diff --git a/scripts/update.sh b/scripts/update.sh
index 3019f72..4c14f1d 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -48,13 +48,11 @@ git pull --ff-only
 [ -f .env ] || cp .env.example .env
 
 echo "==> syncing tracked config values from .env.example"
-# ponytail: gum (charmbracelet/gum) is a single static binary, fetched as a
-# release tarball — no build step, no package-manager dependency. Cached
-# under .cache/gum/ (gitignored) so repeat runs don't re-download. Release
-# asset naming (gum_<ver>_Linux_<arch>.tar.gz) follows charm's standard
-# goreleaser convention but hasn't been exercised against a real download
-# on this exact host yet — if it 404s, check
-# https://github.com/charmbracelet/gum/releases for the current naming.
+# ponytail: gum (charmbracelet/gum) is a single static binary. Vendored as
+# a release tarball under scripts/vendor/ (checked into git) for the R9700
+# box, which has no outbound internet access — the download fallback below
+# is only for other archs / when the vendored copy is missing or stale.
+# Cached under .cache/gum/ (gitignored) so repeat runs don't re-extract.
 GUM_VERSION="0.14.5"
 GUM_DIR="$(pwd)/.cache/gum"
 GUM_BIN="$GUM_DIR/gum"
@@ -62,17 +60,23 @@ ensure_gum() {
   command -v gum >/dev/null 2>&1 && { echo "gum"; return; }
   [ -x "$GUM_BIN" ] && { echo "$GUM_BIN"; return; }
   mkdir -p "$GUM_DIR"
-  local arch tmpdir url
+  local arch tmpdir vendored
   case "$(uname -m)" in
     x86_64) arch="x86_64" ;;
     aarch64|arm64) arch="arm64" ;;
     *) echo "no gum build for $(uname -m), falling back to plain prompts" >&2; echo ""; return ;;
   esac
-  url="https://github.com/charmbracelet/gum/releases/download/v${GUM_VERSION}/gum_${GUM_VERSION}_Linux_${arch}.tar.gz"
   tmpdir="$(mktemp -d)"
-  if ! curl -fsSL "$url" | tar -xz -C "$tmpdir" 2>/dev/null; then
-    echo "couldn't download gum from $url (no internet egress? falling back to plain prompts)" >&2
+  vendored="$(pwd)/scripts/vendor/gum_${GUM_VERSION}_Linux_${arch}.tar.gz"
+  if [ -f "$vendored" ]; then
+    tar -xz -C "$tmpdir" -f "$vendored"
   else
+    local url="https://github.com/charmbracelet/gum/releases/download/v${GUM_VERSION}/gum_${GUM_VERSION}_Linux_${arch}.tar.gz"
+    if ! curl -fsSL "$url" | tar -xz -C "$tmpdir" 2>/dev/null; then
+      echo "no vendored gum for $arch and couldn't download from $url (no internet egress? falling back to plain prompts)" >&2
+    fi
+  fi
+  if [ -n "$(find "$tmpdir" -name gum -type f 2>/dev/null)" ]; then
     find "$tmpdir" -name gum -type f -exec cp {} "$GUM_BIN" \;
     chmod +x "$GUM_BIN" 2>/dev/null || true
   fi
diff --git a/scripts/vendor/gum_0.14.5_Linux_x86_64.tar.gz b/scripts/vendor/gum_0.14.5_Linux_x86_64.tar.gz
new file mode 100644
index 0000000..fcd9f83
Binary files /dev/null and b/scripts/vendor/gum_0.14.5_Linux_x86_64.tar.gz differ