Document that C# script steps require the .NET SDK

src/pages/docs/deployments/custom-scripts/index.md

@@ -31,6 +31,29 @@ Support for ScriptCS in Octopus will be removed from `2025.3`.
 To view previous and upcoming deprecations, please visit our [deprecations page](https://octopus.com/docs/deprecations).
 :::
 
+## C# script requirements {#csharp-requirements}
+
+C# scripts (`.csx`) run through [dotnet-script](https://github.com/dotnet-script/dotnet-script), which needs the **.NET SDK** — not just the runtime — on the machine that runs the script: a [deployment target](/docs/infrastructure/deployment-targets), a [worker](/docs/infrastructure/workers), or the Octopus Server. This applies to every C# script, because dotnet-script runs `dotnet restore` against a generated project even when the script references no NuGet packages.
+
+With only the runtime installed, the step fails with a message that points at your NuGet references rather than the missing SDK:
+
+```text
+Unable to restore packages from '/root/.cache/dotnet-script/work/net8.0/script.csproj'
+Make sure that all script files contains valid NuGet references
+```
+
+### Which SDK version {#csharp-sdk-version}
+
+dotnet-script targets whichever .NET runtime the `dotnet` on the path resolves, so install an SDK at least as new as that runtime. Installing the SDK also installs a matching runtime. Calamari is [self-contained](/docs/octopus-rest-api/calamari) and carries its own runtime, but your C# script runs under the machine's `dotnet`.
+
+The [octopusdeploy/worker-tools images](/docs/projects/steps/execution-containers-for-workers/#worker-tools-images) include a .NET SDK, so C# scripts run in an [execution container](/docs/projects/steps/execution-containers-for-workers) without any extra setup.
+
+### NuGet sources {#csharp-nuget-source}
+
+By default, dotnet-script restores packages from `https://api.nuget.org/v3/index.json`. To restore from a different feed, set the `Octopus.Action.Script.CSharp.NuGetSource` [system variable](/docs/projects/variables/system-variables) on the project or step.
+
+Only one source can be supplied. It replaces the default and overrides any sources configured in a `NuGet.config` on the machine, so a script needing packages from both nuget.org and a private feed must point at a feed that can serve all of them, such as a private feed configured to proxy nuget.org upstream.
+
 ## What you can do with custom scripts
 
 If an activity can be scripted, Octopus can run that script as a standalone activity or as part of a larger orchestration.

src/pages/docs/infrastructure/deployment-targets/linux/ssh-requirements.md

@@ -1,7 +1,7 @@
 ---
 layout: src/layouts/Default.astro
 pubDate: 2023-01-01
-modDate: 2024-03-22
+modDate: 2026-08-11
 title: SSH target requirements
 description: Requirements for using SSH deployment targets with Octopus.
 navOrder: 15
@@ -31,6 +31,17 @@ See the Bash Reference Manual, section [6.2 Bash Startup Files](http://www.gnu.o
 
 Since it is self-contained, .NET Core does not need to be installed on the target server. However, there are still some [pre-requisite dependencies](https://learn.microsoft.com/en-us/dotnet/core/install/linux-scripted-manual#dependencies) required for .NET Core itself that must be installed.
 
+This covers Calamari itself; [C# scripts](#csharp) have their own requirement.
+
+## C# scripts {#csharp}
+
+C# scripts (`.csx`) are executed by [dotnet-script](https://github.com/dotnet-script/dotnet-script), which needs more than the self-contained Calamari runtime. Octopus can run them on an SSH target provided:
+
+- The **.NET SDK** is installed, not just the .NET runtime — this applies to every C# script, including scripts that reference no NuGet packages
+- `dotnet` is on the path for the SSH user executing the deployment
+
+See [C# script requirements](/docs/deployments/custom-scripts/#csharp-requirements) for the SDK version to install and the failure you'll see if only the runtime is present.
+
 ## Git-based steps
 
 Git-based steps (steps that clone or fetch from a git repository as part of a deployment or runbook) require OpenSSL **1.1** or **3** on the host. SSH targets running with other OpenSSL versions will fail when running these steps.

src/pages/docs/projects/variables/system-variables.md

@@ -1,7 +1,7 @@
 ---
 layout: src/layouts/Default.astro
 pubDate: 2023-01-01
-modDate: 2026-08-03
+modDate: 2026-08-11
 title: System variables
 sidebarLabel: System variables
 navOrder: 20
@@ -239,7 +239,7 @@ You can also read these variables for a different action using indexed notation,
 | `Octopus.Action.Package.SkipIfAlreadyInstalled` | Whether re-deployment is skipped when the package version is already on the machine. | `False` |
 | `Octopus.Action.Script.ScriptBody` | The script being run in a script step. | `Write-Host 'Hello'` |
 | `Octopus.Action.Script.Syntax` | The syntax of the script being run in a script step. | PowerShell |
-| `Octopus.Action.Script.CSharp.NuGetSource` | The NuGet source used by the dotnet executor for C# script steps. | `https://my-nuget-server/nuget` |
+| `Octopus.Action.Script.CSharp.NuGetSource` | The NuGet source used by the dotnet executor for C# script steps. Only one source can be supplied, and it replaces the default source rather than adding to it. See [NuGet sources for C# scripts](/docs/deployments/custom-scripts/#csharp-nuget-source). | `https://my-nuget-server/nuget` |
 | `Octopus.Action.SkipRemainingConventions` | Set as an output variable to finish the action without running further conventions or scripts. | `True` |
 | `Octopus.Action.TargetRoles` | The machine target tags targeted by the action. | `web-server,frontend` |
 | `Octopus.Action.Template.Id` | The ID of the step template the action is based on, if any. | `action-templates-123` |