diff --git a/projects/github.com/lima-vm/socket_vmnet/package.yml b/projects/github.com/lima-vm/socket_vmnet/package.yml
new file mode 100644
index 0000000000..183c2f15b8
--- /dev/null
+++ b/projects/github.com/lima-vm/socket_vmnet/package.yml
@@ -0,0 +1,57 @@
+# socket_vmnet — vmnet.framework bridge for unmodified rootless QEMU.
+#
+# Used by Lima, Colima, and standalone QEMU setups on macOS to give
+# VMs a real bridged network adapter without root privileges on the
+# QEMU process (socket_vmnet itself still needs to run as root to
+# create the vmnet.framework interface; that's typically done via
+# launchd or sudoers — see share/doc/socket_vmnet/ for templates).
+#
+# macOS-only by design — uses Apple's vmnet.framework which has no
+# Linux equivalent.
+
+distributable:
+  url: https://github.com/lima-vm/socket_vmnet/archive/refs/tags/{{ version.tag }}.tar.gz
+  strip-components: 1
+
+versions:
+  github: lima-vm/socket_vmnet
+
+# macOS only — vmnet.framework is Apple-specific.
+platforms:
+  - darwin
+
+build:
+  env:
+    x86-64:
+      ARCH: x86_64
+    aarch64:
+      ARCH: arm64
+  script:
+    # VERSION normally comes from `git describe`; the source
+    # tarball has no .git so the Makefile falls back to "—".
+    # Override explicitly so the binary's embedded version is right.
+    - make --jobs {{ hw.concurrency }} VERSION=v{{version}} all
+
+    # Upstream's `make install` targets /opt/socket_vmnet with strict
+    # ownership for a launchd setup. Pkgx bottles are user-owned;
+    # we install binaries + docs into {{prefix}}, leaving the
+    # sudoers/launchd templates as docs for users to wire up.
+    - mkdir -p "{{prefix}}/bin" "{{prefix}}/share/doc/socket_vmnet"
+    - install -m755 socket_vmnet         "{{prefix}}/bin/"
+    - install -m755 socket_vmnet_client "{{prefix}}/bin/"
+    - cp README.md LICENSE               "{{prefix}}/share/doc/socket_vmnet/"
+    - cp -R etc_sudoers.d launchd        "{{prefix}}/share/doc/socket_vmnet/"
+
+test:
+  # Full bridge functionality requires root + vmnet.framework setup
+  # which we can't exercise from CI. Best we can do is check the
+  # binary loads and shows --help / --version.
+  # `--help` exits non-zero (usage goes to stderr, this is the binary's
+  # default behavior) so accept any exit code — we just want to confirm
+  # the binary loads and the OS can run it.
+  - (socket_vmnet --help 2>&1 || true) | head -5
+  - (socket_vmnet_client --help 2>&1 || true) | head -5
+
+provides:
+  - bin/socket_vmnet
+  - bin/socket_vmnet_client