diff --git a/README.md b/README.md
index 353b1a1..d275680 100644
--- a/README.md
+++ b/README.md
@@ -51,7 +51,7 @@ for what works, what's in progress, and what's still planned.
 | ✅ | **Encrypted passwords** | Stored passwords are encrypted with the OS keystore (DPAPI, Keychain, libsecret). |
 | ✅ | **1Password** | Read the address, port, user, domain or password of a host or a remote desktop connection from 1Password when connecting instead of storing it, and use SSH keys from the 1Password SSH agent. [How](#using-1password) |
 | ✅ | **Light & dark theme** | |
-| 🚧 | **Snippets & automations** *(in progress)* | Save commands as snippets and chain them into automations on a canvas, run locally or on a host, with parameters and the output of earlier steps. Usable, but still changing. |
+| 🚧 | **Snippets & automations** *(in progress)* | Save commands as snippets and chain them into automations on a canvas, run locally or on a host, with parameters and the output of earlier steps, plus an upload step that copies a file from this computer to the host. Usable, but still changing. |
 | 🚧 | **Remote desktop (RDP)** *(in progress)* | RDP sessions as tabs inside the app, next to your terminals (IronRDP, no extra window), or in the OS's own client (Remote Desktop on Windows, FreeRDP on Linux and macOS), signed in automatically either way. Drag files onto the session to copy them there, and save files copied on the remote desktop. Can tunnel through any SSH host, so machines behind a bastion work without exposing port 3389. Display, monitor, clipboard, drive and sound settings per profile. |
 | 💡 | **AI integration** *(maybe in the future)* | Help with commands, explain output or errors, right in the terminal. |
 | 💡 | **Plugin system** *(maybe in the future)* | Extend the app with your own features without touching the core. |
diff --git a/packages/electron/src/core/automation/bundle.test.ts b/packages/electron/src/core/automation/bundle.test.ts
index 401d8bf..7b1e9ee 100644
--- a/packages/electron/src/core/automation/bundle.test.ts
+++ b/packages/electron/src/core/automation/bundle.test.ts
@@ -51,6 +51,22 @@ describe('buildAutomationBundle', () => {
   });
 });
 
+describe('upload nodes in bundles', () => {
+  it('bundle no snippet for an upload node, and come back through JSON', () => {
+    const a = snippet({ id: 'a1', name: 'Load' });
+    const f = automation({
+      params: [{ name: 'host', kind: 'host' }],
+      nodes: [
+        node({ id: 'u', snippetId: '', upload: { from: 'image.tar.gz', to: '/tmp/' }, target: 'remote' }),
+        node({ id: 'n1', snippetId: 'a1', target: 'remote' })
+      ]
+    });
+    const bundle = buildAutomationBundle(f, new Map([['a1', a]]));
+    expect(bundle.snippets).toEqual([a]);
+    expect(parseBundle(JSON.parse(JSON.stringify(bundle)))).toEqual(bundle);
+  });
+});
+
 describe('parseBundle', () => {
   it('round-trips a built snippet bundle through JSON', () => {
     const a = snippet({ id: 'a1', name: 'Build' });
diff --git a/packages/electron/src/core/automation/bundle.ts b/packages/electron/src/core/automation/bundle.ts
index 20cfe5c..adcec9a 100644
--- a/packages/electron/src/core/automation/bundle.ts
+++ b/packages/electron/src/core/automation/bundle.ts
@@ -39,7 +39,7 @@ export function buildAutomationBundle(automation: Automation, snippetsById: Map<
   const seen = new Set<string>();
   const snippets: Snippet[] = [];
   for (const node of automation.nodes) {
-    if (seen.has(node.snippetId)) continue;
+    if (node.upload !== undefined || seen.has(node.snippetId)) continue;
     const snippet = snippetsById.get(node.snippetId);
     if (snippet === undefined) {
       throw new Error(`automation "${automation.name}" references an unknown snippet`);
@@ -105,9 +105,15 @@ function parseAutomationNode(raw: unknown, ctx: string): AutomationNode {
     const p = obj(o.position, `${ctx}.position`);
     position = { x: num(p.x, `${ctx}.position.x`), y: num(p.y, `${ctx}.position.y`) };
   }
+  let upload: AutomationNode['upload'];
+  if (o.upload !== undefined && o.upload !== null) {
+    const u = obj(o.upload, `${ctx}.upload`);
+    upload = { from: str(u.from, `${ctx}.upload.from`), to: str(u.to, `${ctx}.upload.to`) };
+  }
   return {
     id: str(o.id, `${ctx}.id`),
-    snippetId: str(o.snippetId, `${ctx}.snippetId`),
+    snippetId: upload !== undefined && o.snippetId === undefined ? '' : str(o.snippetId, `${ctx}.snippetId`),
+    upload,
     label: str(o.label, `${ctx}.label`),
     continueOnError: bool(o.continueOnError, `${ctx}.continueOnError`),
     target,
diff --git a/packages/electron/src/core/automation/engine.integration.test.ts b/packages/electron/src/core/automation/engine.integration.test.ts
index ecb71ac..a89036d 100644
--- a/packages/electron/src/core/automation/engine.integration.test.ts
+++ b/packages/electron/src/core/automation/engine.integration.test.ts
@@ -1,6 +1,10 @@
 import { describe, expect, it } from 'vitest';
 import { runAutomation, type RunAutomationDeps } from './engine.js';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 import { runLocalCommand } from './localExec.js';
+import { uploadOverSession } from './upload.js';
 import type { Snippet, Automation } from './types.js';
 import { SshSession } from '../ssh/session.js';
 import { testTargetHost } from '../../testSupport/sshTestTarget.js';
@@ -14,16 +18,55 @@ import { testTargetHost } from '../../testSupport/sshTestTarget.js';
 function deps(): RunAutomationDeps {
   return {
     runLocal: runLocalCommand,
-    connectHost: async () => {
+    connectHost: async (hostName) => {
       const session = await SshSession.connect(testTargetHost());
       return {
         runShell: (cmd, timeoutMs) => session.runShell(cmd, timeoutMs),
+        upload: (from, to) => uploadOverSession(session, hostName, from, to),
         disconnect: () => session.disconnect()
       };
     }
   };
 }
 
