diff --git a/docs/build.html b/docs/build.html
index 76de1f4..ceaefa7 100644
--- a/docs/build.html
+++ b/docs/build.html
@@ -11,6 +11,15 @@
       <div class="meta">Node/Next build, Docker multi-stage, registry push, kubectl rollout.</div>
     </header>
     <main class="grid">
+      <section class="card">
+        <h2>Local prerequisites (macOS)</h2>
+        <ul>
+          <li>Run <code>./scripts/install-mac-prereqs.sh</code> to install dev/test tools via Homebrew (Node 20, envsubst/gettext, kubectl, sops, Trivy, Docker Desktop).</li>
+          <li>Requires Homebrew pre-installed; set <code>SKIP_TRIVY=1</code> and/or <code>SKIP_SOPS=1</code> to avoid optional security tools.</li>
+          <li>After install, open Docker.app once so the daemon is running before you build or run ZAP/Trivy scans.</li>
+        </ul>
+      </section>
+
       <section class="card">
         <h2>Pipeline at a glance</h2>
         <div class="diagram">
diff --git a/scripts/install-mac-prereqs.sh b/scripts/install-mac-prereqs.sh
new file mode 100644
index 0000000..4e31a8b
--- /dev/null
+++ b/scripts/install-mac-prereqs.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# macOS prerequisite installer for Lomavuokraus development/testing.
+# Installs core tools via Homebrew: Node.js 20, envsubst (gettext), kubectl, sops, Trivy, and Docker Desktop.
+# Env opts:
+#   SKIP_TRIVY=1  -> skip installing Trivy
+#   SKIP_SOPS=1   -> skip installing sops
+
+log() {
+  echo "[mac-prereqs] $*"
+}
+
+warn() {
+  echo "[mac-prereqs][warn] $*" >&2
+}
+
+require_macos() {
+  if [[ "$(uname -s)" != "Darwin" ]]; then
+    warn "This installer is for macOS only."
+    exit 1
+  fi
+}
+
+require_brew() {
+  if command -v brew >/dev/null 2>&1; then
+    return
+  fi
+  warn "Homebrew is required but not found."
+  warn "Install Homebrew first, e.g.:"
+  warn '  /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"'
+  exit 1
+}
+
+install_formula() {
+  local formula="$1"
+  if brew list --formula "$formula" >/dev/null 2>&1; then
+    log "Formula already installed: $formula"
+    return
+  fi
+  log "Installing $formula..."
+  brew install "$formula"
+}
+
+install_cask() {
+  local cask="$1"
+  if brew list --cask "$cask" >/dev/null 2>&1; then
+    log "Cask already installed: $cask"
+    return
+  fi
+  log "Installing cask $cask..."
+  brew install --cask "$cask"
+}
+
+ensure_node20() {
+  local current_major=""
+  if command -v node >/dev/null 2>&1; then
+    current_major="$(node -v | sed -E 's/^v([0-9]+).*/\1/')"
+  fi
+
+  if [[ -n "$current_major" && "$current_major" -ge 20 ]]; then
+    log "Node.js already at v${current_major} (>=20); skipping install."
+    return
+  fi
+
+  install_formula "node@20"
+  log "Linking node@20 into PATH..."
+  brew link --overwrite --force node@20
+}
+
+ensure_envsubst() {
+  if command -v envsubst >/dev/null 2>&1; then
+    log "envsubst already available."
+    return
+  fi
+
+  install_formula "gettext"
+  if ! command -v envsubst >/dev/null 2>&1; then
+    log "Linking gettext to expose envsubst..."
+    brew link --force gettext
+  fi
+
+  if ! command -v envsubst >/dev/null 2>&1; then
+    warn "envsubst still not in PATH. Add $(brew --prefix)/opt/gettext/bin to PATH."
+  fi
+}
+
+require_macos
+require_brew
+
+ensure_node20
+ensure_envsubst
+install_formula "kubectl"
+[[ "${SKIP_SOPS:-0}" == "1" ]] || install_formula "sops"
+[[ "${SKIP_TRIVY:-0}" == "1" ]] || install_formula "trivy"
+install_cask "docker"
+
+log "Done. Launch Docker.app once so the Docker daemon is available."