diff --git a/scripts/run/forge.sh b/scripts/run/forge.sh
index c29255f..d234a42 100755
--- a/scripts/run/forge.sh
+++ b/scripts/run/forge.sh
@@ -74,6 +74,7 @@ Forgejo origin lifecycle (DigitalOcean). Needs ~/.vault/do_pat_cocotte + the coc
   ./run forge:down   stop + snapshot + destroy  (~$6/mo -> ~$0.30/mo idle)
   ./run forge:up     restore from newest snapshot, refresh vault creds (auto-looks up key ID)
   ./run forge:dns    ensure 'ctforge' /etc/hosts shortcut (now via net-tools DX infra + net sync; fallback local)
+  ./run forge:setup-registries   (one-time after up: deploy verdaccio/pypi/swift services on the droplet if not in snapshot)
 EOF
 }
 
@@ -95,6 +96,19 @@ cmd_forge_dns() {
   echo "/etc/hosts: $name -> $ip   →  http://$name:3000  (also via 'net sync')"
 }
 
+cmd_forge_setup_registries() {
+  # One-time setup of new publish services on the ct-forge droplet (verdaccio, pypi, swift).
+  # Run after ./run forge:up if the snapshot doesn't have the updated compose/services.
+  # Uses docker compose on the droplet (updated via the uvlava TF cloud-init/forge.yaml).
+  # See uvlava/terraform/do/cloud-init/forge.yaml for the compose with pypiserver + swift note.
+  local ip
+  ip="$(grep -E '^FORGE_IP=' "$_VAULT_CREDS" 2>/dev/null | cut -d= -f2)"
+  [ -n "$ip" ] || { echo "no FORGE_IP in $_VAULT_CREDS" >&2; return 1; }
+  echo "Setting up registries on ct-forge at $ip (verdaccio npm, pypi, swift via forgejo)..."
+  ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -i ~/.ssh/id_cocotte_fleet root@"$ip" 'cd /opt/forge && docker compose pull && docker compose up -d && echo "registries up (check docker ps)"' || echo "SSH/setup failed; ensure keys and compose has the services from TF."
+  echo "Update DNS if needed. Publish using the ct URLs (npm.ct, pypi.ct, swift.ct). Run this after changes to compose."
+}
+
 cmd_forge_down() {
   local id ip aid snap
   id="$(_forge_droplet_id)"