+describe('upload node against the test target', () => {
+  it('copies a local file to the host, and the next node reads it where it landed', async () => {
+    const dir = await mkdtemp(join(tmpdir(), 'bssh-upload-'));
+    const file = join(dir, `payload-${Date.now()}.txt`);
+    await writeFile(file, 'hello from the upload node\n');
+    try {
+      const read: Snippet = { id: 'read', name: 'Read', command: 'cat {{nodes.upload.output}} && rm {{nodes.upload.output}}', timeoutSecs: 30 };
+      const automation: Automation = {
+        name: 'it-upload',
+        params: [{ name: 'host', kind: 'host' }],
+        nodes: [
+          { id: 'u', snippetId: '', upload: { from: file, to: '/tmp/' }, label: 'upload', continueOnError: false, target: 'remote' },
+          { id: 'r', snippetId: 'read', label: 'read', continueOnError: false, target: 'remote' }
+        ],
+        edges: [{ from: 'u', to: 'r' }]
+      };
+      const results = await runAutomation(automation, new Map([['read', read]]), { host: 'ssh-test-target' }, deps());
+      expect(results.map((r) => r.status)).toEqual(['success', 'success']);
+      expect(results[0].output).toMatch(/^\/tmp\/payload-\d+\.txt$/);
+      expect(results[1].output).toContain('hello from the upload node');
+    } finally {
+      await rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  it('says which local file is missing', async () => {
+    const automation: Automation = {
+      name: 'it-upload-missing',
+      params: [{ name: 'host', kind: 'host' }],
+      nodes: [{ id: 'u', snippetId: '', upload: { from: join(tmpdir(), 'no-such-file.tar.gz'), to: '/tmp/' }, label: 'upload', continueOnError: false, target: 'remote' }],
+      edges: []
+    };
+    const [result] = await runAutomation(automation, new Map(), { host: 'ssh-test-target' }, deps());
+    expect(result.status).toBe('failed');
+    expect(result.error).toContain('no such file on this computer');
+  });
+});
+
 describe('snippet engine against the test target', () => {
   it('a local node feeds its output into a remote node over a real SSH connection', async () => {
     const local: Snippet = { id: 'local', name: 'Local', kind: 'local', command: 'echo build-123', timeoutSecs: 30 };
diff --git a/packages/electron/src/core/automation/engine.test.ts b/packages/electron/src/core/automation/engine.test.ts
index bd0180f..319d101 100644
--- a/packages/electron/src/core/automation/engine.test.ts
+++ b/packages/electron/src/core/automation/engine.test.ts
@@ -5,6 +5,7 @@ import {
   runAutomation,
   substituteTemplate,
   topoOrder,
+  uploadDestination,
   validateAutomation,
   type RunAutomationDeps
 } from './engine.js';
@@ -240,7 +241,7 @@ describe('runAutomation', () => {
   function deps(overrides: Partial<RunAutomationDeps> = {}): RunAutomationDeps {
     return {
       runLocal: async (command) => ({ output: `ran: ${command}`, ok: true }),
-      connectHost: async () => ({ runShell: async () => ({ output: '', ok: true }), disconnect: () => {} }),
+      connectHost: async () => ({ runShell: async () => ({ output: '', ok: true }), upload: async () => {}, disconnect: () => {} }),
       ...overrides
     };
   }
@@ -490,3 +491,89 @@ describe('runAutomation', () => {
     expect(results[0].error).toMatch(/no host parameter value/);
   });
 });
+
+describe('upload nodes', () => {
+  const pack = snippet({ id: 'pack', name: 'Pack', command: 'docker save -o image.tar {{params.image}} && tar -czf image.tar.gz image.tar' });
+  const load = snippet({ id: 'load', name: 'Load', command: 'docker load < {{nodes.upload.output}}' });
+  const params: AutomationParam[] = [...hostParam, { name: 'image', kind: 'text' }, { name: 'dir', kind: 'text' }];
+  const flow = automation(
+    [
+      node({ id: 'n1', snippetId: 'pack', label: 'pack' }),
+      node({ id: 'n2', snippetId: '', label: 'upload', target: 'remote', upload: { from: 'image.tar.gz', to: '{{params.dir}}/' } }),
+      node({ id: 'n3', snippetId: 'load', label: 'load', target: 'remote' })
+    ],
+    [
+      ['n1', 'n2'],
+      ['n2', 'n3']
+    ],
+    params
+  );
+  const library = new Map([
+    ['pack', pack],
+    ['load', load]
+  ]);
+
+  it('validates: needs no snippet, but both paths, the host, and known references', () => {
+    expect(validateAutomation(flow, library)).toEqual([]);
+    const bad = automation(
+      [node({ id: 'u', snippetId: '', label: 'u', target: 'local', upload: { from: ' ', to: '{{params.nope}}' } })],
+      [],
+      hostParam
+    );
+    expect(validateAutomation(bad, library)).toEqual([
+      'upload "u" needs a file to upload',
+      'upload "u" must target the host',
+      'node "u" references unknown parameter "nope"'
+    ]);
+  });
+
+  it('uploads over the host connection, and its output is where the file landed', async () => {
+    const uploads: Array<[string, string]> = [];
+    const commands: string[] = [];
+    let connects = 0;
+    const results = await runAutomation(flow, library, { host: 'web-1', image: 'nginx:1.27', dir: '/tmp' }, {
+      runLocal: async () => ({ output: '', ok: true }),
+      connectHost: async () => {
+        connects += 1;
+        return {
+          runShell: async (cmd) => {
+            commands.push(cmd);
+            return { output: 'Loaded image', ok: true };
+          },
+          upload: async (from, to) => {
+            uploads.push([from, to]);
+          },
+          disconnect: () => {}
+        };
+      }
+    });
+    expect(uploads).toEqual([['image.tar.gz', '/tmp/image.tar.gz']]);
+    expect(results.map((r) => r.status)).toEqual(['success', 'success', 'success']);
+    expect(results[1].output).toBe('/tmp/image.tar.gz');
+    expect(commands).toEqual(['docker load < /tmp/image.tar.gz']);
+    expect(connects).toBe(1);
+  });
+
+  it('fails the node with the reason, and skips what depends on it', async () => {
+    const results = await runAutomation(flow, library, { host: 'web-1', image: 'nginx', dir: '/tmp' }, {
+      runLocal: async () => ({ output: '', ok: true }),
+      connectHost: async () => ({
+        runShell: async () => ({ output: '', ok: true }),
+        upload: async () => {
+          throw new Error('no such file on this computer: C:\\Users\\me\\image.tar.gz');
+        },
+        disconnect: () => {}
+      })
+    });
+    expect(results.map((r) => r.status)).toEqual(['success', 'failed', 'skipped']);
+    expect(results[1].error).toMatch(/no such file on this computer/);
+  });
+});
+
+describe('uploadDestination', () => {
+  it('keeps the file name for a folder ending in /, from either kind of local path', () => {
+    expect(uploadDestination('C:\\Users\\me\\image.tar.gz', '/tmp/')).toBe('/tmp/image.tar.gz');
+    expect(uploadDestination('~/build/app.tgz', '/srv/')).toBe('/srv/app.tgz');
+    expect(uploadDestination('image.tar.gz', '/tmp/renamed.tar.gz')).toBe('/tmp/renamed.tar.gz');
+  });
+});
diff --git a/packages/electron/src/core/automation/engine.ts b/packages/electron/src/core/automation/engine.ts
index 4c1d1a7..b64b1bd 100644
--- a/packages/electron/src/core/automation/engine.ts
+++ b/packages/electron/src/core/automation/engine.ts
@@ -68,6 +68,22 @@ function hostParamOf(automation: Automation): { name: string } | undefined {
   return automation.params.find((p) => p.kind === 'host');
 }
 
