diff --git a/src/server/index.tsx b/src/server/index.tsx
index f8f40a2..ce5bbcb 100644
--- a/src/server/index.tsx
+++ b/src/server/index.tsx
@@ -59,9 +59,36 @@ app.all('/api/tools/:tool/:path{.+}', async c => {
   })
 })
 
+const BUILD_SCRIPT = import.meta.dir + '/../../scripts/build.ts'
 const DIST_DIR = import.meta.dir + '/../../dist'
 const INSTALL_SCRIPT = await Bun.file(import.meta.dir + '/install.sh').text()
 
+const BUILD_TARGETS = [
+  'toes-macos-arm64',
+  'toes-macos-x64',
+  'toes-linux-arm64',
+  'toes-linux-x64',
+]
+
+const buildInFlight = new Map<string, Promise<boolean>>()
+
+async function buildBinary(name: string): Promise<boolean> {
+  const existing = buildInFlight.get(name)
+  if (existing) return existing
+
+  const promise = (async () => {
+    const proc = Bun.spawn(
+      ['bun', 'run', BUILD_SCRIPT, `--target=${name}`],
+      { stdout: 'inherit', stderr: 'inherit' },
+    )
+    return (await proc.exited) === 0
+  })()
+
+  buildInFlight.set(name, promise)
+  promise.finally(() => buildInFlight.delete(name))
+  return promise
+}
+
 // Install script: curl -fsSL http://toes.local/install | bash
 app.get('/install', c => {
   if (!TOES_URL) return c.text('TOES_URL is not configured', 500)
@@ -69,7 +96,7 @@ app.get('/install', c => {
   return c.text(script, 200, { 'content-type': 'text/plain' })
 })
 
-// Serve built CLI binaries from dist/
+// Serve built CLI binaries from dist/, building on-demand if needed
 app.get('/dist/:file', async c => {
   const file = c.req.param('file')
   if (!file || file.includes('/') || file.includes('..')) {
@@ -77,9 +104,11 @@ app.get('/dist/:file', async c => {
   }
   const bunFile = Bun.file(`${DIST_DIR}/${file}`)
   if (!(await bunFile.exists())) {
-    return c.text(`Binary "${file}" not found — run cli:build:all on the server`, 404)
+    if (!BUILD_TARGETS.includes(file)) return c.text('Not found', 404)
+    const ok = await buildBinary(file)
+    if (!ok) return c.text(`Failed to build "${file}"`, 500)
   }
-  return new Response(bunFile, {
+  return new Response(Bun.file(`${DIST_DIR}/${file}`), {
     headers: { 'content-type': 'application/octet-stream' },
   })
 })