diff --git a/.github/workflows/portable-native-build.yml b/.github/workflows/portable-native-build.yml
index d4e0a34a..97271e46 100644
--- a/.github/workflows/portable-native-build.yml
+++ b/.github/workflows/portable-native-build.yml
@@ -11,6 +11,9 @@ on:
       - "scripts/build.mjs"
       - "scripts/platform-storage-probe.ts"
       - "scripts/windows-credential-probe.ts"
+      - "scripts/windows-icon.ts"
+      - "scripts/windows-package-probe.ts"
+      - "forge.config.ts"
       - "src/**"
       - "tests/integration/gw-dat-dimensions.test.ts"
       - "package.json"
@@ -63,3 +66,21 @@ jobs:
         run: >-
           node --import ./scripts/ts-hook.mjs --test
           tests/integration/gw-dat-dimensions.test.ts
+      - name: Build the unsigned Windows Squirrel package
+        if: runner.os == 'Windows'
+        env:
+          GW_PACKAGE_INTENT: local
+        run: pnpm make -- --platform=win32 --arch=x64
+      - name: Inspect the exact Windows package boundary
+        if: runner.os == 'Windows'
+        run: pnpm test:windows-package
+      - name: Prove the local package has no trusted distribution signature
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $setup = Get-ChildItem "out/make/squirrel.windows/x64/*Setup.exe"
+          if ($setup.Count -ne 1) { throw "Expected one Setup executable" }
+          $signature = Get-AuthenticodeSignature $setup.FullName
+          if ($signature.Status -ne "NotSigned") {
+            throw "Local package unexpectedly has status $($signature.Status)"
+          }
diff --git a/apps/launcher/src/App.vue b/apps/launcher/src/App.vue
index feb1b10f..d522ee66 100644
--- a/apps/launcher/src/App.vue
+++ b/apps/launcher/src/App.vue
@@ -219,6 +219,9 @@ const toolLabels: Readonly<Record<GlobalTool, string>> = {
   "xunlai-storage": "Xunlai Storage",
 };
 const profileIcons = { swords: Swords, archive: Archive, map: MapIcon, scroll: ScrollText, shield: Shield, star: Star, crown: Crown, flame: Flame } as const;
+const primaryModifierName = computed(() =>
+  snapshot.value.platform === "macos" ? "Command" : "Ctrl"
+);
 
 function checked(event: Event): boolean {
   return (event.currentTarget as HTMLInputElement).checked;
@@ -301,12 +304,12 @@ async function captureToolShortcut(tool: GlobalTool) {
   if (!result) return;
   if (result.status === "captured") {
     if (await runAction("The shortcut could not be saved.", () => native?.tools.replaceShortcut({ tool, binding: result.binding }))) shortcutMessage.value = "Shortcut saved.";
-  } else if (result.status === "reserved") shortcutMessage.value = "That shortcut is used by macOS or this application.";
+  } else if (result.status === "reserved") shortcutMessage.value = "That shortcut is used by your system or this application.";
   else if (result.status === "conflict") {
     pendingShortcutReplacement.value = { tool, binding: result.binding };
     shortcutMessage.value = `That shortcut is already used by ${toolLabels[result.tool]}.`;
   }
-  else if (result.status === "invalid") shortcutMessage.value = "Use Command with a letter or number.";
+  else if (result.status === "invalid") shortcutMessage.value = `Use ${primaryModifierName.value} with a letter or number.`;
   else shortcutMessage.value = "Shortcut change cancelled.";
 }
 
@@ -342,7 +345,7 @@ async function replaceToolShortcut() {
       <AlertTriangle /><div><strong>{{ playableNotice.title }}</strong><span>{{ playableNotice.detail }}</span></div>
       <button @click="openSettings('game-files')">View game files</button>
     </section>
-    <section v-else-if="snapshot.readiness.state === 'offline-playable'" class="priority-banner"><AlertTriangle /><div><strong>You are offline</strong><span>You can play with the game files already on this Mac.</span></div></section>
+    <section v-else-if="snapshot.readiness.state === 'offline-playable'" class="priority-banner"><AlertTriangle /><div><strong>You are offline</strong><span>You can play with the game files already on this computer.</span></div></section>
     <section v-else-if="backgroundDownloadBanner" class="priority-banner"><Clock3 /><div><strong>{{ backgroundDownloadBanner.title }}</strong><span>{{ backgroundDownloadBanner.detail }}</span></div><button @click="openSettings('game-files')">View download</button></section>
     <section v-else class="funding-banner">
       <div><strong>Help cover the yearly costs</strong><span>Apple Developer Program, domain, and hosting</span></div>
@@ -395,7 +398,7 @@ async function replaceToolShortcut() {
               <div v-if="snapshot.tools.restartRequired" class="restart-row"><span><strong>Restart needed</strong><small>Your change is saved.</small></span><button v-if="!visibleProfiles.some(profile => profile.state === 'running')" class="primary" @click="runAction('The application could not restart.', () => native?.tools.restartToApply())">Restart application</button><span v-else>Applies after your next normal restart.</span></div>
             </div>
           </template>
-          <MapsSettings v-else-if="settingsRoute === 'maps'" :settings="snapshot.settings" :save="updateLauncherSettings" />
+          <MapsSettings v-else-if="settingsRoute === 'maps'" :settings="snapshot.settings" :platform="snapshot.platform" :save="updateLauncherSettings" />
           <GameFilesSettings
             v-else-if="settingsRoute === 'game-files'"
             :readiness="snapshot.readiness"
@@ -437,7 +440,7 @@ async function replaceToolShortcut() {
 
     <BaseModal v-if="snapshot.experience.setup === 'pending'" labelledby="setup-title" :dismissible="false" wide>
       <div class="setup-card">
-        <template v-if="setupStep === 1"><span class="eyebrow">Welcome</span><h2 id="setup-title">Welcome to Guild Wars Reforged</h2><p>Guild Wars Reforged runs Guild Wars on your Mac. It is an unofficial community project and is not affiliated with ArenaNet or NCSOFT.</p><div class="form-actions"><button class="primary" @click="setupStep = 2">Continue</button></div></template>
+        <template v-if="setupStep === 1"><span class="eyebrow">Welcome</span><h2 id="setup-title">Welcome to Guild Wars Reforged</h2><p>Guild Wars Reforged runs Guild Wars on your computer. It is an unofficial community project and is not affiliated with ArenaNet or NCSOFT.</p><div class="form-actions"><button class="primary" @click="setupStep = 2">Continue</button></div></template>
         <template v-else><span class="eyebrow">Optional</span><h2 id="setup-title">Optional Tools</h2><p>Build Management saves team builds. Quick Travel opens a map search. Xunlai Storage opens storage in supported outposts.</p><p><strong>Tools apply to every account.</strong></p><p class="setup-note">If you enable Tools, the app restarts once to finish setup.</p><div class="form-actions spread"><button class="secondary" @click="setupStep = 1">Back</button><span /><button class="secondary" @click="completeSetup(false)">Not now</button><button class="primary" @click="completeSetup(true)">Enable Tools</button></div></template>
       </div>
     </BaseModal>
diff --git a/apps/launcher/src/components/KnownIssuesView.vue b/apps/launcher/src/components/KnownIssuesView.vue
index f3221684..225f06ae 100644
--- a/apps/launcher/src/components/KnownIssuesView.vue
+++ b/apps/launcher/src/components/KnownIssuesView.vue
@@ -8,11 +8,11 @@ const emit = defineEmits<{ external: [kind: LauncherExternalLink] }>();
 
 <template>
   <section class="page">
-    <div class="page-head"><div><span class="eyebrow">Support</span><h1>Known issues</h1><p>Current game and macOS issues, with workarounds when we have one.</p></div></div>
+    <div class="page-head"><div><span class="eyebrow">Support</span><h1>Known issues</h1><p>Current game and launcher issues, with workarounds when we have one.</p></div></div>
     <div v-if="availability === 'placeholder'" class="empty-state"><AlertTriangle /><h3>Known issues are not connected yet.</h3><p>Check GitHub or Discord for current reports and workarounds.</p><div class="form-actions"><button class="secondary" @click="emit('external', 'discord')">Open Discord</button><button class="primary" @click="emit('external', 'github')">Open GitHub</button></div></div>
     <div v-else class="issue-list">
       <article><AlertTriangle /><div><h3>Some textures may appear black</h3><p>Restart the affected game window. Your saved data is not affected.</p><button class="text-link" @click="emit('external', 'github')">View workaround <ExternalLink /></button></div><span>Game</span></article>
-      <article><AlertTriangle /><div><h3>Long sessions can use too much memory</h3><p>Close and reopen the game window when macOS shows a memory warning.</p></div><span>Game</span></article>
+      <article><AlertTriangle /><div><h3>Long sessions can use too much memory</h3><p>Close and reopen the game window when your system shows a memory warning.</p></div><span>Game</span></article>
       <article class="resolved"><Check /><div><h3>Map reveal crash</h3><p>Fixed in the current launcher version.</p></div><span>Resolved</span></article>
     </div>
   </section>
diff --git a/apps/launcher/src/components/MapsSettings.test.ts b/apps/launcher/src/components/MapsSettings.test.ts
index d22376ac..3c428ddb 100644
--- a/apps/launcher/src/components/MapsSettings.test.ts
+++ b/apps/launcher/src/components/MapsSettings.test.ts
@@ -7,7 +7,7 @@ describe("Maps settings", () => {
   it("keeps the global map controls and their style editor in the launcher", async () => {
     const save = vi.fn(async () => undefined);
     const wrapper = mount(MapsSettings, {
-      props: { settings: fixtureSnapshot.settings, save },
+      props: { settings: fixtureSnapshot.settings, platform: "macos", save },
     });
 