+/** Everything in a node that templates are substituted into: its snippet's command, or
+ *  an upload's two paths. Undefined for a node whose snippet is gone. */
+function templatedText(node: AutomationNode, snippetsById: Map<string, Snippet>): string | undefined {
+  if (node.upload !== undefined) return `${node.upload.from}\n${node.upload.to}`;
+  return snippetsById.get(node.snippetId)?.command;
+}
+
+/** Where an upload lands: `to` itself, or — when `to` ends in `/` — that folder plus the
+ *  local file's name. The host is POSIX; the local path may use either separator. */
+export function uploadDestination(from: string, to: string): string {
+  const dest = to.trim();
+  if (!dest.endsWith('/')) return dest;
+  const name = from.trim().split(/[\\/]/).filter(Boolean).pop() ?? '';
+  return `${dest}${name}`;
+}
+
 /** Save-time structural validation — not execution. Returns a list of problem
  *  strings (empty means valid): an unknown `snippetId`, a duplicate label or
  *  parameter name, more than one `'host'`-kind parameter, a remote node with no host
@@ -84,8 +100,11 @@ export function validateAutomation(automation: Automation, snippetsById: Map<str
   const labelCounts = new Map<string, number>();
 
   for (const node of automation.nodes) {
-    const snippet = snippetsById.get(node.snippetId);
-    if (snippet === undefined) {
+    if (node.upload !== undefined) {
+      if (!node.upload.from.trim()) problems.push(`upload "${node.label}" needs a file to upload`);
+      if (!node.upload.to.trim()) problems.push(`upload "${node.label}" needs a destination on the host`);
+      if (node.target !== 'remote') problems.push(`upload "${node.label}" must target the host`);
+    } else if (snippetsById.get(node.snippetId) === undefined) {
       problems.push(`node "${node.label}" references an unknown snippet`);
     }
     labelCounts.set(node.label, (labelCounts.get(node.label) ?? 0) + 1);
@@ -122,12 +141,12 @@ export function validateAutomation(automation: Automation, snippetsById: Map<str
 
   const predecessorsOf = predecessorMap(automation);
   for (const node of automation.nodes) {
-    const snippet = snippetsById.get(node.snippetId);
-    if (snippet === undefined) continue;
+    const text = templatedText(node, snippetsById);
+    if (text === undefined) continue;
     const directPredecessorLabels = new Set(
       (predecessorsOf.get(node.id) ?? []).map((id) => nodeById.get(id)?.label)
     );
-    for (const match of snippet.command.matchAll(TEMPLATE_REF)) {
+    for (const match of text.matchAll(TEMPLATE_REF)) {
       const ref = match[1];
       if (!labelToNode.has(ref)) {
         problems.push(`node "${node.label}" references unknown label "${ref}"`);
@@ -135,7 +154,7 @@ export function validateAutomation(automation: Automation, snippetsById: Map<str
         problems.push(`node "${node.label}" references "${ref}", which is not a direct dependency (add an edge from it)`);
       }
     }
-    for (const match of snippet.command.matchAll(PARAM_REF)) {
+    for (const match of text.matchAll(PARAM_REF)) {
       const ref = match[1];
       if (!paramNames.has(ref)) {
         problems.push(`node "${node.label}" references unknown parameter "${ref}"`);
@@ -186,6 +205,8 @@ export function substituteTemplate(
 
 export interface RunAutomationConnection {
   runShell(cmd: string, timeoutMs: number): Promise<{ output: string; ok: boolean; error?: string }>;
+  /** Copies the local file `from` to `to` on the host; rejects with why it failed. */
+  upload(from: string, to: string): Promise<void>;
   disconnect(): void;
 }
 
@@ -225,6 +246,16 @@ export async function runAutomation(
   const resultsById = new Map<string, NodeResult>();
   const connections = new Map<string, RunAutomationConnection>();
 
+  /** The host's connection, opened on first use and shared by every node after. */
+  async function connectionFor(hostName: string): Promise<RunAutomationConnection> {
+    let connection = connections.get(hostName);
+    if (connection === undefined) {
+      connection = await deps.connectHost(hostName);
+      connections.set(hostName, connection);
+    }
+    return connection;
+  }
+
   function settle(nodeId: string, result: NodeResult): void {
     resultsById.set(nodeId, result);
     onProgress?.({ kind: 'nodeResult', result });
@@ -235,7 +266,7 @@ export async function runAutomation(
       const node = nodeById.get(nodeId)!;
       const snippet = snippetsById.get(node.snippetId);
 
-      if (snippet === undefined) {
+      if (snippet === undefined && node.upload === undefined) {
         settle(nodeId, { nodeId, label: node.label, status: 'failed', output: '', error: 'snippet no longer exists', durationMs: 0 });
         continue;
       }
@@ -255,22 +286,27 @@ export async function runAutomation(
 
       onProgress?.({ kind: 'nodeStarted', nodeId, label: node.label });
       const predecessorsByLabel = new Map(predecessorIds.map((id) => [nodeById.get(id)!.label, resultsById.get(id)!]));
-      const timeoutMs = snippet.timeoutSecs * 1000;
       const startedAt = Date.now();
 
       let exec: { output: string; ok: boolean; error?: string };
       try {
-        const command = substituteTemplate(snippet.command, predecessorsByLabel, paramValues);
-        if (node.target === 'local') {
-          exec = await deps.runLocal(command, timeoutMs);
+        if (node.upload !== undefined) {
+          // No timeout: a big image takes as long as the line allows, and a stalled
+          // transfer fails on the SSH connection's own keepalive.
+          const from = substituteTemplate(node.upload.from, predecessorsByLabel, paramValues).trim();
+          const to = uploadDestination(from, substituteTemplate(node.upload.to, predecessorsByLabel, paramValues));
+          const connection = await connectionFor(nodeHostName!);
+          await connection.upload(from, to);
+          // The output is where it landed, so the next node can use it as is:
+          // `docker load < {{nodes.upload.output}}`.
+          exec = { output: to, ok: true };
+        } else if (node.target === 'local') {
+          const command = substituteTemplate(snippet!.command, predecessorsByLabel, paramValues);
+          exec = await deps.runLocal(command, snippet!.timeoutSecs * 1000);
         } else {
-          const hostName = nodeHostName!;
-          let connection = connections.get(hostName);
-          if (connection === undefined) {
-            connection = await deps.connectHost(hostName);
-            connections.set(hostName, connection);
-          }
-          exec = await connection.runShell(command, timeoutMs);
+          const command = substituteTemplate(snippet!.command, predecessorsByLabel, paramValues);
+          const connection = await connectionFor(nodeHostName!);
+          exec = await connection.runShell(command, snippet!.timeoutSecs * 1000);
         }
       } catch (e) {
         exec = { output: '', ok: false, error: (e as Error).message };
diff --git a/packages/electron/src/core/automation/localExec.test.ts b/packages/electron/src/core/automation/localExec.test.ts
index ec244ce..9833a32 100644
--- a/packages/electron/src/core/automation/localExec.test.ts
+++ b/packages/electron/src/core/automation/localExec.test.ts
@@ -1,8 +1,8 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
 import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { runLocalCommand } from './localExec.js';
+import { localUploadPath, runLocalCommand } from './localExec.js';
 
