diff --git a/scripts/taler-landing/deploy-landings.sh b/scripts/taler-landing/deploy-landings.sh
new file mode 100644
index 0000000..fe3eb07
--- /dev/null
+++ b/scripts/taler-landing/deploy-landings.sh
@@ -0,0 +1,72 @@
+#!/bin/bash
+# Install exchange + merchant landing pages inside containers and ensure nginx
+# listens on 9014 (exchange) / 9015 (merchant).
+#
+# Port map (wire these in Caddy / podman -p):
+#   9013  bank landing     (already on taler-hacktivism-bank)
+#   9014  exchange landing (taler-hacktivism-exchange-ansible)
+#   9015  merchant landing (taler-hacktivism)
+#
+# Run on koopa (host) with podman access.
+set -euo pipefail
+
+ROOT=$(cd "$(dirname "$0")/../.." && pwd)
+# allow override when files already on host /tmp
+SRC_EX="${SRC_EX:-$ROOT/configs/exchange-landing}"
+SRC_MER="${SRC_MER:-$ROOT/configs/merchant-landing}"
+SRC_QR="${SRC_QR:-$ROOT/configs/bank-landing/qrcode.min.js}"
+
+C_EX=taler-hacktivism-exchange-ansible
+C_MER=taler-hacktivism
+
+echo "=== exchange landing → $C_EX :9014 ==="
+# nginx may be missing on exchange image
+if ! podman exec "$C_EX" command -v nginx >/dev/null 2>&1; then
+  echo "installing nginx in $C_EX …"
+  podman exec "$C_EX" bash -c 'export DEBIAN_FRONTEND=noninteractive; apt-get update -qq && apt-get install -y -qq nginx'
+fi
+podman exec "$C_EX" mkdir -p /var/www/exchange-landing /etc/nginx/sites-available /etc/nginx/sites-enabled
+podman cp "$SRC_EX/index.html" "$C_EX:/var/www/exchange-landing/index.html"
+if [ -f "$SRC_QR" ]; then
+  podman cp "$SRC_QR" "$C_EX:/var/www/exchange-landing/qrcode.min.js"
+fi
+podman cp "$SRC_EX/nginx-landing.conf" "$C_EX:/etc/nginx/sites-available/exchange-landing"
+podman exec "$C_EX" bash -c '
+  ln -sfn /etc/nginx/sites-available/exchange-landing /etc/nginx/sites-enabled/exchange-landing
+  # ensure sites-enabled is included
+  if ! grep -q sites-enabled /etc/nginx/nginx.conf 2>/dev/null; then
+    sed -i "/http {/a\\    include /etc/nginx/sites-enabled/*;" /etc/nginx/nginx.conf 2>/dev/null || true
+  fi
+  nginx -t
+  if command -v systemctl >/dev/null && systemctl is-system-running >/dev/null 2>&1; then
+    systemctl enable nginx 2>/dev/null || true
+    systemctl restart nginx || nginx
+  else
+    nginx -s reload 2>/dev/null || nginx
+  fi
+  ss -lntp | grep 9014 || netstat -lntp 2>/dev/null | grep 9014 || true
+'
+
+echo "=== merchant landing → $C_MER :9015 ==="
+podman exec "$C_MER" mkdir -p /var/www/merchant-landing
+podman cp "$SRC_MER/index.html" "$C_MER:/var/www/merchant-landing/index.html"
+podman cp "$SRC_MER/nginx-landing.conf" "$C_MER:/etc/nginx/sites-available/merchant-landing"
+podman exec "$C_MER" bash -c '
+  ln -sfn /etc/nginx/sites-available/merchant-landing /etc/nginx/sites-enabled/merchant-landing
+  nginx -t
+  nginx -s reload 2>/dev/null || systemctl reload nginx 2>/dev/null || true
+  ss -lntp | grep 9015 || true
+'
+
+echo
+echo "=== inside-container checks ==="
+podman exec "$C_EX" curl -sS -m 3 -o /dev/null -w "exchange_landing=%{http_code}\n" http://127.0.0.1:9014/intro/ || true
+podman exec "$C_MER" curl -sS -m 3 -o /dev/null -w "merchant_landing=%{http_code}\n" http://127.0.0.1:9015/intro/ || true
+
+echo
+echo "PORTS TO WIRE (host → Caddy / firewall / podman -p):"
+echo "  9013  bank landing     (taler-hacktivism-bank)              already published"
+echo "  9014  exchange landing (taler-hacktivism-exchange-ansible)  NEEDS -p 9014:9014"
+echo "  9015  merchant landing (taler-hacktivism)                   NEEDS -p 9015:9015"
+echo
+echo "If host curl to :9014/:9015 fails, republish pasta ports (commit+replace) — see README."