     expect(wrapper.text()).toContain("These settings apply to every account");
@@ -28,7 +28,7 @@ describe("Maps settings", () => {
   it("refuses invalid imported style text without writing settings", async () => {
     const save = vi.fn(async () => undefined);
     const wrapper = mount(MapsSettings, {
-      props: { settings: fixtureSnapshot.settings, save },
+      props: { settings: fixtureSnapshot.settings, platform: "macos", save },
     });
     const textarea = wrapper.get("textarea");
     await textarea.setValue("not a map style");
diff --git a/apps/launcher/src/components/MapsSettings.vue b/apps/launcher/src/components/MapsSettings.vue
index 1b58ce3b..1ac5a908 100644
--- a/apps/launcher/src/components/MapsSettings.vue
+++ b/apps/launcher/src/components/MapsSettings.vue
@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import { computed, ref } from "vue";
 import type { LauncherSettings, LauncherSettingsPatch } from "@shared/launcher-contracts";
+import type { ShortcutPlatform } from "@shared/keyboard-shortcuts";
 import {
   CARTOGRAPHY_BUILTIN_PRESETS,
   CARTOGRAPHY_LINE_PATTERNS,
@@ -23,6 +24,7 @@ import {
 
 const props = defineProps<{
   settings: LauncherSettings;
+  platform: ShortcutPlatform;
   save: (patch: LauncherSettingsPatch) => Promise<void>;
 }>();
 
@@ -31,6 +33,7 @@ const importValue = ref("");
 const editing = ref(false);
 const active = computed(() => resolveCartographyPresetEntry(props.settings.cartographyPresetLibrary));
 const exportValue = computed(() => active.value ? encodeCartographyPreset({ name: active.value.name, style: active.value.style }) : "");
+const copyShortcut = computed(() => props.platform === "macos" ? "Command-C" : "Ctrl-C");
 const lineLabels = {
   lattice: "Grid lines",
   current: "Current cell",
@@ -174,7 +177,7 @@ async function updateUnseen(field: "color" | "marker", value: string) {
       <label><span><strong>Style name</strong></span><input :value="active.name" maxlength="40" @change="rename(($event.currentTarget as HTMLInputElement).value)" /></label>
       <button class="text-link" @click="remove">Delete custom style</button>
     </template>
-    <details><summary>Import or share a style</summary><label>Style text<textarea rows="4" :value="importValue || exportValue" @input="importValue = ($event.currentTarget as HTMLTextAreaElement).value" /></label><button class="secondary" :disabled="!importValue" @click="importPreset">Import as new style</button><p>Select the text and press Command-C to share the current style. Paste another style here to import it.</p></details>
+    <details><summary>Import or share a style</summary><label>Style text<textarea rows="4" :value="importValue || exportValue" @input="importValue = ($event.currentTarget as HTMLTextAreaElement).value" /></label><button class="secondary" :disabled="!importValue" @click="importPreset">Import as new style</button><p>Select the text and press {{ copyShortcut }} to share the current style. Paste another style here to import it.</p></details>
   </div>
 
   <div v-if="editing && active?.custom" class="setting-group map-style-editor">
diff --git a/apps/launcher/src/components/UpdateGameFilesSettings.test.ts b/apps/launcher/src/components/UpdateGameFilesSettings.test.ts
index 6a2c863d..16017834 100644
--- a/apps/launcher/src/components/UpdateGameFilesSettings.test.ts
+++ b/apps/launcher/src/components/UpdateGameFilesSettings.test.ts
@@ -134,7 +134,7 @@ describe("Game Files settings", () => {
         reset: noOp,
       },
     });
-    expect(wrapper.text()).toContain("stopped because this Mac is offline");
+    expect(wrapper.text()).toContain("stopped because this computer is offline");
     await wrapper.get(".download-card button").trigger("click");
     expect(resume).toHaveBeenCalledOnce();
   });
diff --git a/apps/launcher/src/update-game-files-copy.ts b/apps/launcher/src/update-game-files-copy.ts
index 1520434d..f863829f 100644
--- a/apps/launcher/src/update-game-files-copy.ts
+++ b/apps/launcher/src/update-game-files-copy.ts
@@ -106,7 +106,7 @@ function failedApplicationUpdate(
 
 const DOWNLOAD_FAILURE: Partial<Record<ErrorCode, string>> = {
   disk_full: "There is not enough free space to finish downloading. Free some space, then try again.",
-  net_offline: "The download stopped because this Mac is offline. Reconnect, then try again.",
+  net_offline: "The download stopped because this computer is offline. Reconnect, then try again.",
   dns_timeout: "The download could not reach ArenaNet. Check your connection, then try again.",
   http_status: "ArenaNet could not serve a game file. This is usually temporary; try again in a few minutes.",
 };
@@ -118,7 +118,7 @@ export function backgroundDownloadFailure(reason: ErrorCode): string {
 
 const REPAIR_REASON: Partial<Record<ErrorCode, string>> = {
   disk_full: "There is not enough free space to prepare Guild Wars. Free some space, then repair the game files.",
-  net_offline: "This Mac is offline and no usable game client is available. Reconnect, then repair the game files.",
+  net_offline: "This computer is offline and no usable game client is available. Reconnect, then repair the game files.",
   dns_timeout: "ArenaNet could not be reached. Check your connection, then repair the game files.",
   http_status: "ArenaNet could not provide the required game files. Try the repair again in a few minutes.",
   artifact_unverified: "A downloaded game file did not pass verification. Repair will download a clean copy.",
diff --git a/assets/AppIcon.ico b/assets/AppIcon.ico
new file mode 100644
index 00000000..e4e54644
Binary files /dev/null and b/assets/AppIcon.ico differ
diff --git a/forge.config.ts b/forge.config.ts
index 3c2322df..87705cb4 100644
--- a/forge.config.ts
+++ b/forge.config.ts
@@ -1,4 +1,5 @@
 import { MakerDMG } from "@electron-forge/maker-dmg";
+import { MakerSquirrel } from "@electron-forge/maker-squirrel";
 import { MakerZIP } from "@electron-forge/maker-zip";
 import type { ForgeConfig } from "@electron-forge/shared-types";
 import { flipFuses, FuseV1Options, FuseVersion } from "@electron/fuses";
@@ -15,6 +16,10 @@ import {
   DISTRIBUTION_CHANNEL_CONFIG,
   distributionMarker,
 } from "./src/shared/distribution-channel.js";
+import {
+  releaseAssetUrl,
+  releaseUpdateArtifactName,
+} from "./src/shared/project-identity.js";
 
 const packageVersion = (
   JSON.parse(
@@ -27,6 +32,7 @@ const macOSVersion = macOSBundleVersions(packageVersion);
 const packageMode = resolvePackageMode(process.env.GW_PACKAGE_INTENT);
 const channelConfig = DISTRIBUTION_CHANNEL_CONFIG[packageMode.productChannel];
 const buildingDarwin = process.platform === "darwin";
+const buildingWindows = process.platform === "win32";
 
 function packagedExecutablePath(
   resourcesPath: string,
@@ -80,6 +86,16 @@ const releaseNotarization = buildingDarwin && packageMode.intent === "release"
     }
   : undefined;
 