 // Shells out via child_process.exec (real shell semantics — pipes, &&, …), so these
 // tests run real (tiny, fast, cross-platform) commands rather than mocking anything.
@@ -55,3 +55,13 @@ describe('runLocalCommand', () => {
     expect(elapsed).toBeLessThan(5000);
   });
 });
+
+describe('localUploadPath', () => {
+  it('reads a relative path and ~ from the home folder, keeps an absolute one', () => {
+    const home = join('/', 'home', 'me');
+    expect(localUploadPath('image.tar.gz', home)).toBe(join(home, 'image.tar.gz'));
+    expect(localUploadPath(' ~/build/app.tgz ', home)).toBe(join(home, 'build', 'app.tgz'));
+    const absolute = resolve('/data/app.tgz');
+    expect(localUploadPath(absolute, home)).toBe(absolute);
+  });
+});
diff --git a/packages/electron/src/core/automation/localExec.ts b/packages/electron/src/core/automation/localExec.ts
index 290fe67..3d87594 100644
--- a/packages/electron/src/core/automation/localExec.ts
+++ b/packages/electron/src/core/automation/localExec.ts
@@ -1,4 +1,25 @@
 import { exec } from 'node:child_process';
+import { stat } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { isAbsolute, join } from 'node:path';
+
+/** A local file an upload node names: absolute as given, `~/…` in the home folder, and
+ *  anything else relative to the home folder too — where local nodes run (see
+ *  `runLocalCommand`), so `image.tar.gz` is the file a previous node just wrote. */
+export function localUploadPath(from: string, home: string = homedir()): string {
+  const p = from.trim();
+  if (p === '~') return home;
+  if (p.startsWith('~/') || p.startsWith('~\\')) return join(home, p.slice(2));
+  return isAbsolute(p) ? p : join(home, p);
+}
+
+/** Checks the file an upload node is about to send, so a missing one fails with its
+ *  full path rather than SFTP's bare "No such file". */
+export async function checkUploadSource(path: string): Promise<void> {
+  const info = await stat(path).catch(() => undefined);
+  if (info === undefined) throw new Error(`no such file on this computer: ${path}`);
+  if (!info.isFile()) throw new Error(`not a file: ${path}`);
+}
 
 /**
  * Runs a shell command on the local machine for a Snippet "local" node. Unlike
@@ -26,7 +47,10 @@ export async function runLocalCommand(
   return new Promise((resolve) => {
     exec(
       command,
-      { timeout: timeoutMs, killSignal: 'SIGTERM', windowsHide: true, maxBuffer: 10 * 1024 * 1024 },
+      // In the home folder: the app's own working directory is wherever it was started
+      // from — the install folder, often not writable — so `docker save -o image.tar`
+      // had nowhere sensible to go. An upload node's relative path means the same folder.
+      { cwd: homedir(), timeout: timeoutMs, killSignal: 'SIGTERM', windowsHide: true, maxBuffer: 10 * 1024 * 1024 },
       (err, stdout, stderr) => {
         const output = stdout + stderr;
         if (err) {
diff --git a/packages/electron/src/core/automation/types.ts b/packages/electron/src/core/automation/types.ts
index 202199e..b805691 100644
--- a/packages/electron/src/core/automation/types.ts
+++ b/packages/electron/src/core/automation/types.ts
@@ -40,10 +40,24 @@ export interface AutomationParam {
  *  `'host'` param resolves at run time. */
 export type NodeTarget = 'local' | 'remote';
 
+/** A built-in step instead of a snippet: copies a file from this machine to the
+ *  automation's host over the app's own SFTP connection (its saved password,
+ *  1Password, jump hosts, known host keys). Both paths may use `{{params.<name>}}`
+ *  and `{{nodes.<label>.output}}`. */
+export interface UploadStep {
+  /** A file on this machine; relative to the home folder, like local nodes' commands. */
+  from: string;
+  /** Where on the host: a file path, or a folder ending in `/` to keep the file's name. */
+  to: string;
+}
+
 export interface AutomationNode {
   /** Instance id, unique within the automation — a Snippet can appear more than once. */
   id: string;
+  /** The snippet this node runs; `''` for an upload node. */
   snippetId: string;
+  /** Set for an upload node, which runs no snippet (and always targets the host). */
+  upload?: UploadStep;
   /** Unique within the automation; the `{{nodes.<label>.output}}` handle. */
   label: string;
   /** An automation-wiring concern, not a property of the reusable Snippet: does this
diff --git a/packages/electron/src/core/automation/upload.ts b/packages/electron/src/core/automation/upload.ts
new file mode 100644
index 0000000..122e081
--- /dev/null
+++ b/packages/electron/src/core/automation/upload.ts
@@ -0,0 +1,20 @@
+import type { SshSession } from '../ssh/session.js';
+import { checkUploadSource, localUploadPath } from './localExec.js';
+
+/**
+ * An upload node's transfer: the local file `from` (see `localUploadPath`) to `to` on
+ * the host, over an SFTP channel on the automation's own connection to it — the same
+ * login, 1Password prompt and host key check as the commands around it.
+ */
+export async function uploadOverSession(session: SshSession, hostName: string, from: string, to: string): Promise<void> {
+  const local = localUploadPath(from);
+  await checkUploadSource(local);
+  const sftp = await session.openSftp();
+  try {
+    await new Promise<void>((resolve, reject) =>
+      sftp.fastPut(local, to, (err) => (err ? reject(new Error(`could not write ${to} on ${hostName}: ${err.message}`)) : resolve()))
+    );
+  } finally {
+    sftp.end();
+  }
+}
diff --git a/packages/electron/src/core/config/automations.test.ts b/packages/electron/src/core/config/automations.test.ts
index e0c94fc..0e6613e 100644
--- a/packages/electron/src/core/config/automations.test.ts
+++ b/packages/electron/src/core/config/automations.test.ts
@@ -59,6 +59,18 @@ describe('saveAutomations / loadAutomations round trip', () => {
     expect(await loadAutomations(path)).toEqual(original);
   });
 
