diff --git a/docs/04-tofu.md b/docs/04-tofu.md
index a530418..6741fa9 100644
--- a/docs/04-tofu.md
+++ b/docs/04-tofu.md
@@ -240,7 +240,10 @@ Headlamp's port-forward command is unchanged (`kubectl` just needs
 
 ## 7. Tearing down the manual VM
 
-Now that the real 3-node cluster is up, remove stage 2's throwaway one:
+Now that the real 3-node cluster is up, remove stage 2's throwaway one.
+`scripts/cleanup-manual-vm.sh` runs the commands below (with a confirmation
+prompt first, since it's destructive) — worth reading through once so you
+know what it's doing before you run it unattended:
 
 ```sh
 virsh -c qemu:///system destroy k3s-manual              # stop it
diff --git a/scripts/cleanup-manual-vm.sh b/scripts/cleanup-manual-vm.sh
new file mode 100755
index 0000000..4dab781
--- /dev/null
+++ b/scripts/cleanup-manual-vm.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# Tears down stage 2's throwaway k3s-manual VM (docs/02-k3s.md).
+# See docs/04-tofu.md, "Tearing down the manual VM" for what each step does
+# and why nothing else needs cleaning up.
+set -euo pipefail
+
+read -p "This will destroy the k3s-manual VM and its disks. Continue? [y/N] " confirm
+[[ "$confirm" =~ ^[Yy]$ ]] || exit 0
+
+virsh -c qemu:///system destroy k3s-manual 2>/dev/null || true
+virsh -c qemu:///system undefine k3s-manual --remove-all-storage 2>/dev/null || true
+virsh -c qemu:///system vol-delete --pool default k3s-manual-base.qcow2 2>/dev/null || true
+rm -f ~/.kube/config-manual
+rm -rf ~/vms
+
+echo "k3s-manual cleaned up."