+const windowsSigning = buildingWindows && packageMode.kind === "signed"
+  ? {
+      certificateFile: requiredSigningEnvironment("WINDOWS_CERTIFICATE_FILE"),
+      certificatePassword: requiredSigningEnvironment("WINDOWS_CERTIFICATE_PASSWORD"),
+      timestampServer: "https://timestamp.digicert.com",
+      description: channelConfig.productName,
+      website: "https://gwonmac.com",
+    }
+  : undefined;
+
 const config: ForgeConfig = {
   packagerConfig: {
     // Both are executable code that cannot run from inside the archive: a
@@ -92,7 +108,7 @@ const config: ForgeConfig = {
     executableName: channelConfig.productName,
     appVersion: macOSVersion.appVersion,
     buildVersion: macOSVersion.buildVersion,
-    icon: path.resolve("assets/AppIcon.icns"),
+    icon: path.resolve(buildingWindows ? "assets/AppIcon.ico" : "assets/AppIcon.icns"),
     appBundleId: channelConfig.bundleId,
     appCategoryType: "public.app-category.games",
     darwinDarkModeSupport: true,
@@ -123,6 +139,27 @@ const config: ForgeConfig = {
   rebuildConfig: {},
   makers: [
     new MakerZIP({}, ["darwin"]),
+    ...(buildingWindows
+      ? [
+          new MakerSquirrel({
+            usePackageJson: false,
+            name: channelConfig.windowsPackageId,
+            title: channelConfig.productName,
+            exe: `${channelConfig.productName}.exe`,
+            version: packageVersion,
+            authors: "gwonmac contributors",
+            owners: "gwonmac contributors",
+            copyright: "© 2026 gwonmac contributors. Guild Wars © ArenaNet LLC.",
+            description: "Run Guild Wars with native profiles, updates, and optional Tools.",
+            setupExe: releaseUpdateArtifactName(packageVersion, "win32-x64"),
+            setupIcon: path.resolve("assets/AppIcon.ico"),
+            iconUrl: releaseAssetUrl(`v${packageVersion}`, "AppIcon.ico"),
+            noMsi: true,
+            noDelta: true,
+            ...(windowsSigning ? { windowsSign: windowsSigning } : {}),
+          }),
+        ]
+      : []),
     ...(buildingDarwin && packageMode.intent === "release"
       ? [
           new MakerDMG({
@@ -161,7 +198,10 @@ const config: ForgeConfig = {
       platform,
       arch,
     ) => {
-      if (platform === "darwin" && packageMode.kind === "signed") {
+      if (
+        (platform === "darwin" || platform === "win32")
+        && packageMode.kind === "signed"
+      ) {
         writeFileSync(
           path.resolve(resourcesPath, "..", "distribution-channel.json"),
           `${JSON.stringify(distributionMarker(packageMode.channel))}\n`,
diff --git a/package.json b/package.json
index 9d003ee7..3fa40970 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "private": true,
   "packageManager": "pnpm@11.13.1",
   "type": "module",
-  "description": "Guild Wars Reforged for macOS",
+  "description": "Guild Wars Reforged desktop launcher",
   "author": "gwonmac contributors",
   "license": "GPL-3.0-only",
   "repository": {
@@ -27,6 +27,7 @@
     "launcher:fixture": "pnpm build && node --import ./scripts/ts-hook.mjs scripts/launcher-fixture.ts",
     "storage:probe": "node --import ./scripts/ts-hook.mjs scripts/platform-storage-probe.ts",
     "test:windows-credentials": "node --import ./scripts/ts-hook.mjs scripts/windows-credential-probe.ts",
+    "test:windows-package": "node --import ./scripts/ts-hook.mjs scripts/windows-package-probe.ts",
     "test:signed-dev": "node --import ./scripts/ts-hook.mjs scripts/run-signed-dev.ts --test-keychain",
     "tools:dev": "pnpm --filter @gwonmac/tools-ui dev",
     "tools:test": "pnpm --filter @gwonmac/tools-ui test",
@@ -76,6 +77,7 @@
   "devDependencies": {
     "@electron-forge/cli": "^7.11.2",
     "@electron-forge/maker-dmg": "^7.11.2",
+    "@electron-forge/maker-squirrel": "^7.11.2",
     "@electron-forge/maker-zip": "^7.11.2",
     "@electron-forge/shared-types": "^7.11.2",
     "@electron/asar": "^3.4.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 38c60248..748c35f8 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -33,6 +33,9 @@ importers:
       '@electron-forge/maker-dmg':
         specifier: ^7.11.2
         version: 7.11.2
+      '@electron-forge/maker-squirrel':
+        specifier: ^7.11.2
+        version: 7.11.2
       '@electron-forge/maker-zip':
         specifier: ^7.11.2
         version: 7.11.2
@@ -440,6 +443,10 @@ packages:
     resolution: {integrity: sha512-vh8/mnu3xyMbRcz3S0TV1rB7ZyGhMK60Yz2f2R+Zmj1EbAivLEq5UAvzHdB+kLttr0Dpjp2FIX4TcZ9neD4Y9g==}
     engines: {node: '>= 16.4.0'}
 
+  '@electron-forge/maker-squirrel@7.11.2':
+    resolution: {integrity: sha512-4CILo57ZDEQH1mJxjhYCSXuv+WaU7oPq67KqiTLEUOEzmiPg9u9/z7FXE34H/Tn5aKWN3dy+ngAETzv6iERCGg==}
+    engines: {node: '>= 16.4.0'}
+
   '@electron-forge/maker-zip@7.11.2':
     resolution: {integrity: sha512-FWnOm2MORX/nt8psnEtID3Vnt8Blby1NkzjU3KjXBPF9kave71C3lI8KbBbCeKKyTQ/S00i2FiglKdRWQ1WNTw==}
     engines: {node: '>= 16.4.0'}
@@ -4675,6 +4682,10 @@ packages:
   electron-to-chromium@1.5.395:
     resolution: {integrity: sha512-7zt9Aw+SrmxLWLN0zhaTWZQiCdryLVrYTq5R7iZakLvi2UQPYMMsROYV/2qVCzMeCiSXHwKOU+sZ4zOVVlrtKA==}
 
+  electron-winstaller@5.4.4:
+    resolution: {integrity: sha512-j9ETcBGJaXxAY/b6UBpR7LZfjdU4BAO+yvr4ifqHEdyuc3UNCy91PDGkWKY5UQ4coHNYfnwFggrqD6QPeFGAlg==}
+    engines: {node: '>=8.0.0'}
+
   electron@43.4.1:
     resolution: {integrity: sha512-5b+EuiwkgG5iRcsEL34rimgRpkYp15SsfZOa0pC5kXs0Tb82TH4n95rpQzTZa7yRCbA7tm0WoEbuBL6NaAhAcA==}
     engines: {node: '>= 22.12.0'}
@@ -5105,6 +5116,10 @@ packages:
     resolution: {integrity: sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA==}
     engines: {node: '>=14.14'}
 
+  fs-extra@7.0.1:
+    resolution: {integrity: sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==}
+    engines: {node: '>=6 <7 || >=8'}
+
   fs-extra@8.1.0:
     resolution: {integrity: sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==}
     engines: {node: '>=6 <7 || >=8'}
@@ -6156,6 +6171,10 @@ packages:
     resolution: {integrity: sha512-KZxYo1BUkWD2TVFLr0MQoM8vUUigWD3LlD83a/75BqC+4qE0Hb1Vo5v1FgcfaNXvfXzr+5EhQ6ing/CaBijTlw==}
     engines: {node: '>= 18'}
 
+  mkdirp@0.5.6:
+    resolution: {integrity: sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==}
+    hasBin: true
+
   mkdirp@1.0.4:
     resolution: {integrity: sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==}
     engines: {node: '>=10'}
@@ -7099,6 +7118,11 @@ packages:
   rfdc@1.4.1:
     resolution: {integrity: sha512-q1b3N5QkRUWUl7iyylaaj3kOpIT0N2i9MqIEQXP73GVsN9cw3fdx8X63cEmWhJGi2PPCF23Ijp7ktmd39rawIA==}
 
+  rimraf@2.6.3:
+    resolution: {integrity: sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA==}
+    deprecated: Rimraf versions prior to v4 are no longer supported
+    hasBin: true
+
   rimraf@3.0.2:
     resolution: {integrity: sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==}
     deprecated: Rimraf versions prior to v4 are no longer supported
@@ -7512,6 +7536,10 @@ packages:
   teex@1.0.1:
     resolution: {integrity: sha512-eYE6iEI62Ni1H8oIa7KlDU6uQBtqr4Eajni3wX7rpfXD8ysFx8z0+dri+KWEPWpBsxXfxu58x/0jvTVT1ekOSg==}
 
+  temp@0.9.4:
+    resolution: {integrity: sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==}
+    engines: {node: '>=6.0.0'}
+
   terser@5.49.0:
     resolution: {integrity: sha512-SNiDnXyHSrxVcIOtVbULzcTmniUiwcV7Nwdyj1twVubeTmbjoa8p69KKDpfkdoOavuM4/GRm1+ykI8qqnavHoA==}
     engines: {node: '>=10'}
@@ -8738,6 +8766,17 @@ snapshots:
       - bluebird
       - supports-color
 
+  '@electron-forge/maker-squirrel@7.11.2':
+    dependencies:
+      '@electron-forge/maker-base': 7.11.2
+      '@electron-forge/shared-types': 7.11.2
+      fs-extra: 10.1.0
+    optionalDependencies:
+      electron-winstaller: 5.4.4
+    transitivePeerDependencies:
+      - bluebird
+      - supports-color
+
   '@electron-forge/maker-zip@7.11.2':
     dependencies:
       '@electron-forge/maker-base': 7.11.2
@@ -13258,6 +13297,20 @@ snapshots:
 
   electron-to-chromium@1.5.395: {}
 
+  electron-winstaller@5.4.4:
+    dependencies:
+      '@electron/asar': 3.4.1
+      debug: 4.4.3
+      fs-extra: 7.0.1
+      lodash: 4.18.1
+      semver: 7.8.5
+      temp: 0.9.4
+    optionalDependencies:
+      '@electron/windows-sign': 1.2.2
+    transitivePeerDependencies:
+      - supports-color
+    optional: true
+
   electron@43.4.1:
     dependencies:
       '@electron-internal/extract-zip': 1.0.4
@@ -13830,6 +13883,13 @@ snapshots:
       jsonfile: 6.2.1
       universalify: 2.0.1
 
+  fs-extra@7.0.1:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 4.0.0
+      universalify: 0.1.2
+    optional: true
+
   fs-extra@8.1.0:
     dependencies:
       graceful-fs: 4.2.11
@@ -14903,6 +14963,11 @@ snapshots:
     dependencies:
       minipass: 7.1.3
 
