diff --git a/Makefile b/Makefile
index a461bfa..cdf84aa 100644
--- a/Makefile
+++ b/Makefile
@@ -7,15 +7,11 @@
 
 GOFLAGS := -trimpath
 
-.PHONY: build gitctl test clean proto proto-tools proto-check
+.PHONY: build test clean proto proto-tools proto-check
 
 # build the simplegit server into ./build.
 build:
-	go build $(GOFLAGS) -o daemon ./cmd/daemon
-
-# build the ManageService TUI client into ./build.
-gitctl:
-	go build $(GOFLAGS) -o gitctl ./cmd/gitctl
+	go build $(GOFLAGS) -o simplegit ./cmd
 
 # run all tests.
 test:
diff --git a/cmd/main.go b/cmd/main.go
new file mode 100644
index 0000000..7e6d9fe
--- /dev/null
+++ b/cmd/main.go
@@ -0,0 +1,51 @@
+// simplegit is the single entry point for the simplegit git-hosting server and
+// its management TUI. The two used to be separate binaries (cmd/daemon and
+// cmd/gitctl); they are now subcommands of one binary.
+//
+//	simplegit daemon   run the git hosting server (HTTP + SSH + manage)
+//	simplegit ctl      run the gitctl TUI against the manage port
+//	simplegit          (no args, or any other subcommand) print help
+//
+// Each subcommand owns its own flag set, so flags are parsed after the
+// subcommand is selected: `simplegit daemon -skip-auth`, `simplegit ctl -manage ...`.
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"simplegit/cmd/daemon"
+	"simplegit/cmd/gitctl"
+)
+
+func main() {
+	args := os.Args[1:]
+	if len(args) == 0 {
+		printHelp(os.Stdout)
+		return
+	}
+	switch args[0] {
+	case "daemon":
+		daemon.Run(args[1:])
+	case "ctl":
+		gitctl.Run(args[1:])
+	case "help", "-h", "--help":
+		printHelp(os.Stdout)
+	default:
+		fmt.Fprintf(os.Stderr, "simplegit: unknown subcommand %q\n\n", args[0])
+		printHelp(os.Stderr)
+		os.Exit(2)
+	}
+}
+
+func printHelp(w *os.File) {
+	fmt.Fprint(w, `simplegit - minimal git hosting server + management TUI
+
+Usage:
+  simplegit daemon [flags]   run the git hosting server (HTTP + SSH + manage)
+  simplegit ctl   [flags]   run the gitctl TUI against the manage port
+  simplegit help            show this help
+
+Run "simplegit daemon -h" or "simplegit ctl -h" for subcommand flags.
+`)
+}
diff --git a/tests/api_e2e.sh b/tests/api_e2e.sh
index 4a0ad87..4bc6944 100755
--- a/tests/api_e2e.sh
+++ b/tests/api_e2e.sh
@@ -3,7 +3,7 @@
 #
 # Assumes the backend is already listening at $BASE (default :8091). Start it
 # in another terminal, e.g.:
-#   go run ./cmd -root /tmp/sgtest -http :8091 -ssh :2222
+#   go run ./cmd daemon -root /tmp/sgtest -rpc :8091 -ssh :2222
 # then run:
 #   ./tests/api_e2e.sh
 #
diff --git a/tests/http_push.sh b/tests/http_push.sh
index 35a106d..150eebb 100755
--- a/tests/http_push.sh
+++ b/tests/http_push.sh
@@ -32,7 +32,7 @@ trap 'rm -rf "$WORK"; [ -n "$SG_PID" ] && kill "$SG_PID" 2>/dev/null' EXIT
 mkdir -p "$ROOT"
 
 # --- start simplegit (skip-auth: anon read+write, no console needed) ---
-"$BIN" -rpc "$RPC" -ssh "" -root "$ROOT" -skip-auth >"$WORK/sg.log" 2>&1 &
+"$BIN" daemon -rpc "$RPC" -ssh "" -root "$ROOT" -skip-auth >"$WORK/sg.log" 2>&1 &
 SG_PID=$!
 
 # wait until the HTTP port answers