diff --git a/.env.example b/.env.example
index 27b4205..067377d 100644
--- a/.env.example
+++ b/.env.example
@@ -21,3 +21,6 @@ AUTH_SALT='generateme'
 SECURE_AUTH_SALT='generateme'
 LOGGED_IN_SALT='generateme'
 NONCE_SALT='generateme'
+
+# Multisite (subdomain install)
+# DOMAIN_CURRENT_SITE is derived from WP_HOME; no separate value needed here.
diff --git a/bin/bootstrap-secrets.sh b/bin/bootstrap-secrets.sh
new file mode 100755
index 0000000..fbaa783
--- /dev/null
+++ b/bin/bootstrap-secrets.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+if [ $# -lt 2 ]; then
+  echo "Usage: $0 <gcp-project> <secret-name> [version]" >&2
+  exit 1
+fi
+
+project="$1"
+secret_name="$2"
+version="${3:-latest}"
+
+if ! command -v gcloud >/dev/null 2>&1; then
+  echo "gcloud CLI is required but not found on PATH" >&2
+  exit 1
+fi
+
+root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+out_file="$root_dir/.env.local"
+
+if [ -e "$out_file" ]; then
+  read -r -p ".env.local already exists — overwrite? [y/N] " confirm
+  case "$confirm" in
+    [yY]*) ;;
+    *) echo "Aborted."; exit 1 ;;
+  esac
+fi
+
+umask 077
+gcloud secrets versions access "$version" \
+  --project "$project" \
+  --secret "$secret_name" \
+  > "$out_file"
+
+echo "Wrote $out_file"
diff --git a/bin/setup-local.sh b/bin/setup-local.sh
new file mode 100755
index 0000000..418e5f4
--- /dev/null
+++ b/bin/setup-local.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+root_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$root_dir"
+
+site_title="${1:-Canopy}"
+
+wp() {
+  if command -v ddev >/dev/null 2>&1 && ddev describe >/dev/null 2>&1; then
+    ddev exec wp "$@"
+  else
+    command wp "$@"
+  fi
+}
+
+if [ ! -f .env ]; then
+  echo ".env not found — copy .env.example to .env and fill in DB/WP_HOME first" >&2
+  exit 1
+fi
+
+domain_current_site="$(grep -E '^WP_HOME=' .env | sed -E "s/^WP_HOME=['\"]?https?:\/\/([^'\"\/]+).*/\1/")"
+
+if ! wp core is-installed --network 2>/dev/null; then
+  echo "==> Installing WordPress multisite network"
+  wp core multisite-install \
+    --subdomains \
+    --title="$site_title" \
+    --admin_user=admin \
+    --admin_email="admin@example.com" \
+    --admin_password="admin" \
+    --skip-email
+fi
+
+echo "==> Ensuring a seed subsite exists"
+if ! wp site list --field=url | grep -q "^https\?://riding\.${domain_current_site}"; then
+  wp site create --slug=riding --title="Riding Site"
+fi
+
+echo "==> Activating network plugins"
+wp plugin activate --network --all
+
+echo "Done. Admin: admin / admin"
diff --git a/config/application.php b/config/application.php
index 242709e..430025a 100644
--- a/config/application.php
+++ b/config/application.php
@@ -141,6 +141,19 @@
 Config::define('LOGGED_IN_SALT', env('LOGGED_IN_SALT'));
 Config::define('NONCE_SALT', env('NONCE_SALT'));
 
+/**
+ * Multisite (subdomain install)
+ */
+$wp_home = (object) parse_url(env('WP_HOME'));
+
+Config::define('WP_ALLOW_MULTISITE', true);
+Config::define('MULTISITE', true);
+Config::define('SUBDOMAIN_INSTALL', true);
+Config::define('DOMAIN_CURRENT_SITE', isset($wp_home->port) ? "{$wp_home->host}:{$wp_home->port}" : $wp_home->host);
+Config::define('PATH_CURRENT_SITE', '/');
+Config::define('SITE_ID_CURRENT_SITE', 1);
+Config::define('BLOG_ID_CURRENT_SITE', 1);
+
 /**
  * Custom Settings
  */