+  it('round-trips an upload node', async () => {
+    const original = [
+      automation({
+        params: [{ name: 'host', kind: 'host' }],
+        nodes: [{ id: 'u', snippetId: '', upload: { from: 'image.tar.gz', to: '/tmp/' }, label: 'upload', continueOnError: false, target: 'remote' }],
+        edges: []
+      })
+    ];
+    await saveAutomations(original, path);
+    expect(await loadAutomations(path)).toEqual(original);
+  });
+
   it('round-trips a node position', async () => {
     const original = [automation({ nodes: [{ id: 'n1', snippetId: 'a1', label: 'build', continueOnError: false, target: 'local', position: { x: 12, y: 34 } }] })];
     await saveAutomations(original, path);
diff --git a/packages/electron/src/core/config/automations.ts b/packages/electron/src/core/config/automations.ts
index 434ba19..9140a6c 100644
--- a/packages/electron/src/core/config/automations.ts
+++ b/packages/electron/src/core/config/automations.ts
@@ -24,9 +24,18 @@ function automationNodeFromToml(raw: Record<string, unknown>, automationName: st
     raw.position !== undefined && typeof raw.position === 'object' && raw.position !== null
       ? (raw.position as { x?: unknown; y?: unknown })
       : undefined;
+  let upload: AutomationNode['upload'];
+  if (raw.upload !== undefined) {
+    const u = raw.upload as { from?: unknown; to?: unknown } | null;
+    if (typeof u !== 'object' || u === null || typeof u.from !== 'string' || typeof u.to !== 'string') {
+      throw new Error(`automation "${automationName}" node "${raw.id}" has an invalid "upload"`);
+    }
+    upload = { from: u.from, to: u.to };
+  }
   return {
     id: raw.id,
     snippetId: raw.snippetId,
+    upload,
     label: raw.label,
     continueOnError: raw.continueOnError === true,
     target,
@@ -45,6 +54,7 @@ function automationNodeToToml(node: AutomationNode): Record<string, unknown> {
     continueOnError: node.continueOnError,
     target: node.target
   };
+  if (node.upload !== undefined) out.upload = { from: node.upload.from, to: node.upload.to };
   if (node.position !== undefined) out.position = { x: node.position.x, y: node.position.y };
   return out;
 }
diff --git a/packages/electron/src/dto.ts b/packages/electron/src/dto.ts
index 6b9dad6..052f2ee 100644
--- a/packages/electron/src/dto.ts
+++ b/packages/electron/src/dto.ts
@@ -138,7 +138,10 @@ export function snippetFromDto(dto: SnippetDto): Snippet {
 
 export interface AutomationNodeDto {
   id: string;
+  /** `''` for an upload node. */
   snippetId: string;
+  /** Set for an upload node: a local file to copy to the automation's host. */
+  upload?: { from: string; to: string };
   label: string;
   continueOnError: boolean;
   target: NodeTargetDto;
diff --git a/packages/electron/src/ipc/automations.ts b/packages/electron/src/ipc/automations.ts
index 89f5ced..4a06850 100644
--- a/packages/electron/src/ipc/automations.ts
+++ b/packages/electron/src/ipc/automations.ts
@@ -4,6 +4,7 @@ import { readFile, writeFile } from 'node:fs/promises';
 import { loadSnippets, saveSnippets } from '../core/config/snippets.js';
 import { loadAutomations, saveAutomations } from '../core/config/automations.js';
 import { runLocalCommand } from '../core/automation/localExec.js';
+import { uploadOverSession } from '../core/automation/upload.js';
 import { missingParamValues, runAutomation, validateAutomation, type RunAutomationDeps } from '../core/automation/engine.js';
 import {
   buildSnippetBundle,
@@ -251,6 +252,8 @@ async function executeAutomationRun(state: GuiState, automationName: string, par
         const session = await SshSession.shared(host);
         return {
           runShell: (cmd, timeoutMs) => session.runShell(cmd, timeoutMs),
+          // Over the same connection as the commands: one login, one 1Password prompt.
+          upload: (from, to) => uploadOverSession(session, hostName, from, to),
           disconnect: () => session.disconnect()
         };
       }
diff --git a/packages/ui/e2e/automations.spec.ts b/packages/ui/e2e/automations.spec.ts
index 71e6ea6..12010c2 100644
--- a/packages/ui/e2e/automations.spec.ts
+++ b/packages/ui/e2e/automations.spec.ts
@@ -20,6 +20,7 @@ async function boot(page: Page): Promise<void> {
     const win = window as unknown as Record<string, unknown>;
     const listeners: Record<string, Array<(payload: unknown) => void>> = {};
     const state: { snippets: Rec[]; automations: Rec[] } = { snippets: [], automations: [] };
+    win.__automationState = state;
     // Every export_* call, recorded for assertions — real Electron shows a native save
     // dialog here, which Playwright can't drive, so the test instead checks the right
     // channel/id or name reached the (stubbed) IPC boundary.
@@ -391,6 +392,39 @@ test('a node set to run on a host carries no host itself — the automation asks
   await expect(progress.locator('li', { hasText: 'Deploy' })).toContainText('ok on web-1');
 });
 
