diff --git a/configs/nym/entrypoint.sh b/configs/nym/entrypoint.sh
new file mode 100755
index 0000000..191d575
--- /dev/null
+++ b/configs/nym/entrypoint.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+# Map env → nym-node run. Bonding / wallet stay outside this container.
+set -euo pipefail
+
+export HOME="${NYM_HOME:-/var/lib/nym}"
+ID="${NYMNODE_ID:-koopa-nym}"
+MODE="${NYMNODE_MODE:-mixnode}"
+PUBLIC_IPS="${NYMNODE_PUBLIC_IPS:-}"
+LOCATION="${NYMNODE_LOCATION:-}"
+HOSTNAME_OPT="${NYMNODE_HOSTNAME:-}"
+WG="${NYMNODE_WG_ENABLED:-false}"
+HTTP_BIND="${NYMNODE_HTTP_BIND_ADDRESS:-[::]:8080}"
+MIX_BIND="${NYMNODE_MIXNET_BIND_ADDRESS:-[::]:1789}"
+VERLOC_BIND="${NYMNODE_VERLOC_BIND_ADDRESS:-[::]:1790}"
+ENTRY_BIND="${NYMNODE_ENTRY_BIND_ADDRESS:-[::]:9000}"
+ACCEPT_TC="${NYMNODE_ACCEPT_OPERATOR_TERMS:-true}"
+
+ARGS=(run --id "$ID" --mode "$MODE" --no-banner)
+ARGS+=(--http-bind-address "$HTTP_BIND")
+ARGS+=(--mixnet-bind-address "$MIX_BIND")
+ARGS+=(--verloc-bind-address "$VERLOC_BIND")
+ARGS+=(--entry-bind-address "$ENTRY_BIND")
+
+if [ -n "$PUBLIC_IPS" ]; then
+  ARGS+=(--public-ips "$PUBLIC_IPS")
+fi
+if [ -n "$LOCATION" ]; then
+  ARGS+=(--location "$LOCATION")
+fi
+if [ -n "$HOSTNAME_OPT" ]; then
+  ARGS+=(--hostname "$HOSTNAME_OPT")
+fi
+if [ "$WG" = "true" ] || [ "$WG" = "1" ]; then
+  ARGS+=(--wireguard-enabled true)
+  # containers often lack kernel WG
+  ARGS+=(--wireguard-userspace true)
+fi
+if [ "$ACCEPT_TC" = "true" ] || [ "$ACCEPT_TC" = "1" ]; then
+  ARGS+=(--accept-operator-terms-and-conditions)
+fi
+
+# Extra flags from operator (space-separated)
+if [ -n "${NYMNODE_EXTRA_ARGS:-}" ]; then
+  # shellcheck disable=SC2206
+  EXTRA=( $NYMNODE_EXTRA_ARGS )
+  ARGS+=("${EXTRA[@]}")
+fi
+
+exec nym-node "${ARGS[@]}"