diff --git a/scripts/deploy/create-npmrc.sh b/scripts/deploy/create-npmrc.sh
new file mode 100644
index 000000000..ce3df826c
--- /dev/null
+++ b/scripts/deploy/create-npmrc.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Create .npmrc_temp and .npmrc for Docker BuildKit / compose secrets.
+# Requires NPM_TOKEN in the environment.
+
+set -euo pipefail
+
+if [[ -z "${NPM_TOKEN:-}" ]]; then
+  echo "NPM_TOKEN is not set" >&2
+  exit 1
+fi
+
+cat <<EOF > .npmrc_temp
+@tria-plc:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=${NPM_TOKEN}
+always-auth=true
+EOF
+
+cp .npmrc_temp .npmrc
+echo "Created .npmrc_temp and .npmrc for private @tria-plc packages"