable=SC2206
   EXTRA=( $NYMNODE_EXTRA_ARGS )
diff --git a/scripts/nym/build.sh b/scripts/nym/build.sh
index fe6a2d7..271c6a4 100755
--- a/scripts/nym/build.sh
+++ b/scripts/nym/build.sh
@@ -1,10 +1,18 @@
 #!/bin/bash
-# Build localhost/koopa-nym:latest from configs/nym/Containerfile
+# Download nym-node + build localhost/koopa-nym:latest
 set -euo pipefail
 ROOT=$(cd "$(dirname "$0")/../.." && pwd)
 SRC="${NYM_SRC:-$ROOT/configs/nym}"
 TAG="${NYM_IMAGE:-localhost/koopa-nym:latest}"
+REL="${NYM_RELEASE_TAG:-nym-binaries-v2026.13-ziller}"
+URL="${NYM_NODE_URL:-https://github.com/nymtech/nym/releases/download/${REL}/nym-node}"
 cd "$SRC"
+if [ ! -x nym-node ] || [ "${NYM_FORCE_DOWNLOAD:-0}" = "1" ]; then
+  echo "download $URL"
+  curl -fsSL -L -o nym-node.tmp "$URL"
+  chmod +x nym-node.tmp
+  mv nym-node.tmp nym-node
+fi
+./nym-node --version || true
 podman build -t "$TAG" -f Containerfile .
 echo "built $TAG"
-podman image inspect "$TAG" --format '{{.Id}} {{.Created}}' 2>/dev/null || true