diff --git a/scripts/create-env.sh b/scripts/create-env.sh
new file mode 100755
index 0000000..93ba110
--- /dev/null
+++ b/scripts/create-env.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# Usage:
+#   ./scripts/create-env.sh          → creates .env (dev)
+#   ./scripts/create-env.sh prod      → creates .env.production
+set -euo pipefail
+
+TARGET="${1:-dev}"
+if [[ "$TARGET" == "prod" ]]; then
+  FILE=".env.production"
+  NODE_ENV="production"
+  DB_HOST="postgres"
+  SITE_URL="https://shumiland.com.ua"
+else
+  FILE=".env"
+  NODE_ENV="development"
+  DB_HOST="localhost"
+  SITE_URL="http://localhost:3000"
+fi
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+OUT="$ROOT/$FILE"
+
+if [[ -f "$OUT" ]]; then
+  echo "⚠️  $FILE already exists. Overwrite? [y/N]"
+  read -r CONFIRM
+  [[ "$CONFIRM" =~ ^[Yy]$ ]] || { echo "Aborted."; exit 0; }
+fi
+
+gen() { openssl rand -base64 32 | tr -d '=+/' | head -c 48; }
+
+POSTGRES_PASSWORD="$(gen)"
+PAYLOAD_SECRET="$(gen)"
+REVALIDATE_SECRET="$(gen)"
+SYNC_SECRET="$(gen)"
+CRON_SECRET="$(gen)"
+
+cat > "$OUT" << EOF
+# ─── Database ────────────────────────────────────────────────────────────────
+DATABASE_URL=postgresql://shumiland:${POSTGRES_PASSWORD}@${DB_HOST}:5432/shumiland
+POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+
+# ─── Payload CMS ─────────────────────────────────────────────────────────────
+PAYLOAD_SECRET=${PAYLOAD_SECRET}
+
+# ─── Next.js ─────────────────────────────────────────────────────────────────
+NEXT_PUBLIC_SITE_URL=${SITE_URL}
+
+# ─── Node ────────────────────────────────────────────────────────────────────
+NODE_ENV=${NODE_ENV}
+
+# ─── ezy.com.ua ──────────────────────────────────────────────────────────────
+EZY_PARTNER_KEY=DBBzR-vLcXd-PsQ8wf1oXkti8x0yTKCCUi2J69f8DClbXT
+EZY_ACTIVITY=fda5a0acfe1dad42867ea88dbe13008a10c391f2
+
+# ─── Telegram ────────────────────────────────────────────────────────────────
+TELEGRAM_BOT_TOKEN=8707306864:AAG1UpYFb39m7FVFh5Hkg6TBj-G8O9OSSQ4
+TELEGRAM_CHAT_ID=5464970026
+
+# ─── Resend ──────────────────────────────────────────────────────────────────
+RESEND_API_KEY=re_Y51MgfQN_NNj7jn9z1acWmPDtMSDjzzGr
+MANAGER_EMAILS=admin@ai-impress.com
+
+# ─── Binotel ─────────────────────────────────────────────────────────────────
+BINOTEL_HMAC_SECRET=
+
+# ─── Revalidation / Sync / Cron ──────────────────────────────────────────────
+REVALIDATE_SECRET=${REVALIDATE_SECRET}
+SYNC_SECRET=${SYNC_SECRET}
+CRON_SECRET=${CRON_SECRET}
+
+# ─── Certbot (prod only) ─────────────────────────────────────────────────────
+CERTBOT_DOMAIN=shumiland.com.ua
+CERTBOT_EMAIL=admin@ai-impress.com
+EOF
+
+echo "✅  Created $FILE"
+echo "   POSTGRES_PASSWORD : ${POSTGRES_PASSWORD}"
+echo "   PAYLOAD_SECRET    : ${PAYLOAD_SECRET}"
+echo "   REVALIDATE_SECRET : ${REVALIDATE_SECRET}"
+echo "   SYNC_SECRET       : ${SYNC_SECRET}"
+echo "   CRON_SECRET       : ${CRON_SECRET}"
+echo ""
+echo "⚠️  Fill in BINOTEL_HMAC_SECRET manually when available."