+  mkdirp@0.5.6:
+    dependencies:
+      minimist: 1.2.8
+    optional: true
+
   mkdirp@1.0.4: {}
 
   mlly@1.8.2:
@@ -16287,6 +16352,11 @@ snapshots:
 
   rfdc@1.4.1: {}
 
+  rimraf@2.6.3:
+    dependencies:
+      glob: 7.2.3
+    optional: true
+
   rimraf@3.0.2:
     dependencies:
       glob: 7.2.3
@@ -16824,6 +16894,12 @@ snapshots:
       - bare-abort-controller
       - react-native-b4a
 
+  temp@0.9.4:
+    dependencies:
+      mkdirp: 0.5.6
+      rimraf: 2.6.3
+    optional: true
+
   terser@5.49.0:
     dependencies:
       '@jridgewell/source-map': 0.3.11
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 9653d5b6..bc3340a7 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -37,6 +37,9 @@ packageExtensions:
       "@nuxt/kit": 4.5.1
 allowBuilds:
   electron: true
+  # Selects the package-owned 7-Zip executable for the build host; it makes no
+  # network request and writes only inside electron-winstaller's vendor tree.
+  electron-winstaller: true
   esbuild: true
   fs-xattr: true
   macos-alias: true
diff --git a/scripts/build.mjs b/scripts/build.mjs
index aa71f7de..8f3b43d1 100644
--- a/scripts/build.mjs
+++ b/scripts/build.mjs
@@ -172,6 +172,7 @@ export function nativeBuildSteps(platform, architecture) {
           "Advapi32.lib",
           "Shell32.lib",
           "Ole32.lib",
+          "Wintrust.lib",
           "build/native/node.lib",
           "/Fe:build/native/windows-host.node",
         ],
diff --git a/scripts/release-manifest.ts b/scripts/release-manifest.ts
index 3db11642..cf894e51 100644
--- a/scripts/release-manifest.ts
+++ b/scripts/release-manifest.ts
@@ -41,7 +41,7 @@ export function releaseManifest(options: {
     pub_date: publishedAt.toISOString(),
     notes: "",
   };
-  if (!parseReleaseManifest(manifest)) {
+  if (!parseReleaseManifest(manifest, "darwin-arm64")) {
     throw new Error("generated release manifest is invalid");
   }
   return `${JSON.stringify(manifest, null, 2)}\n`;
diff --git a/scripts/update-feeds.ts b/scripts/update-feeds.ts
index 0179e488..136d7d2f 100644
--- a/scripts/update-feeds.ts
+++ b/scripts/update-feeds.ts
@@ -2,7 +2,7 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import {
-  APP_UPDATE_FEED_URLS,
+  appUpdateFeedUrls,
   releaseAssetUrl,
 } from "../src/shared/project-identity.js";
 import {
@@ -132,7 +132,7 @@ async function readCandidateManifest(
   } catch {
     throw new Error(`release manifest ${candidate.tag} is not JSON`);
   }
-  const parsed = parseReleaseManifest(value);
+  const parsed = parseReleaseManifest(value, "darwin-arm64");
   if (
     !parsed
     || parsed.manifest.tag !== candidate.tag
@@ -170,8 +170,8 @@ export function assertFeedsDoNotMoveBackward(
   previous: UpdateFeeds,
 ): void {
   for (const track of UPDATE_TRACKS) {
-    const nextManifest = parseReleaseManifest(next[track]);
-    const previousManifest = parseReleaseManifest(previous[track]);
+    const nextManifest = parseReleaseManifest(next[track], "darwin-arm64");
+    const previousManifest = parseReleaseManifest(previous[track], "darwin-arm64");
     if (!nextManifest || !previousManifest) {
       throw new Error(`${track} channel comparison received an invalid manifest`);
     }
@@ -192,7 +192,7 @@ export async function readPublishedFeeds(
   options: { bootstrap: boolean; cacheBust: string },
 ): Promise<UpdateFeeds | null> {
   const responses = await Promise.all(UPDATE_TRACKS.map(async (track) => {
-    const url = new URL(APP_UPDATE_FEED_URLS[track]);
+    const url = new URL(appUpdateFeedUrls("darwin-arm64")[track]);
     url.searchParams.set("publication", options.cacheBust);
     const response = await fetchImpl(url, {
       headers: { accept: "application/json" },
@@ -203,7 +203,7 @@ export async function readPublishedFeeds(
       throw new Error(`${track} channel returned HTTP ${response.status}`);
     }
     const value: unknown = await response.json();
-    const parsed = parseReleaseManifest(value);
+    const parsed = parseReleaseManifest(value, "darwin-arm64");
     if (
       !parsed
       || !isReleaseEligibleForTrack(parsed.releaseVersion, track)
diff --git a/scripts/windows-icon.ts b/scripts/windows-icon.ts
new file mode 100644
index 00000000..648e9370
--- /dev/null
+++ b/scripts/windows-icon.ts
@@ -0,0 +1,74 @@
+/** Build the tracked multi-size Windows icon from the canonical application PNG. */
+import { readFile, writeFile } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+import { PNG } from "pngjs";
+
+export const WINDOWS_ICON_SIZES = [16, 24, 32, 48, 64, 128, 256] as const;
+
+function resizedPng(source: PNG, size: number): Buffer {
+  const result = new PNG({ width: size, height: size });
+  const scaleX = source.width / size;
+  const scaleY = source.height / size;
+  for (let y = 0; y < size; y += 1) {
+    const sourceY = Math.max(0, Math.min(source.height - 1, (y + 0.5) * scaleY - 0.5));
+    const y0 = Math.floor(sourceY);
+    const y1 = Math.min(source.height - 1, y0 + 1);
+    const fy = sourceY - y0;
+    for (let x = 0; x < size; x += 1) {
+      const sourceX = Math.max(0, Math.min(source.width - 1, (x + 0.5) * scaleX - 0.5));
+      const x0 = Math.floor(sourceX);
+      const x1 = Math.min(source.width - 1, x0 + 1);
+      const fx = sourceX - x0;
+      const target = (y * size + x) * 4;
+      for (let channel = 0; channel < 4; channel += 1) {
+        const top = source.data[(y0 * source.width + x0) * 4 + channel]! * (1 - fx)
+          + source.data[(y0 * source.width + x1) * 4 + channel]! * fx;
+        const bottom = source.data[(y1 * source.width + x0) * 4 + channel]! * (1 - fx)
+          + source.data[(y1 * source.width + x1) * 4 + channel]! * fx;
+        result.data[target + channel] = Math.round(top * (1 - fy) + bottom * fy);
+      }
+    }
+  }
+  return PNG.sync.write(result, { colorType: 6, inputColorType: 6 });
+}
+
+export function windowsIcon(sourceBytes: Buffer): Buffer {
+  const source = PNG.sync.read(sourceBytes);
+  if (source.width !== source.height || source.width < 256) {
+    throw new Error("Windows icon source must be a square PNG at least 256 pixels wide");
+  }
+  const images = WINDOWS_ICON_SIZES.map((size) => resizedPng(source, size));
+  const directorySize = 6 + images.length * 16;
+  const output = Buffer.alloc(directorySize + images.reduce((sum, image) => sum + image.length, 0));
+  output.writeUInt16LE(0, 0);
+  output.writeUInt16LE(1, 2);
+  output.writeUInt16LE(images.length, 4);
+  let imageOffset = directorySize;
+  images.forEach((image, index) => {
+    const size = WINDOWS_ICON_SIZES[index]!;
+    const entry = 6 + index * 16;
+    output.writeUInt8(size === 256 ? 0 : size, entry);
+    output.writeUInt8(size === 256 ? 0 : size, entry + 1);
+    output.writeUInt8(0, entry + 2);
+    output.writeUInt8(0, entry + 3);
+    output.writeUInt16LE(1, entry + 4);
+    output.writeUInt16LE(32, entry + 6);
+    output.writeUInt32LE(image.length, entry + 8);
+    output.writeUInt32LE(imageOffset, entry + 12);
+    image.copy(output, imageOffset);
+    imageOffset += image.length;
+  });
+  return output;
+}
+
+async function main(): Promise<void> {
+  const [source, destination, ...extra] = process.argv.slice(2);
+  if (!source || !destination || extra.length > 0) {
+    throw new Error("usage: windows-icon <source.png> <destination.ico>");
+  }
