diff --git a/tooling/render-config.sh b/tooling/render-config.sh
new file mode 100755
index 0000000..b1eeb9c
--- /dev/null
+++ b/tooling/render-config.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# render-config.sh — turn *.tmpl files into real configs via envsubst.
+# Substitutes ONLY ${BASE_DOMAIN} and ${HOST_LAN_IP} so literal $-syntax that
+# belongs to the target file (dnsmasq, caddy, toml) is left untouched.
+# Halts on any unset var or missing template (cautious: no half-rendered output).
+set -euo pipefail
+
+cd "$(dirname "$0")/.."   # repo root
+
+[ -f .env ] && { set -a; . ./.env; set +a; }
+: "${BASE_DOMAIN:?BASE_DOMAIN unset (set in .env)}"
+: "${HOST_LAN_IP:?HOST_LAN_IP unset (set in .env)}"
+
+render() {  # $1=template  $2=output
+  [ -f "$1" ] || { echo "missing template: $1" >&2; exit 1; }
+  envsubst '${BASE_DOMAIN} ${HOST_LAN_IP}' < "$1" > "$2"
+  echo "rendered $2"
+}
+
+render drasl/config/config.toml.tmpl drasl/config/config.toml
+render dnsmasq/dnsmasq.conf.tmpl      dnsmasq/dnsmasq.conf