diff --git a/src/xceadmin/meson-install.sh b/src/xceadmin/meson-install.sh
new file mode 100755
index 00000000..48348abb
--- /dev/null
+++ b/src/xceadmin/meson-install.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# meson install-time script (meson.add_install_script) -- runs after the
+# xceadmin custom_target (build_by_default) has already installed+tested
+# into its own build-dir venv (meson-build.sh). This script does NOT copy
+# that venv wholesale: pip's generated console_scripts wrapper hardcodes
+# the *build-directory* absolute path in its shebang, which stops existing
+# once the build dir is cleaned up -- copying it verbatim into $out would
+# ship a binary with a shebang pointing at nowhere.
+#
+# Instead: copy just the xceadmin/xcecommon package dirs (pure files, no
+# shebang) into $out, and hand-write a wrapper whose shebang and PYTHONPATH
+# are resolved against *this* install script's own environment (python3
+# and the nix-provided pycapnp/pyyaml/jsonschema/click site-packages come
+# from nativeBuildInputs, same as every other phase of this derivation) --
+# every path baked in below is a real /nix/store path, so nix's reference
+# scanner picks each one up as a proper runtime dependency of $out.
+set -euo pipefail
+
+DESTDIR_PREFIX="$MESON_INSTALL_DESTDIR_PREFIX"
+PYTHON="$(command -v python3)"
+
+VENV_SITE_GLOB=("$MESON_BUILD_ROOT"/xceadmin/.venv/lib/python3.*/site-packages)
+VENV_SITE="${VENV_SITE_GLOB[0]}"
+if [ ! -d "$VENV_SITE/xceadmin" ]; then
+    echo "meson-install.sh: expected $VENV_SITE/xceadmin from the xceadmin build step, not found" >&2
+    exit 1
+fi
+
+SITE_DIR="$DESTDIR_PREFIX/lib/xceadmin-site"
+mkdir -p "$SITE_DIR" "$DESTDIR_PREFIX/bin"
+rm -rf "$SITE_DIR/xceadmin" "$SITE_DIR/xcecommon"
+cp -r "$VENV_SITE/xceadmin" "$VENV_SITE/xcecommon" "$SITE_DIR/"
+
+cat > "$DESTDIR_PREFIX/bin/xceadmin" <<WRAPPER
+#!/usr/bin/env bash
+export PYTHONPATH="$SITE_DIR:${PYTHONPATH:-}"
+exec "$PYTHON" -m xceadmin.cli "\$@"
+WRAPPER
+chmod +x "$DESTDIR_PREFIX/bin/xceadmin"
+
+echo "=== xceadmin (meson install): wrapper installed at $DESTDIR_PREFIX/bin/xceadmin ==="
diff --git a/src/xceadmin/meson.build b/src/xceadmin/meson.build
index f599613b..e6d26b07 100644
--- a/src/xceadmin/meson.build
+++ b/src/xceadmin/meson.build
@@ -32,3 +32,9 @@ xceadmin_stamp = custom_target('xceadmin',
   build_always_stale: true,
   console: true,
 )
+
+# Installs a standalone $out/bin/xceadmin -- runs after xceadmin_stamp
+# (ninja install always depends on build_by_default targets first) so the
+# build-dir venv it copies from already exists. See meson-install.sh for
+# why this isn't a plain `cp` of that venv.
+meson.add_install_script('meson-install.sh')