+  await writeFile(destination, windowsIcon(await readFile(source)));
+}
+
+if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  await main();
+}
diff --git a/scripts/windows-package-probe.ts b/scripts/windows-package-probe.ts
new file mode 100644
index 00000000..e4e928bc
--- /dev/null
+++ b/scripts/windows-package-probe.ts
@@ -0,0 +1,72 @@
+/** Inspect the exact unsigned Squirrel.Windows package produced by target CI. */
+import assert from "node:assert/strict";
+import { existsSync } from "node:fs";
+import { readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import { DISTRIBUTION_CHANNEL_CONFIG } from "../src/shared/distribution-channel.js";
+import { releaseUpdateArtifactName } from "../src/shared/project-identity.js";
+
+async function peFile(file: string): Promise<void> {
+  const bytes = await readFile(file);
+  assert.equal(bytes.subarray(0, 2).toString("ascii"), "MZ", `${file} is not a PE file`);
+}
+
+export async function probeWindowsPackage(root: string): Promise<Readonly<{
+  platform: "win32";
+  architecture: "x64";
+  setup: string;
+  package: string;
+  signed: false;
+  installedRuntime: "unproven";
+}>> {
+  const manifest = JSON.parse(await readFile(path.join(root, "package.json"), "utf8")) as {
+    version: string;
+  };
+  const product = DISTRIBUTION_CHANNEL_CONFIG.release.productName;
+  const packageRoot = path.join(root, "out", `${product}-win32-x64`);
+  const resources = path.join(packageRoot, "resources");
+  assert.equal(
+    existsSync(path.join(resources, "distribution-channel.json")),
+    false,
+    "an unsigned package must not claim distribution capabilities",
+  );
+  await peFile(path.join(packageRoot, `${product}.exe`));
+  await peFile(path.join(resources, "app.asar.unpacked", "build", "native", "windows-host.node"));
+  await peFile(path.join(resources, "app.asar.unpacked", "build", "native", "gw-dat-decode.exe"));
+
+  const makeRoot = path.join(root, "out", "make", "squirrel.windows", "x64");
+  const artifacts = (await readdir(makeRoot)).sort();
+  const setup = releaseUpdateArtifactName(manifest.version, "win32-x64");
+  assert.ok(artifacts.includes(setup), "the versioned Setup executable is missing");
+  assert.ok(artifacts.includes("RELEASES"), "the Squirrel RELEASES file is missing");
+  assert.equal(artifacts.some((file) => file.endsWith(".msi")), false);
+  assert.equal(artifacts.some((file) => file.includes("-delta.nupkg")), false);
+  const packages = artifacts.filter((file) => file.endsWith("-full.nupkg"));
+  assert.equal(packages.length, 1, "one full Squirrel package is required");
+  const releases = (await readFile(path.join(makeRoot, "RELEASES"), "utf8"))
+    .trim()
+    .split(/\r?\n/u);
+  assert.equal(releases.length, 1, "the first package cannot name previous releases");
+  assert.match(
+    releases[0]!,
+    new RegExp(`^[0-9A-Fa-f]{40} ${packages[0]!.replaceAll(".", "\\.")} [1-9][0-9]*$`, "u"),
+  );
+  await peFile(path.join(makeRoot, setup));
+  return {
+    platform: "win32",
+    architecture: "x64",
+    setup,
+    package: packages[0]!,
+    signed: false,
+    installedRuntime: "unproven",
+  };
+}
+
+if (process.argv[1] && pathToFileURL(process.argv[1]).href === import.meta.url) {
+  globalThis.console.log(JSON.stringify(
+    await probeWindowsPackage(path.resolve(import.meta.dirname, "..")),
+    null,
+    2,
+  ));
+}
diff --git a/src/main/app-updater.ts b/src/main/app-updater.ts
index 92ef03b4..49661b27 100644
--- a/src/main/app-updater.ts
+++ b/src/main/app-updater.ts
@@ -8,7 +8,9 @@
  * traffic. Release discovery reads one static channel document and never
  * spends a GitHub REST API request from the player's shared public IP.
  *
- * Only a package carrying the release marker may reach Squirrel.Mac. The
+ * Only a package carrying the release marker may reach the native Squirrel
+ * updater. Windows additionally verifies the running executable's
+ * Authenticode trust before main creates this owner. The
  * selected Stable/Beta track is read once per check. Stable admits only
  * stable releases; Beta additionally admits beta and RC releases. Alpha is
  * never eligible. Ad-hoc developer builds carry no release marker and cannot
@@ -20,7 +22,10 @@ import type {
   AppUpdateErrorCode,
   AppUpdateState,
 } from "../shared/contracts.js";
-import { APP_UPDATE_FEED_URLS } from "../shared/project-identity.js";
+import {
+  appUpdateFeedUrls,
+  type AppUpdateTarget,
+} from "../shared/project-identity.js";
 import {
   compareReleaseVersions,
   isReleaseEligibleForTrack,
@@ -41,6 +46,7 @@ interface NativeUpdater {
 export interface AppUpdaterOptions {
   currentVersion: string;
   capable: boolean;
+  target: AppUpdateTarget | null;
   nativeUpdater: NativeUpdater;
   fetch?: typeof fetch;
   now?: () => number;
@@ -165,7 +171,7 @@ export class AppUpdater {
       currentVersion: this.options.currentVersion,
       ...(previous === undefined ? {} : { lastCheckedAt: previous }),
     });
-    if (!this.options.capable) {
+    if (!this.options.capable || this.options.target === null) {
       await this.failAndRemember("updater-unavailable");
       return;
     }
@@ -180,10 +186,13 @@ export class AppUpdater {
     let response: Response;
     try {
       try {
-        response = await this.fetchImpl(APP_UPDATE_FEED_URLS[track], {
-          signal: controller.signal,
-          headers: { accept: "application/json" },
-        });
+        response = await this.fetchImpl(
+          appUpdateFeedUrls(this.options.target)[track],
+          {
+            signal: controller.signal,
+            headers: { accept: "application/json" },
+          },
+        );
       } catch (error) {
         await this.failAndRemember(
           this.noteFailure(
@@ -210,7 +219,7 @@ export class AppUpdater {
         );
         return;
       }
-      const feed = parseReleaseManifest(body);
+      const feed = parseReleaseManifest(body, this.options.target);
       if (
         !feed
         || !isReleaseEligibleForTrack(feed.releaseVersion, track)
diff --git a/src/main/main.ts b/src/main/main.ts
index 5183f1d0..5a4a8fce 100644
--- a/src/main/main.ts
+++ b/src/main/main.ts
@@ -118,6 +118,7 @@ import { installMacosCommandKeyUps } from "./macos-command-key-ups.js";
 import { recordMainInput } from './input-trace.js';
 import { cleanupLegacySecretFiles } from "./core/legacy-secret-cleanup.js";
 import {
+  DISTRIBUTION_CHANNEL_CONFIG,
   distributionCapabilities,
   isDistributionChannel,
   parseDistributionMarker,
@@ -147,6 +148,7 @@ import { LauncherOrchestrator } from "./launcher-orchestrator.js";
 import { registerLauncherIpc } from "./launcher-ipc.js";
 import { LAUNCHER_IPC } from "../shared/launcher-contracts.js";
 import type { GlobalTool, LauncherSettingsPatch, ShortcutReplacement } from "../shared/launcher-contracts.js";
+import { appUpdateTarget } from "../shared/project-identity.js";
 import {
   DEFAULT_SHORTCUTS,
   shortcutPlatform,
@@ -164,15 +166,30 @@ import { captureLauncherShortcut } from "./launcher-shortcut-capture.js";
 import {
   loadWindowsNativeHost,
   WindowsCredentialKeychain,
+  windowsExecutableTrusted,
 } from "./windows-native-host.js";
 import { windowsAppUserModelId } from "./windows-shell.js";
+import {
+  handleWindowsSquirrelStartup,
+  WINDOWS_SQUIRREL_FIRST_RUN_GRACE_MS,
+  windowsSquirrelFirstRun,
+} from "./windows-squirrel-startup.js";
 