+test('an upload step: added from the "+" menu, saved as a node without a snippet, there again on reopen', async ({ page }) => {
+  await boot(page);
+  await page.getByRole('button', { name: 'Automations', exact: true }).click();
+  await page.getByRole('button', { name: 'New automation' }).first().click();
+  await page.getByLabel('Automation name').fill('ship-image');
+
+  await page.getByRole('button', { name: 'Add a snippet to this automation' }).click();
+  await page.getByRole('dialog', { name: 'Pick a snippet' }).getByRole('button', { name: /Upload a file to the host/ }).click();
+  const upload = page.locator('.svelte-flow__node', { hasText: 'Upload a file to the host' });
+  await expect(upload.getByLabel('Label')).toHaveValue('upload');
+  await upload.getByLabel('From this computer').fill('image.tar.gz');
+  await upload.getByLabel('To on the host').fill('/tmp/');
+
+  // An upload always goes to the host, so the automation needs a host parameter first.
+  await page.getByRole('button', { name: 'Create automation' }).click();
+  await expect(page.getByText('This automation runs something on a host — add a host parameter on the Start node')).toBeVisible();
+  await page.getByRole('button', { name: 'Add parameter' }).click();
+  await page.getByLabel('Parameter 1 name').fill('host');
+  await page.getByRole('combobox', { name: 'Parameter 1 kind' }).selectOption('host');
+  await page.getByRole('button', { name: 'Create automation' }).click();
+  await expect(page.getByRole('heading', { name: 'Automations' })).toBeVisible();
+
+  const saved = await page.evaluate(
+    () => (window as unknown as { __automationState: { automations: Array<{ nodes: unknown[] }> } }).__automationState.automations[0].nodes[0]
+  );
+  expect(saved).toMatchObject({ snippetId: '', upload: { from: 'image.tar.gz', to: '/tmp/' }, target: 'remote', label: 'upload' });
+
+  await page.getByText('ship-image', { exact: true }).click();
+  const reopened = page.locator('.svelte-flow__node', { hasText: 'Upload a file to the host' });
+  await expect(reopened.getByLabel('From this computer')).toHaveValue('image.tar.gz');
+  await expect(reopened.getByLabel('To on the host')).toHaveValue('/tmp/');
+});
+
 test('the "+" menu can create a brand new snippet inline and drops it straight onto the canvas', async ({
   page
 }) => {
diff --git a/packages/ui/src/lib/bindings.ts b/packages/ui/src/lib/bindings.ts
index ce1aa20..e19426e 100644
--- a/packages/ui/src/lib/bindings.ts
+++ b/packages/ui/src/lib/bindings.ts
@@ -331,10 +331,13 @@ export type AutomationDto = {
 };
 /** `to` depends on `from` — `from` must complete before `to` can start. */
 export type AutomationEdgeDto = { from: string; to: string };
-/** One placement of a reusable Snippet into an Automation. */
+/** One placement of a reusable Snippet into an Automation — or a built-in upload step. */
 export type AutomationNodeDto = {
   id: string;
+  /** `''` for an upload step. */
   snippetId: string;
+  /** Set for an upload step: a file on this machine copied to the automation's host. */
+  upload?: { from: string; to: string } | null;
   label: string;
   continueOnError: boolean;
   target: NodeTargetDto;
diff --git a/packages/ui/src/lib/components/CommandPalette.svelte b/packages/ui/src/lib/components/CommandPalette.svelte
index 32ccc61..e0423f4 100644
--- a/packages/ui/src/lib/components/CommandPalette.svelte
+++ b/packages/ui/src/lib/components/CommandPalette.svelte
@@ -106,6 +106,9 @@
       case 'newSnippet':
         palette.chooseSnippet('new');
         break;
+      case 'uploadStep':
+        palette.chooseSnippet('upload');
+        break;
     }
   }
 
@@ -231,6 +234,9 @@
                 {:else if item.kind === 'snippet'}
                   <Icon name="automations" size={16} />
                   <span class="min-w-0 flex-1 truncate font-medium">{item.snippet.name}</span>
+                {:else if item.kind === 'uploadStep'}
+                  <Icon name="upload" size={16} />
+                  <span class="min-w-0 flex-1 truncate font-medium">Upload a file to the host…</span>
                 {:else}
                   <Icon name="plus" size={16} />
                   <span class="min-w-0 flex-1 truncate font-medium">New snippet…</span>
diff --git a/packages/ui/src/lib/screens/AutomationEditor.svelte b/packages/ui/src/lib/screens/AutomationEditor.svelte
index ba36464..f6f2e03 100644
--- a/packages/ui/src/lib/screens/AutomationEditor.svelte
+++ b/packages/ui/src/lib/screens/AutomationEditor.svelte
@@ -31,6 +31,7 @@
   import { theme } from '$lib/stores/theme';
   import AutomationCanvasNode from './AutomationCanvasNode.svelte';
   import AutomationStartNode from './AutomationStartNode.svelte';
+  import AutomationUploadNode from './AutomationUploadNode.svelte';
   import SnippetEditor from './SnippetEditor.svelte';
   import { emptyForm, formFromSnippet } from './snippetForm';
   import {
@@ -40,6 +41,8 @@
     type AnyCanvasNode,
     type AutomationCanvasEdge,
     type SnippetNode,
+    type StepNode,
+    type UploadNode,
     type AutomationNodeActionsContext,
     type StartNode
   } from './automationCanvasTypes';
@@ -61,7 +64,7 @@
   // svelte-ignore state_referenced_locally
   const notFound = automationName !== null && existing === undefined;
 
-  const nodeTypes = { snippet: AutomationCanvasNode, start: AutomationStartNode };
+  const nodeTypes = { snippet: AutomationCanvasNode, upload: AutomationUploadNode, start: AutomationStartNode };
 
   /** A simple left-to-right, wrapping grid — used only for a node that has no saved
    *  `position` yet (freshly added, or an automation saved before positions existed). */
@@ -73,6 +76,11 @@
     return n.type === 'snippet';
   }
 
+  /** Every node that is saved as an `AutomationNode` — snippets and upload steps. */
+  function isStepNode(n: AnyCanvasNode): n is StepNode {
+    return n.type === 'snippet' || n.type === 'upload';
+  }
+
   const startNode: StartNode = {
     id: START_NODE_ID,
     type: 'start',
@@ -86,7 +94,15 @@
   let params = $state<AutomationParamDto[]>(initial.params.map((p) => ({ ...p })));
   let canvasNodes = $state<AnyCanvasNode[]>([
     startNode,
-    ...initial.nodes.map((n, i) => {
+    ...initial.nodes.map((n, i): StepNode => {
+      if (n.upload) {
+        return {
+          id: n.id,
+          type: 'upload' as const,
+          position: n.position ?? layoutPosition(i),
+          data: { label: n.label, continueOnError: n.continueOnError, from: n.upload.from, to: n.upload.to }
+        };
+      }
       const snippet = $snippets.find((a) => a.id === n.snippetId);
       return {
         id: n.id,
@@ -184,7 +200,7 @@
       {
         id,
         type: 'snippet',
-        position: placement.position ?? layoutPosition(canvasNodes.filter(isSnippetNode).length),
+        position: placement.position ?? layoutPosition(canvasNodes.filter(isStepNode).length),
         data: {
           snippetId: snippet.id,
           label: uniqueLabel(snippet.name),
@@ -195,14 +211,29 @@
         }
       }
     ];
-    if (placement.wireFrom) {
-      canvasEdges = [
-        ...canvasEdges,
-        placement.wireFrom === START_NODE_ID
-          ? startLinkEdge(id)
-          : { id: `${placement.wireFrom}->${id}`, source: placement.wireFrom, target: id }
-      ];
-    }
+    wire(placement.wireFrom, id);
+  }
+
+  /** Places a new upload step, the same way `addSnippetNode` places a snippet. */
+  function addUploadNode(placement: NodePlacement): void {
+    const id = crypto.randomUUID();
+    const node: UploadNode = {
+      id,
+      type: 'upload',
+      position: placement.position ?? layoutPosition(canvasNodes.filter(isStepNode).length),
+      data: { label: uniqueLabel('upload'), continueOnError: false, from: '', to: '/tmp/' }
+    };
+    canvasNodes = [...canvasNodes, node];
+    wire(placement.wireFrom, id);
+  }
+
+  /** The edge a placement asks for, from `wireFrom` to the new node `id`. */
+  function wire(wireFrom: string | null, id: string): void {
+    if (!wireFrom) return;
+    canvasEdges = [
+      ...canvasEdges,
+      wireFrom === START_NODE_ID ? startLinkEdge(id) : { id: `${wireFrom}->${id}`, source: wireFrom, target: id }
+    ];
   }
 
