diff --git a/deployments/headscale/deploy.sh b/deployments/headscale/deploy.sh
index 437b5f1..f8736a3 100644
--- a/deployments/headscale/deploy.sh
+++ b/deployments/headscale/deploy.sh
@@ -274,6 +274,17 @@ while (( $(date +%s) < deadline )); do
     sleep 5
 done
 
+# Convenience: a `headscale` command on the host that runs the CLI inside the
+# container from ANY directory (plain `docker compose` needs to be run from
+# $STACK_DIR). STACK_DIR is baked in; "$@" is passed through.
+cat > /usr/local/bin/headscale <<EOF
+#!/bin/sh
+# Auto-generated by headscale deploy.sh -- runs the headscale CLI in-container.
+exec docker compose -f "$STACK_DIR/docker-compose.yml" exec headscale headscale "\$@"
+EOF
+chmod +x /usr/local/bin/headscale
+log "Installed /usr/local/bin/headscale (runs the CLI inside the container)."
+
 echo
 log "Stack status:"
 docker compose ps
@@ -290,19 +301,19 @@ Stack dir:   ${STACK_DIR}
 OIDC redirect/callback URI -- register THIS in your pocket-id client:
   https://${HEADSCALE_DOMAIN}/oidc/callback
 
-Bootstrap a user (run from $STACK_DIR):
-  docker compose exec headscale headscale users create alice
-  docker compose exec headscale headscale users list
+Headscale CLI -- use the installed wrapper from anywhere:
+  headscale users create alice
+  headscale users list
+  headscale nodes list
+  headscale --help
+  # (equivalent: cd $STACK_DIR && docker compose exec headscale headscale ...)
 
 Tailscale client login:
   tailscale up --login-server https://${HEADSCALE_DOMAIN}
   # Browser opens, OIDC flow via pocket-id, node registers.
 
-CLI inside the container:
-  docker compose exec headscale headscale --help
-  docker compose exec headscale headscale nodes list
-
-Manage:
+Manage (run from $STACK_DIR):
+  cd $STACK_DIR
   docker compose logs -f
   docker compose pull && docker compose up -d   # update
   docker compose down                            # stop, keep volumes