+const windowsSquirrelStartupHandled = process.platform === "win32"
+  && handleWindowsSquirrelStartup({
+    argv: process.argv,
+    execPath: process.execPath,
+    executableName: `${app.getName()}.exe`,
+    quit: () => app.quit(),
+  });
+const windowsSquirrelFirstRunActive = process.platform === "win32"
+  && windowsSquirrelFirstRun(process.argv);
 const nativeHostLayout = {
   packaged: app.isPackaged,
   appPath: app.getAppPath(),
   resourcesPath: process.resourcesPath,
 };
-const windowsNativeHost = process.platform === "win32"
+const windowsNativeHost = process.platform === "win32" && !windowsSquirrelStartupHandled
   ? loadWindowsNativeHost(nativeHostLayout)
   : null;
 const explicitUserData = app.commandLine.hasSwitch("user-data-dir");
@@ -196,7 +213,8 @@ if (process.platform === "win32") {
   app.setAppUserModelId(windowsAppUserModelId(app.getName()));
 }
 
-const primaryInstance = app.requestSingleInstanceLock();
+const primaryInstance = !windowsSquirrelStartupHandled
+  && app.requestSingleInstanceLock();
 if (!primaryInstance) {
   app.quit();
 } else {
@@ -376,7 +394,6 @@ function packagedDistributionChannel(): DistributionChannel | null {
     const channel = process.env.GW_TEST_DISTRIBUTION_CHANNEL;
     return isDistributionChannel(channel) ? channel : null;
   }
-  if (process.platform !== "darwin") return null;
   try {
     const marker = JSON.parse(
       readFileSync(
@@ -384,7 +401,18 @@ function packagedDistributionChannel(): DistributionChannel | null {
         "utf8",
       ),
     ) as unknown;
-    return parseDistributionMarker(marker)?.channel ?? null;
+    const channel = parseDistributionMarker(marker)?.channel ?? null;
+    if (channel === null) return null;
+    if (DISTRIBUTION_CHANNEL_CONFIG[channel].productName !== app.getName()) {
+      return null;
+    }
+    if (process.platform === "darwin") return channel;
+    if (
+      process.platform === "win32"
+      && windowsNativeHost !== null
+      && windowsExecutableTrusted(windowsNativeHost)
+    ) return channel;
+    return null;
   } catch {
     return null;
   }
@@ -712,6 +740,7 @@ if (primaryInstance) void app.whenReady().then(async () => {
   appUpdaterController = new AppUpdater({
     currentVersion: HOST_VERSION,
     capable: distribution.automaticUpdates,
+    target: appUpdateTarget(process.platform, process.arch),
     nativeUpdater: {
       setFeedURL: (options) => autoUpdater.setFeedURL(options),
       checkForUpdates: () => {
@@ -925,7 +954,7 @@ if (primaryInstance) void app.whenReady().then(async () => {
       () => currentSettings ?? settings,
     ),
     replaceShortcut: async ({ tool, binding }: ShortcutReplacement) => {
-      if (shortcutReserved(binding)) throw new Error("That shortcut is reserved by macOS or the application");
+      if (shortcutReserved(binding)) throw new Error("That shortcut is reserved by the system or the application");
       const active = currentSettings ?? settings;
       let overrides = active.shortcutOverrides;
       const conflict = shortcutOwner(binding, active, tool);
@@ -1093,7 +1122,13 @@ if (primaryInstance) void app.whenReady().then(async () => {
   // The same persisted due-time governs launch and background checks. A player
   // who restarts repeatedly therefore does not spend another network request
   // until the previous settled attempt is six hours old.
-  scheduleAutomaticAppUpdateCheck();
+  const firstAutomaticUpdateTimer = windowsSquirrelFirstRunActive
+    ? setTimeout(
+        scheduleAutomaticAppUpdateCheck,
+        WINDOWS_SQUIRREL_FIRST_RUN_GRACE_MS,
+      )
+    : null;
+  if (firstAutomaticUpdateTimer === null) scheduleAutomaticAppUpdateCheck();
   // A 30-minute tick with a six-hour due-time instead of a six-hour timer:
   // a laptop waking past the boundary checks within half an hour, with no
   // resume handler and no new diagnostic event. check() already coalesces,
@@ -1108,6 +1143,9 @@ if (primaryInstance) void app.whenReady().then(async () => {
   }, PERIODIC_CHECK_TICK_MS);
   onAppQuit(() => {
     scheduleAutomaticAppUpdateCheck = null;
+    if (firstAutomaticUpdateTimer !== null) {
+      clearTimeout(firstAutomaticUpdateTimer);
+    }
     clearInterval(periodicCheckTick);
   });
   if (secondInstanceRequested) win.once("ready-to-show", revealMainWindow);
diff --git a/src/main/windows-native-host.ts b/src/main/windows-native-host.ts
index 25bca885..58e4fce5 100644
--- a/src/main/windows-native-host.ts
+++ b/src/main/windows-native-host.ts
@@ -14,6 +14,7 @@ import {
 
 interface WindowsNativeHost {
   localAppData(): string;
+  currentExecutableTrusted(): boolean;
   load(identity: string, slot: SecretSlot): Promise<Buffer | null>;
   save(identity: string, slot: SecretSlot, value: Buffer): Promise<void>;
   clear(identity: string, slot: SecretSlot): Promise<void>;
@@ -31,12 +32,17 @@ function isWindowsNativeHost(value: unknown): value is WindowsNativeHost {
   const candidate = value as Partial<Record<keyof WindowsNativeHost, unknown>>;
   return (
     typeof candidate.localAppData === "function"
+    && typeof candidate.currentExecutableTrusted === "function"
     && typeof candidate.load === "function"
     && typeof candidate.save === "function"
     && typeof candidate.clear === "function"
   );
 }
 
+export function windowsExecutableTrusted(host: WindowsNativeHost): boolean {
+  return host.currentExecutableTrusted();
+}
+
 export function loadWindowsNativeHost(layout: BundleLayout): WindowsNativeHost {
   const loaded: unknown = createRequire(import.meta.url)(
     windowsNativeHostPath(layout),
diff --git a/src/main/windows-shell.ts b/src/main/windows-shell.ts
index 09ad7009..a7eca3d8 100644
--- a/src/main/windows-shell.ts
+++ b/src/main/windows-shell.ts
@@ -12,9 +12,7 @@ import {
 export function windowsSquirrelPackageId(
   channel: DistributionChannel,
 ): string {
-  if (channel === "release") return "GuildWarsReforged";
-  if (channel === "preview") return "GuildWarsReforgedPreview";
-  return "GuildWarsReforgedDev";
+  return DISTRIBUTION_CHANNEL_CONFIG[channel].windowsPackageId;
 }
 
 export function windowsAppUserModelId(productName: string): string {
diff --git a/src/main/windows-squirrel-startup.ts b/src/main/windows-squirrel-startup.ts
new file mode 100644
index 00000000..46ada725
--- /dev/null
+++ b/src/main/windows-squirrel-startup.ts
@@ -0,0 +1,77 @@
+/**
+ * Own Squirrel.Windows lifecycle invocations before product windows or native
+ * persistence are allowed to exist.
+ */
+import { spawn, type ChildProcess } from "node:child_process";
+import path from "node:path";
+
+export const WINDOWS_SQUIRREL_EVENTS = [
+  "--squirrel-install",
+  "--squirrel-updated",
+  "--squirrel-uninstall",
+  "--squirrel-obsolete",
+] as const;
+export type WindowsSquirrelEvent = (typeof WINDOWS_SQUIRREL_EVENTS)[number];
+export const WINDOWS_SQUIRREL_FIRST_RUN_GRACE_MS = 15_000;
+
+export function windowsSquirrelFirstRun(argv: readonly string[]): boolean {
+  return argv.includes("--squirrel-firstrun");
+}
+
+export function windowsSquirrelEvent(
+  argv: readonly string[],
+): WindowsSquirrelEvent | null {
+  const events = WINDOWS_SQUIRREL_EVENTS.filter((event) => argv.includes(event));
+  if (events.length > 1) throw new Error("conflicting Squirrel.Windows lifecycle events");
+  return events[0] ?? null;
+}
+
+export function windowsSquirrelUpdateArguments(
+  event: WindowsSquirrelEvent,
+  executableName: string,
+): readonly string[] | null {
+  if (event === "--squirrel-obsolete") return null;
+  return [
+    event === "--squirrel-uninstall" ? "--removeShortcut" : "--createShortcut",
+    executableName,
+  ];
+}
+
+interface StartupDependencies {
+  readonly argv: readonly string[];
+  readonly execPath: string;
+  readonly executableName: string;
+  readonly quit: () => void;
+  readonly spawnUpdate?: (
+    executable: string,
+    args: readonly string[],
+  ) => Pick<ChildProcess, "unref">;
+}
+
+export function handleWindowsSquirrelStartup(
+  dependencies: StartupDependencies,
+): boolean {
+  const event = windowsSquirrelEvent(dependencies.argv);
+  if (event === null) return false;
+  const args = windowsSquirrelUpdateArguments(event, dependencies.executableName);
+  if (args !== null) {
+    const update = path.win32.resolve(
+      path.win32.dirname(dependencies.execPath),
+      "..",
+      "Update.exe",
+    );
+    const spawnUpdate = dependencies.spawnUpdate ?? ((executable, commandArgs) =>
+      spawn(executable, commandArgs, {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+      }));
+    try {
+      spawnUpdate(update, args).unref();
+    } catch {
+      // The installer owns recovery. Product startup must still remain closed.
+    }
+  }
+  dependencies.quit();
+  return true;
+}
diff --git a/src/native/windows-host/host.cpp b/src/native/windows-host/host.cpp
index 4bab5605..24abc1b6 100644
--- a/src/native/windows-host/host.cpp
+++ b/src/native/windows-host/host.cpp
@@ -8,7 +8,9 @@
 #include <node_api.h>
 #include <windows.h>
 #include <wincred.h>
+#include <wintrust.h>
 #include <shlobj.h>
+#include <softpub.h>
 
 #include <cstdint>
 #include <exception>
@@ -295,6 +297,44 @@ napi_value LocalAppDataCallback(napi_env env, napi_callback_info info) {
   return value;
 }
 