   async function submitNewSnippet(snippet: SnippetDto): Promise<void> {
@@ -254,7 +285,7 @@
 
   function uniqueLabel(base: string): string {
     const slug = base.trim() || 'node';
-    const taken = new Set(canvasNodes.filter(isSnippetNode).map((n) => n.data.label));
+    const taken = new Set(canvasNodes.filter(isStepNode).map((n) => n.data.label));
     if (!taken.has(slug)) return slug;
     let i = 2;
     while (taken.has(`${slug}-${i}`)) i += 1;
@@ -274,6 +305,10 @@
       newSnippetDialog = { id: crypto.randomUUID(), placement };
       return;
     }
+    if (result === 'upload') {
+      addUploadNode(placement);
+      return;
+    }
     addSnippetNode(result, placement);
   }
 
@@ -323,12 +358,12 @@
       error = 'Name cannot be empty';
       return;
     }
-    const snippetNodes = canvasNodes.filter(isSnippetNode);
-    if (snippetNodes.length === 0) {
+    const stepNodes = canvasNodes.filter(isStepNode);
+    if (stepNodes.length === 0) {
       error = 'Add at least one node';
       return;
     }
-    const labels = snippetNodes.map((n) => n.data.label.trim());
+    const labels = stepNodes.map((n) => n.data.label.trim());
     if (labels.some((l) => !l)) {
       error = 'Every node needs a label';
       return;
@@ -337,9 +372,10 @@
       error = 'Node labels must be unique within the automation';
       return;
     }
-    const usesRemote = snippetNodes.some((n) => n.data.snippetKind === 'remote');
+    // An upload always goes to the host.
+    const usesRemote = stepNodes.some((n) => n.type === 'upload' || n.data.target === 'remote');
     if (usesRemote && !hasHostParam) {
-      error = 'This automation runs a remote snippet — add a host parameter on the Start node';
+      error = 'This automation runs something on a host — add a host parameter on the Start node';
       return;
     }
 
@@ -360,12 +396,13 @@
     const automation: AutomationDto = {
       name: automationNameTrimmed,
       params: params.map((p) => ({ ...p })),
-      nodes: snippetNodes.map((n) => ({
+      nodes: stepNodes.map((n) => ({
         id: n.id,
-        snippetId: n.data.snippetId,
+        ...(n.type === 'upload'
+          ? { snippetId: '', upload: { from: n.data.from.trim(), to: n.data.to.trim() }, target: 'remote' as const }
+          : { snippetId: n.data.snippetId, target: n.data.target }),
         label: n.data.label.trim(),
         continueOnError: n.data.continueOnError,
-        target: n.data.target,
         position: { x: n.position.x, y: n.position.y }
       })),
       edges: realEdges.map((e) => ({ from: e.source, to: e.target })),
diff --git a/packages/ui/src/lib/screens/AutomationUploadNode.svelte b/packages/ui/src/lib/screens/AutomationUploadNode.svelte
new file mode 100644
index 0000000..3569dfd
--- /dev/null
+++ b/packages/ui/src/lib/screens/AutomationUploadNode.svelte
@@ -0,0 +1,87 @@
+<script lang="ts">
+  // A built-in upload step on the Automation canvas (AutomationEditor.svelte): copies a
+  // file from this machine to the automation's host over the app's own SFTP connection.
+  // Laid out like AutomationCanvasNode.svelte — label, then its own fields — and edited
+  // in place the same way, via `updateNodeData`. No "runs local / on host" switch: an
+  // upload always needs the host. Its output is the path the file landed at, so the next
+  // node can say `docker load < {{nodes.<label>.output}}`.
+  import { Handle, Position, useSvelteFlow, type NodeProps } from '@xyflow/svelte';
+  import { Icon } from '$lib/theme';
+  import type { UploadNode } from './automationCanvasTypes';
+
+  let { id, data, selected }: NodeProps<UploadNode> = $props();
+
+  const { updateNodeData, deleteElements } = useSvelteFlow();
+
+  const input =
+    'nodrag w-full rounded bg-surface-inset px-2 py-1 font-mono text-xs text-fg outline-none ' +
+    'focus-visible:ring-2 focus-visible:ring-focus placeholder:text-faint';
+</script>
+
+<div
+  class="w-56 space-y-2 rounded-lg border bg-surface p-3 text-left shadow-sm {selected
+    ? 'border-accent'
+    : 'border-default'}"
+>
+  <Handle type="target" position={Position.Left} />
+
+  <div class="flex items-center gap-1.5">
+    <input
+      value={data.label}
+      oninput={(e) => updateNodeData(id, { label: e.currentTarget.value })}
+      class="nodrag min-w-0 flex-1 rounded bg-surface-inset px-2 py-1 font-mono text-xs text-fg outline-none focus-visible:ring-2 focus-visible:ring-focus"
+      placeholder="label"
+      aria-label="Label"
+    />
+    <button
+      type="button"
+      class="nodrag nopan grid h-6 w-6 shrink-0 place-items-center rounded text-muted transition hover:bg-surface-inset hover:text-fg focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-focus"
+      title="Remove node"
+      aria-label="Remove {data.label || 'node'}"
+      onclick={() => void deleteElements({ nodes: [{ id }] })}
+    >
+      <Icon name="trash" size={13} />
+    </button>
+  </div>
+
+  <div class="flex items-center gap-1.5 text-[11px] text-muted">
+    <Icon name="upload" size={12} />
+    Upload a file to the host
+  </div>
+
+  <label class="block space-y-0.5 text-[11px] text-muted">
+    <span>From this computer</span>
+    <input
+      value={data.from}
+      oninput={(e) => updateNodeData(id, { from: e.currentTarget.value })}
+      class={input}
+      placeholder="image.tar.gz"
+      spellcheck="false"
+      title="A file on this computer — relative paths start in your home folder, where local nodes run"
+    />
+  </label>
+
+  <label class="block space-y-0.5 text-[11px] text-muted">
+    <span>To on the host</span>
+    <input
+      value={data.to}
+      oninput={(e) => updateNodeData(id, { to: e.currentTarget.value })}
+      class={input}
+      placeholder="/tmp/"
+      spellcheck="false"
+      title="A path on the host — end it with / to keep the file's name. The node's output is where the file landed."
+    />
+  </label>
+
+  <label class="nodrag flex items-center gap-1.5 text-[11px] text-muted">
+    <input
+      type="checkbox"
+      checked={data.continueOnError}
+      onchange={(e) => updateNodeData(id, { continueOnError: e.currentTarget.checked })}
+      class="accent-current"
+    />
+    Continue on error
+  </label>
+
+  <Handle type="source" position={Position.Right} />
+</div>
diff --git a/packages/ui/src/lib/screens/automationCanvasTypes.ts b/packages/ui/src/lib/screens/automationCanvasTypes.ts
index d296184..1ea3a68 100644
--- a/packages/ui/src/lib/screens/automationCanvasTypes.ts
+++ b/packages/ui/src/lib/screens/automationCanvasTypes.ts
@@ -16,6 +16,22 @@ export interface SnippetNodeData extends Record<string, unknown> {
 }
 
