diff --git a/tools/docker/mc-ai-entrypoint.sh b/tools/docker/mc-ai-entrypoint.sh
new file mode 100755
index 00000000..5cb4f327
--- /dev/null
+++ b/tools/docker/mc-ai-entrypoint.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# mc-ai-entrypoint.sh — installs the image-baked GDExtension .so into the
+# bind-mounted worktree's addons directory, then execs whatever command the
+# caller passed.
+#
+# Why: scripts/mc-ai-docker.sh bind-mounts the per-run scratch worktree at
+# /work so Godot sees the project tree, JSON game pack, and tools/ scripts.
+# The .so artifact in /opt/mc-ai/ was built from the same SHA when the image
+# was built; installing it into the worktree at container start guarantees
+# Godot loads the SHA-matched artifact and we never accidentally pick up a
+# stale .so the worktree might carry.
+
+set -euo pipefail
+
+ADDON_DIR="/work/src/game/engine/addons/magic_civ_physics"
+BAKED="/opt/mc-ai/libmagic_civ_physics.x86_64.so"
+
+if [[ ! -f "${BAKED}" ]]; then
+    echo "ERROR: baked .so missing at ${BAKED} — Dockerfile.mc-ai build is incomplete." >&2
+    exit 2
+fi
+
+if [[ ! -d "${ADDON_DIR}" ]]; then
+    echo "ERROR: ${ADDON_DIR} missing — bind-mount the project worktree at /work." >&2
+    exit 2
+fi
+
+install -m 0755 "${BAKED}" "${ADDON_DIR}/libmagic_civ_physics.x86_64.so"
+
+# Purge any stale macOS dylib the worktree may carry — Godot on Linux
+# shouldn't try to load it but pruning eliminates the question.
+rm -f "${ADDON_DIR}/libmagic_civ_physics.dylib"
+
+exec "$@"