+napi_value CurrentExecutableTrustedCallback(napi_env env,
+                                            napi_callback_info info) {
+  std::size_t argc = 0;
+  if (napi_get_cb_info(env, info, &argc, nullptr, nullptr, nullptr) != napi_ok ||
+      argc != 0) {
+    napi_throw_type_error(env, nullptr,
+                          "currentExecutableTrusted takes no arguments");
+    return nullptr;
+  }
+  std::vector<wchar_t> executable(32768, L'\0');
+  const DWORD length = GetModuleFileNameW(
+      nullptr, executable.data(), static_cast<DWORD>(executable.size()));
+  bool trusted = false;
+  if (length > 0 && length < executable.size()) {
+    WINTRUST_FILE_INFO file{};
+    file.cbStruct = sizeof(file);
+    file.pcwszFilePath = executable.data();
+    GUID policy = WINTRUST_ACTION_GENERIC_VERIFY_V2;
+    WINTRUST_DATA trust{};
+    trust.cbStruct = sizeof(trust);
+    trust.dwUIChoice = WTD_UI_NONE;
+    trust.fdwRevocationChecks = WTD_REVOKE_NONE;
+    trust.dwUnionChoice = WTD_CHOICE_FILE;
+    trust.pFile = &file;
+    trust.dwStateAction = WTD_STATEACTION_VERIFY;
+    trust.dwProvFlags = WTD_CACHE_ONLY_URL_RETRIEVAL;
+    trusted = WinVerifyTrust(nullptr, &policy, &trust) == ERROR_SUCCESS;
+    trust.dwStateAction = WTD_STATEACTION_CLOSE;
+    WinVerifyTrust(nullptr, &policy, &trust);
+  }
+  napi_value result;
+  if (napi_get_boolean(env, trusted, &result) != napi_ok) {
+    napi_throw_error(env, nullptr, "Authenticode verification unavailable");
+    return nullptr;
+  }
+  return result;
+}
+
 napi_value Init(napi_env env, napi_value exports) {
   napi_property_descriptor properties[] = {
       {"load", nullptr, LoadCallback, nullptr, nullptr, nullptr, napi_default,
@@ -305,6 +345,8 @@ napi_value Init(napi_env env, napi_value exports) {
        nullptr},
       {"localAppData", nullptr, LocalAppDataCallback, nullptr, nullptr, nullptr,
        napi_default, nullptr},
+      {"currentExecutableTrusted", nullptr, CurrentExecutableTrustedCallback,
+       nullptr, nullptr, nullptr, napi_default, nullptr},
   };
   if (napi_define_properties(env, exports,
                              sizeof(properties) / sizeof(properties[0]),
diff --git a/src/shared/distribution-channel.ts b/src/shared/distribution-channel.ts
index 6d41afa1..3215ce3d 100644
--- a/src/shared/distribution-channel.ts
+++ b/src/shared/distribution-channel.ts
@@ -29,6 +29,7 @@ export type DistributionChannel = (typeof DISTRIBUTION_CHANNELS)[number];
 export interface DistributionChannelConfig {
   readonly productName: string;
   readonly bundleId: string;
+  readonly windowsPackageId: string;
   readonly signingKind: "developer-id" | "development";
 }
 
@@ -38,16 +39,19 @@ export const DISTRIBUTION_CHANNEL_CONFIG: Readonly<
   release: {
     productName: "Guild Wars Reforged",
     bundleId: "io.github.mat4m0.gwonmac",
+    windowsPackageId: "GuildWarsReforged",
     signingKind: "developer-id",
   },
   preview: {
     productName: "Guild Wars Reforged Preview",
     bundleId: "io.github.mat4m0.gwonmac.preview",
+    windowsPackageId: "GuildWarsReforgedPreview",
     signingKind: "developer-id",
   },
   development: {
     productName: "Guild Wars Reforged Dev",
     bundleId: "io.github.mat4m0.gwonmac.dev",
+    windowsPackageId: "GuildWarsReforgedDev",
     signingKind: "development",
   },
 };
diff --git a/src/shared/project-identity.ts b/src/shared/project-identity.ts
index 33c3599c..7ee1431e 100644
--- a/src/shared/project-identity.ts
+++ b/src/shared/project-identity.ts
@@ -19,13 +19,49 @@ export const RELEASE_REPO = `${GITHUB_OWNER}/${GITHUB_REPOSITORY}`;
 export const APPLE_TEAM_ID = "9NN976MFZ4";
 const UPDATE_FEED_ROOT =
   `https://${GITHUB_OWNER.toLowerCase()}.github.io/${GITHUB_REPOSITORY}/updates`;
-export const APP_UPDATE_FEED_URLS = {
-  stable: `${UPDATE_FEED_ROOT}/stable/darwin/arm64/RELEASES.json`,
-  beta: `${UPDATE_FEED_ROOT}/beta/darwin/arm64/RELEASES.json`,
-} as const;
+
+export const APP_UPDATE_TARGETS = ["darwin-arm64", "win32-x64"] as const;
+export type AppUpdateTarget = (typeof APP_UPDATE_TARGETS)[number];
+
+export function appUpdateTarget(
+  platform: string,
+  architecture: string,
+): AppUpdateTarget | null {
+  if (platform === "darwin" && architecture === "arm64") return "darwin-arm64";
+  if (platform === "win32" && architecture === "x64") return "win32-x64";
+  return null;
+}
+
+export function appUpdateFeedUrls(target: AppUpdateTarget): Readonly<{
+  stable: string;
+  beta: string;
+}> {
+  if (target === "darwin-arm64") {
+    return Object.freeze({
+      stable: `${UPDATE_FEED_ROOT}/stable/darwin/arm64/RELEASES.json`,
+      beta: `${UPDATE_FEED_ROOT}/beta/darwin/arm64/RELEASES.json`,
+    });
+  }
+  return Object.freeze({
+    stable: `${UPDATE_FEED_ROOT}/stable/win32/x64/RELEASES.json`,
+    beta: `${UPDATE_FEED_ROOT}/beta/win32/x64/RELEASES.json`,
+  });
+}
+
+export function releaseUpdateArtifactName(
+  version: string,
+  target: AppUpdateTarget,
+): string {
+  return target === "darwin-arm64"
+    ? `Guild-Wars-Reforged-${version}-macOS-arm64.zip`
+    : `Guild-Wars-Reforged-${version}-Windows-x64-Setup.exe`;
+}
 
 /** One published release's asset, addressed by the tag it was published under. */
 export function releaseAssetUrl(tag: string, name: string): string {
-  return `https://github.com/${RELEASE_REPO}/releases/download/`
-    + `${encodeURIComponent(tag)}/${encodeURIComponent(name)}`;
+  return `${releaseDownloadRoot(tag)}/${encodeURIComponent(name)}`;
+}
+
+export function releaseDownloadRoot(tag: string): string {
+  return `https://github.com/${RELEASE_REPO}/releases/download/${encodeURIComponent(tag)}`;
 }
diff --git a/src/shared/release-manifest.ts b/src/shared/release-manifest.ts
index e2289e5f..bfc8cc21 100644
--- a/src/shared/release-manifest.ts
+++ b/src/shared/release-manifest.ts
@@ -1,9 +1,14 @@
 /**
- * The one closed contract for a published Squirrel.Mac release manifest.
+ * The one closed contract for a published native-updater release manifest.
  * Release construction, static-channel publication, and application discovery
  * all use this reader so none can accept a different tag, asset, or host.
  */
-import { releaseAssetUrl } from "./project-identity.js";
+import {
+  releaseAssetUrl,
+  releaseDownloadRoot,
+  releaseUpdateArtifactName,
+  type AppUpdateTarget,
+} from "./project-identity.js";
 import {
   formatReleaseVersion,
   parseReleaseVersion,
@@ -36,6 +41,7 @@ function isRecord(value: unknown): value is Record<string, unknown> {
  */
 export function parseReleaseManifest(
   value: unknown,
+  target: AppUpdateTarget,
 ): ParsedReleaseManifest | null {
   if (!isRecord(value)) return null;
   const keys = Object.keys(value).sort();
@@ -60,9 +66,8 @@ export function parseReleaseManifest(
     Number.isNaN(publishedAt.valueOf())
     || publishedAt.toISOString() !== value.pub_date
   ) return null;
-  const zipName =
-    `Guild-Wars-Reforged-${value.version}-macOS-arm64.zip`;
-  if (value.url !== releaseAssetUrl(value.tag, zipName)) return null;
+  const artifactName = releaseUpdateArtifactName(value.version, target);
+  if (value.url !== releaseAssetUrl(value.tag, artifactName)) return null;
   return {
     manifest: {
       url: value.url,
@@ -73,6 +78,8 @@ export function parseReleaseManifest(
       notes: "",
     },
     releaseVersion,
-    immutableFeedUrl: releaseAssetUrl(value.tag, "RELEASES.json"),
+    immutableFeedUrl: target === "darwin-arm64"
+      ? releaseAssetUrl(value.tag, "RELEASES.json")
+      : releaseDownloadRoot(value.tag),
   };
 }
diff --git a/tests/policy/source-release-pipeline.test.ts b/tests/policy/source-release-pipeline.test.ts
index 1acd14ff..16e85459 100644
--- a/tests/policy/source-release-pipeline.test.ts
+++ b/tests/policy/source-release-pipeline.test.ts
@@ -180,7 +180,7 @@ test("distribution channels use preflighted signing and a scoped marker", () =>
   assert.match(forge, /distribution-channel\.json/);
   assert.match(
     forge,
-    /if \(platform === "darwin" && packageMode\.kind === "signed"\)/,
+    /\(platform === "darwin" \|\| platform === "win32"\)[\s\S]*packageMode\.kind === "signed"/,
   );
   assert.doesNotMatch(forge, /official-update\.json|GW_OFFICIAL_RELEASE/);
   assert.match(forge, /appBundleId: channelConfig\.bundleId/);
diff --git a/tests/policy/source-windows-credentials.test.ts b/tests/policy/source-windows-credentials.test.ts
index 5747cca0..f4cf431d 100644
--- a/tests/policy/source-windows-credentials.test.ts
+++ b/tests/policy/source-windows-credentials.test.ts
@@ -45,3 +45,15 @@ test("Credential Manager owns only closed application and profile slots", () =>
   assert.doesNotMatch(native, /system\s*\(|popen\s*\(|CreateProcess/u);
   assert.doesNotMatch(main, /safeStorage|encryptString|decryptString/u);
 });
+
+test("only an Authenticode-verified package marker enables Windows persistence", () => {
+  assert.match(native, /WINTRUST_ACTION_GENERIC_VERIFY_V2/u);
+  assert.match(native, /WinVerifyTrust/u);
+  assert.match(native, /WTD_UI_NONE/u);
+  assert.match(native, /WTD_CACHE_ONLY_URL_RETRIEVAL/u);
+  assert.match(main, /windowsExecutableTrusted\(windowsNativeHost\)/u);
+  assert.match(
+    main,
+    /DISTRIBUTION_CHANNEL_CONFIG\[channel\]\.productName !== app\.getName\(\)/u,
+  );
+});
diff --git a/tests/policy/source-windows-distribution.test.ts b/tests/policy/source-windows-distribution.test.ts
new file mode 100644
index 00000000..9a3eb8d3
--- /dev/null
+++ b/tests/policy/source-windows-distribution.test.ts
@@ -0,0 +1,28 @@
+/** Static release boundaries for the first Windows x64 Squirrel package. */
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { test } from "node:test";
+
+const root = process.cwd();
+const forge = readFileSync(path.join(root, "forge.config.ts"), "utf8");
+const main = readFileSync(path.join(root, "src/main/main.ts"), "utf8");
+
+test("Windows uses one per-user Squirrel package with explicit signed inputs", () => {
+  assert.match(forge, /new MakerSquirrel\(/u);
+  assert.match(forge, /name: channelConfig\.windowsPackageId/u);
+  assert.match(forge, /exe: `\$\{channelConfig\.productName\}\.exe`/u);
+  assert.match(forge, /noMsi: true/u);
+  assert.match(forge, /noDelta: true/u);
+  assert.match(forge, /WINDOWS_CERTIFICATE_FILE/u);
+  assert.match(forge, /WINDOWS_CERTIFICATE_PASSWORD/u);
+  assert.match(forge, /https:\/\/timestamp\.digicert\.com/u);
+  assert.match(forge, /setupIcon: path\.resolve\("assets\/AppIcon\.ico"\)/u);
+});
+
+test("Squirrel lifecycle handling precedes the single-instance product path", () => {
+  const lifecycle = main.indexOf("handleWindowsSquirrelStartup");
+  const lock = main.indexOf("requestSingleInstanceLock");
+  assert.ok(lifecycle >= 0 && lock > lifecycle);
+  assert.match(main, /!windowsSquirrelStartupHandled\s*&& app\.requestSingleInstanceLock/u);
+});
diff --git a/tests/unit/app-updater.test.ts b/tests/unit/app-updater.test.ts
index 97d9b396..1bb0e4d0 100644
--- a/tests/unit/app-updater.test.ts
+++ b/tests/unit/app-updater.test.ts
@@ -11,15 +11,20 @@ import type {
   AppUpdateState,
 } from "../../src/shared/contracts.ts";
 import {
-  APP_UPDATE_FEED_URLS,
+  appUpdateFeedUrls,
   releaseAssetUrl,
+  releaseDownloadRoot,
+  releaseUpdateArtifactName,
+  type AppUpdateTarget,
 } from "../../src/shared/project-identity.ts";
 