 export type SnippetNode = Node<SnippetNodeData, 'snippet'>;
+
+/** A built-in upload step (no snippet): a file on this machine to the automation's host.
+ *  Always runs "on host" — it needs the host's connection — so it has no target switch. */
+export interface UploadNodeData extends Record<string, unknown> {
+  label: string;
+  continueOnError: boolean;
+  /** A file on this machine; relative paths are from the home folder. */
+  from: string;
+  /** On the host: a file path, or a folder ending in `/` to keep the name. */
+  to: string;
+}
+
+export type UploadNode = Node<UploadNodeData, 'upload'>;
+
+/** A node that becomes an `AutomationNode` when saved — everything but Start. */
+export type StepNode = SnippetNode | UploadNode;
 export type AutomationCanvasEdge = Edge;
 
 /** The one, permanent "Start" node — the automation's parameters, drawn as a node instead of
@@ -38,7 +54,7 @@ export const START_NODE_ID = '__start__';
 export type StartNodeData = Record<string, never>;
 export type StartNode = Node<StartNodeData, 'start'>;
 
-export type AnyCanvasNode = SnippetNode | StartNode;
+export type AnyCanvasNode = SnippetNode | UploadNode | StartNode;
 
 /** Passed via `setContext(AUTOMATION_PARAMS_CONTEXT, …)` from AutomationEditor.svelte down to the
  *  Start node so it can read/mutate `params` without that state needing to travel
diff --git a/packages/ui/src/lib/stores/palette.test.ts b/packages/ui/src/lib/stores/palette.test.ts
index d6a16fc..95d5bfe 100644
--- a/packages/ui/src/lib/stores/palette.test.ts
+++ b/packages/ui/src/lib/stores/palette.test.ts
@@ -68,14 +68,14 @@ describe('paletteItems — filter & sections', () => {
   it('snippet picker always leads with the pinned "new" row, then matching snippets', () => {
     const snippets = [snippet('Build'), snippet('Deploy')];
     const items = paletteItems('pickSnippet', [], [], snippets, '');
-    expect(items.map((i) => i.kind)).toEqual(['newSnippet', 'snippet', 'snippet']);
+    expect(items.map((i) => i.kind)).toEqual(['newSnippet', 'uploadStep', 'snippet', 'snippet']);
   });
 
-  it('snippet picker filters by name, but the "new" row always survives', () => {
+  it('snippet picker filters by name, but the "new" and upload rows always survive', () => {
     const snippets = [snippet('Build'), snippet('Deploy')];
     const items = paletteItems('pickSnippet', [], [], snippets, 'deploy');
-    expect(items.map((i) => i.kind)).toEqual(['newSnippet', 'snippet']);
-    expect(items[1]).toMatchObject({ kind: 'snippet', snippet: { name: 'Deploy' } });
+    expect(items.map((i) => i.kind)).toEqual(['newSnippet', 'uploadStep', 'snippet']);
+    expect(items[2]).toMatchObject({ kind: 'snippet', snippet: { name: 'Deploy' } });
   });
 });
 
diff --git a/packages/ui/src/lib/stores/palette.ts b/packages/ui/src/lib/stores/palette.ts
index 3e4adce..a7202f8 100644
--- a/packages/ui/src/lib/stores/palette.ts
+++ b/packages/ui/src/lib/stores/palette.ts
@@ -18,7 +18,9 @@ export type PaletteItem =
   | { kind: 'session'; session: Session }
   | { kind: 'host'; host: HostDto }
   | { kind: 'snippet'; snippet: SnippetDto }
-  | { kind: 'newSnippet' };
+  | { kind: 'newSnippet' }
+  /** Pinned in `pickSnippet` mode too: a built-in upload step instead of a snippet. */
+  | { kind: 'uploadStep' };
 
 function hostHaystack(h: HostDto): string {
   return `${h.name} ${h.hostname} ${h.user} ${h.tags.join(' ')}`.toLowerCase();
@@ -56,7 +58,7 @@ export function paletteItems(
     const snippetRows: PaletteItem[] = snippets
       .filter((a) => matches(snippetHaystack(a), query))
       .map((snippet) => ({ kind: 'snippet', snippet }));
-    return [{ kind: 'newSnippet' }, ...snippetRows];
+    return [{ kind: 'newSnippet' }, { kind: 'uploadStep' }, ...snippetRows];
   }
   const hostRows: PaletteItem[] = hosts
     .filter((h) => matches(hostHaystack(h), query))
@@ -84,6 +86,8 @@ export function paletteSignature(items: PaletteItem[]): string {
           return `a:${it.snippet.id}`;
         case 'newSnippet':
           return 'new-snippet';
+        case 'uploadStep':
+          return 'upload-step';
       }
     })
     .join('\u0000');
@@ -114,10 +118,10 @@ export interface PaletteState {
   mode: PaletteMode;
 }
 
-/** What `pickSnippet()` resolves with: an existing Snippet, `'new'` (the pinned
- *  row was chosen — the caller opens its own add-snippet form), or `null` (dismissed
+/** What `pickSnippet()` resolves with: an existing Snippet, `'upload'` (the pinned
+ *  upload-step row), `'new'` (the pinned "new" row was chosen — the caller opens its own add-snippet form), or `null` (dismissed
  *  without choosing). */
-export type SnippetPickResult = SnippetDto | 'new' | null;
+export type SnippetPickResult = SnippetDto | 'new' | 'upload' | null;
 
 function createPalette() {
   const { subscribe, set } = writable<PaletteState>({ open: false, mode: 'navigate' });
@@ -169,7 +173,7 @@ function createPalette() {
       set({ open: false, mode: 'navigate' });
     },
     /** Snippet-picker mode: hand the chosen result back to its caller and close. */
-    chooseSnippet(result: SnippetDto | 'new'): void {
+    chooseSnippet(result: SnippetDto | 'new' | 'upload'): void {
       const resolve = pendingSnippet;
       pendingSnippet = null;
       pendingHost?.(null);