diff --git a/bin/build-rescue-usb.sh b/bin/build-rescue-usb.sh
index 96952ac..56c633e 100755
--- a/bin/build-rescue-usb.sh
+++ b/bin/build-rescue-usb.sh
@@ -10,6 +10,9 @@
 # Requires: curl, gpg, dosfstools, parted, util-linux (losetup), mtools.
 set -euo pipefail
 
+# Shared SystemRescue download + signature verification.
+source "$(dirname "$0")/lib/iso-lib.sh"
+
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 CACHE_DIR="${REPO_ROOT}/.cache"
 SYSRESCUE_VERSION="${SYSRESCUE_VERSION:-13.00}"
@@ -93,24 +96,6 @@ mkdir -p "$CACHE_DIR"
 iso_path="${CACHE_DIR}/systemrescue-${SYSRESCUE_VERSION}-amd64.iso"
 sig_path="${iso_path}.asc"
 
-download_iso() {
-    if [[ -f "$iso_path" ]]; then
-        echo "==> Using cached ISO: $iso_path"
-    else
-        echo "==> Downloading SystemRescue ${SYSRESCUE_VERSION}..."
-        curl -fL --retry 3 -o "$iso_path" "$SYSRESCUE_ISO_URL"
-    fi
-    if [[ ! -f "$sig_path" ]]; then
-        curl -fL --retry 3 -o "$sig_path" "$SYSRESCUE_SIG_URL"
-    fi
-    echo "==> Verifying signature..."
-    # Import key if missing, then verify
-    if ! gpg --list-keys "$SYSRESCUE_SIGNING_KEY" > /dev/null 2>&1; then
-        gpg --keyserver keyserver.ubuntu.com --recv-keys "$SYSRESCUE_SIGNING_KEY" \
-            || gpg --keyserver keys.openpgp.org --recv-keys "$SYSRESCUE_SIGNING_KEY"
-    fi
-    gpg --verify "$sig_path" "$iso_path"
-}
 
 build_image() {
     local out="$1"
diff --git a/bin/build-wipe-usb.sh b/bin/build-wipe-usb.sh
index d168aba..ea5335b 100755
--- a/bin/build-wipe-usb.sh
+++ b/bin/build-wipe-usb.sh
@@ -10,6 +10,9 @@
 # Requires: curl, gpg, dosfstools, parted, util-linux (losetup), mtools.
 set -euo pipefail
 
+# Shared SystemRescue download + signature verification.
+source "$(dirname "$0")/lib/iso-lib.sh"
+
 REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 CACHE_DIR="${REPO_ROOT}/.cache"
 SYSRESCUE_VERSION="${SYSRESCUE_VERSION:-13.00}"
@@ -68,23 +71,6 @@ mkdir -p "$CACHE_DIR"
 iso_path="${CACHE_DIR}/systemrescue-${SYSRESCUE_VERSION}-amd64.iso"
 sig_path="${iso_path}.asc"
 
-download_iso() {
-    if [[ -f "$iso_path" ]]; then
-        echo "==> Using cached ISO: $iso_path"
-    else
-        echo "==> Downloading SystemRescue ${SYSRESCUE_VERSION}..."
-        curl -fL --retry 3 -o "$iso_path" "$SYSRESCUE_ISO_URL"
-    fi
-    if [[ ! -f "$sig_path" ]]; then
-        curl -fL --retry 3 -o "$sig_path" "$SYSRESCUE_SIG_URL"
-    fi
-    echo "==> Verifying signature..."
-    if ! gpg --list-keys "$SYSRESCUE_SIGNING_KEY" > /dev/null 2>&1; then
-        gpg --keyserver keyserver.ubuntu.com --recv-keys "$SYSRESCUE_SIGNING_KEY" \
-            || gpg --keyserver keys.openpgp.org --recv-keys "$SYSRESCUE_SIGNING_KEY"
-    fi
-    gpg --verify "$sig_path" "$iso_path"
-}
 
 build_image() {
     local out="$1"
diff --git a/bin/lib/iso-lib.sh b/bin/lib/iso-lib.sh
new file mode 100644
index 0000000..267955a
--- /dev/null
+++ b/bin/lib/iso-lib.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+# Shared SystemRescue ISO download + signature verification for the USB build
+# scripts. Requires the caller to define:
+#   iso_path, sig_path,
+#   SYSRESCUE_VERSION, SYSRESCUE_ISO_URL, SYSRESCUE_SIG_URL, SYSRESCUE_SIGNING_KEY
+
+download_iso() {
+    if [[ -f "$iso_path" ]]; then
+        echo "==> Using cached ISO: $iso_path"
+    else
+        echo "==> Downloading SystemRescue ${SYSRESCUE_VERSION}..."
+        curl -fL --retry 3 -o "$iso_path" "$SYSRESCUE_ISO_URL"
+    fi
+    if [[ ! -f "$sig_path" ]]; then
+        curl -fL --retry 3 -o "$sig_path" "$SYSRESCUE_SIG_URL"
+    fi
+    echo "==> Verifying signature..."
+    # Import key if missing, then verify
+    if ! gpg --list-keys "$SYSRESCUE_SIGNING_KEY" > /dev/null 2>&1; then
+        gpg --keyserver keyserver.ubuntu.com --recv-keys "$SYSRESCUE_SIGNING_KEY" \
+            || gpg --keyserver keys.openpgp.org --recv-keys "$SYSRESCUE_SIGNING_KEY"
+    fi
+    gpg --verify "$sig_path" "$iso_path"
+}