diff --git a/.gitea/workflows/server-deploy.yml b/.gitea/workflows/server-deploy.yml
index cabdd28..75e6902 100644
--- a/.gitea/workflows/server-deploy.yml
+++ b/.gitea/workflows/server-deploy.yml
@@ -77,7 +77,7 @@ jobs:
                   # generated pb is committed under server/, but a proto change
                   # that someone regenerates in the same push should not depend
                   # on that ordering.
-                  flag server    '^(server/|shared/|proto/|go\.work)'
+                  flag server    '^(server/|shared/|proto/|default_steps/|go\.work)'
                   flag sitesvc   '^(sitesvc/|shared/|go\.work)'
                   flag admin     '^(admin/|shared/|go\.work)'
 
diff --git a/claude.md b/claude.md
index 903cb93..7af946b 100644
--- a/claude.md
+++ b/claude.md
@@ -117,7 +117,7 @@ Upload a public key, assign it per server, revoke softly. The agent diffs desire
 
 A library of reusable **steps** (bash or PowerShell scripts with declared inputs, outputs, and secret refs) composed into **workflows** targeting a set of servers. Running one snapshots the resolved steps into a `WorkflowRun`, then dispatches `RunStepCmd` over the agent command stream. Step stdout/stderr streams back as `StepOutputChunk` and is written to a log file on disk; the UI streams it live. Steps support `on_failure: stop|continue|retry`, per-run env passed between steps via `output_env`, and a per-run workspace directory the agent cleans up at the end.
 
-Default steps are seeded per org at boot (`SeedDefaultSteps`). Logs are swept by retention (`workflow_log_retention_days`; nil = 30 days, 0 = forever).
+Default steps are seeded per org at boot (`SeedDefaultSteps`) from `VANTAGE_DEFAULT_STEPS_DIR`, which `server/Dockerfile` bakes to `/opt/default-steps` from the repo's `default_steps/`. Deliberately **not** under `/data` — that is a bind mount, so the library would be editable from the host. Adding a step there means committing a file and rebuilding, which is why `default_steps/` is in the `server` rebuild trigger. Logs are swept by retention (`workflow_log_retention_days`; nil = 30 days, 0 = forever).
 
 ### Monitors
 
diff --git a/default_steps/step.bash.get_hostname.json b/default_steps/step.bash.get_hostname.json
new file mode 100644
index 0000000..1a4dcd3
--- /dev/null
+++ b/default_steps/step.bash.get_hostname.json
@@ -0,0 +1,12 @@
+{
+  "kind": "vantage.step/v1",
+  "name": "Get Host Name",
+  "description": "",
+  "interpreter": "bash",
+  "script": "HOSTNAME=$(hostname)\necho $HOSTNAME\necho \"HOSTNAME=$HOSTNAME\" \u003e\u003e $WORKFLOW_ENV",
+  "declared_outputs": [
+    "HOSTNAME"
+  ],
+  "declared_inputs": [],
+  "secret_refs": []
+}
\ No newline at end of file
diff --git a/default_steps/step.bash.list_directory.json b/default_steps/step.bash.list_directory.json
new file mode 100644
index 0000000..8e524f1
--- /dev/null
+++ b/default_steps/step.bash.list_directory.json
@@ -0,0 +1,16 @@
+{
+  "kind": "vantage.step/v1",
+  "name": "List Directory",
+  "description": "",
+  "interpreter": "bash",
+  "script": "if [ ! -e $path ]; then\n    echo \"file or directory doesn't exist: $path\"\n    exit 1\nfi\nls -l $path",
+  "declared_outputs": [],
+  "declared_inputs": [
+    {
+      "name": "path",
+      "default": "./",
+      "description": ""
+    }
+  ],
+  "secret_refs": []
+}
\ No newline at end of file
diff --git a/default_steps/step.bash.start_linx_service.json b/default_steps/step.bash.start_linx_service.json
new file mode 100644
index 0000000..0bbb1c7
--- /dev/null
+++ b/default_steps/step.bash.start_linx_service.json
@@ -0,0 +1,16 @@
+{
+  "kind": "vantage.step/v1",
+  "name": "Start Linux Service",
+  "description": "",
+  "interpreter": "bash",
+  "script": "echo \"starting service $serviceName\"\nsystemctl start $serviceName\nretVal=$?\nif [ $retVal -ne 0 ]; then\n    echo \"failed to start service\"\n    exit 1\nfi",
+  "declared_outputs": [],
+  "declared_inputs": [
+    {
+      "name": "serviceName",
+      "default": "",
+      "description": ""
+    }
+  ],
+  "secret_refs": []
+}
\ No newline at end of file
diff --git a/default_steps/step.bash.stop_linux_service.json b/default_steps/step.bash.stop_linux_service.json
new file mode 100644
index 0000000..f38e90b
--- /dev/null
+++ b/default_steps/step.bash.stop_linux_service.json
@@ -0,0 +1,16 @@
+{
+  "kind": "vantage.step/v1",
+  "name": "Stop Linux Service",
+  "description": "",
+  "interpreter": "bash",
+  "script": "echo \"stopping service $serviceName\"\nsystemctl stop $serviceName\nretVal=$?\nif [ $retVal -ne 0 ]; then\n    echo \"failed to stop service\"\n    exit 1\nfi",
+  "declared_outputs": [],
+  "declared_inputs": [
+    {
+      "name": "serviceName",
+      "default": "",
+      "description": ""
+    }
+  ],
+  "secret_refs": []
+}
\ No newline at end of file
diff --git a/default_steps/step.bash.wget.json b/default_steps/step.bash.wget.json
new file mode 100644
index 0000000..475d62e
--- /dev/null
+++ b/default_steps/step.bash.wget.json
@@ -0,0 +1,18 @@
+{
+  "kind": "vantage.step/v1",
+  "name": "WGET",
+  "description": "",
+  "interpreter": "bash",
+  "script": "out=$(mktemp -p ./)\necho \"Downloading file from $url\"\nwget -q $url -O $out\nretVal=$?\nif [ $retVal -ne 0 ]; then\n    echo \"failed to download file from url\"\n    exit 1\nfi\necho \"FILE_PATH=$out\" \u003e\u003e $WORKFLOW_ENV",
+  "declared_outputs": [
+    "FILE_PATH"
+  ],
+  "declared_inputs": [
+    {
+      "name": "url",
+      "default": "",
+      "description": ""
+    }
+  ],
+  "secret_refs": []
+}
\ No newline at end of file
diff --git a/server/Dockerfile b/server/Dockerfile
index 2cf4cfe..f4a698c 100644
--- a/server/Dockerfile
+++ b/server/Dockerfile
@@ -24,6 +24,9 @@ FROM scratch
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /vantage-server /vantage-server
 
+COPY default_steps/ /opt/default-steps/
+ENV VANTAGE_DEFAULT_STEPS_DIR=/opt/default-steps
+
 EXPOSE 8080 9090
 
 ENTRYPOINT ["/vantage-server"]