-function manifest(version: string) {
+function manifest(
+  version: string,
+  target: AppUpdateTarget = "darwin-arm64",
+) {
   const tag = `v${version}`;
-  const zipName = `Guild-Wars-Reforged-${version}-macOS-arm64.zip`;
   return {
-    url: releaseAssetUrl(tag, zipName),
+    url: releaseAssetUrl(tag, releaseUpdateArtifactName(version, target)),
     name: `Guild Wars Reforged v${version}`,
     version,
     tag,
@@ -38,6 +43,7 @@ function response(body: unknown, status = 200, headers?: HeadersInit): Response
 function fixture(options: {
   capable?: boolean;
   currentVersion?: string;
+  target?: AppUpdateTarget | null;
   fetch?: typeof fetch;
   timeoutMs?: number;
   native?: {
@@ -55,6 +61,7 @@ function fixture(options: {
   const updater = new AppUpdater({
     currentVersion: options.currentVersion ?? "2026.7.0-beta.1",
     capable: options.capable ?? true,
+    target: options.target === undefined ? "darwin-arm64" : options.target,
     fetch: options.fetch ?? (async () => response(manifest("2026.7.0-beta.2"))),
     now: () => 1234,
     ...(options.timeoutMs === undefined
@@ -104,12 +111,45 @@ describe("application updater", () => {
         },
       });
       await f.updater.check(track);
-      assert.deepEqual(requests, [APP_UPDATE_FEED_URLS[track]]);
+      assert.deepEqual(requests, [appUpdateFeedUrls("darwin-arm64")[track]]);
       assert.deepEqual(f.feeds, [releaseAssetUrl(`v${version}`, "RELEASES.json")]);
       assert.equal(f.nativeChecks(), 1);
     }
   });
 
+  it("uses the Windows channel and immutable Squirrel release directory", async () => {
+    const requests: string[] = [];
+    const feeds: string[] = [];
+    const version = "2026.8.0";
+    const f = fixture({
+      currentVersion: "2026.7.0",
+      target: "win32-x64",
+      fetch: async (input) => {
+        requests.push(String(input));
+        return response(manifest(version, "win32-x64"));
+      },
+      native: { setFeedURL: (url) => feeds.push(url) },
+    });
+    await f.updater.check("stable");
+    assert.deepEqual(requests, [appUpdateFeedUrls("win32-x64").stable]);
+    assert.deepEqual(feeds, [releaseDownloadRoot(`v${version}`)]);
+    assert.equal(f.nativeChecks(), 1);
+  });
+
+  it("fails closed when no updater target exists", async () => {
+    let requests = 0;
+    const f = fixture({
+      target: null,
+      fetch: async () => {
+        requests += 1;
+        return response(manifest("2026.8.0"));
+      },
+    });
+    await f.updater.check("stable");
+    assert.equal(requests, 0);
+    assert.equal(f.updater.getState().phase, "failed");
+  });
+
   it("makes no request and reports unavailable without the signed marker", async () => {
     let requests = 0;
     const f = fixture({
diff --git a/tests/unit/release-manifest.test.ts b/tests/unit/release-manifest.test.ts
index 25447d0a..53d0b53d 100644
--- a/tests/unit/release-manifest.test.ts
+++ b/tests/unit/release-manifest.test.ts
@@ -2,8 +2,13 @@ import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import { releaseManifest } from "../../scripts/release-manifest.ts";
 import { parseReleaseManifest } from "../../src/shared/release-manifest.ts";
+import {
+  releaseAssetUrl,
+  releaseDownloadRoot,
+  releaseUpdateArtifactName,
+} from "../../src/shared/project-identity.ts";
 
-describe("Squirrel.Mac release manifest", () => {
+describe("native update release manifest", () => {
   it("contains exactly one immutable release asset", () => {
     const manifest = JSON.parse(releaseManifest({
       version: "2026.7.0-beta.2",
@@ -37,20 +42,44 @@ describe("Squirrel.Mac release manifest", () => {
       zipName: "Guild-Wars-Reforged-2026.7.0-macOS-arm64.zip",
       publishedAt: "2026-07-30T12:00:00Z",
     }));
-    assert.equal(parseReleaseManifest(generated)?.manifest.version, "2026.7.0");
+    assert.equal(
+      parseReleaseManifest(generated, "darwin-arm64")?.manifest.version,
+      "2026.7.0",
+    );
     assert.equal(
       parseReleaseManifest({
         ...(generated as Record<string, unknown>),
         url: "https://attacker.invalid/app.zip",
-      }),
+      }, "darwin-arm64"),
       null,
     );
     assert.equal(
       parseReleaseManifest({
         ...(generated as Record<string, unknown>),
         extra: true,
-      }),
+      }, "darwin-arm64"),
       null,
     );
   });
+
+  it("binds Windows discovery to its Setup asset and Squirrel directory", () => {
+    const version = "2026.8.0";
+    const tag = `v${version}`;
+    const manifest = {
+      url: releaseAssetUrl(
+        tag,
+        releaseUpdateArtifactName(version, "win32-x64"),
+      ),
+      name: `Guild Wars Reforged v${version}`,
+      version,
+      tag,
+      pub_date: "2026-08-30T12:00:00.000Z",
+      notes: "",
+    };
+    assert.equal(
+      parseReleaseManifest(manifest, "win32-x64")?.immutableFeedUrl,
+      releaseDownloadRoot(tag),
+    );
+    assert.equal(parseReleaseManifest(manifest, "darwin-arm64"), null);
+  });
 });
diff --git a/tests/unit/windows-icon.test.ts b/tests/unit/windows-icon.test.ts
new file mode 100644
index 00000000..23895566
--- /dev/null
+++ b/tests/unit/windows-icon.test.ts
@@ -0,0 +1,29 @@
+/** The Windows icon stays a deterministic derivative of the canonical artwork. */
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import { describe, it } from "node:test";
+import { PNG } from "pngjs";
+import {
+  WINDOWS_ICON_SIZES,
+  windowsIcon,
+} from "../../scripts/windows-icon.ts";
+
+describe("Windows application icon", () => {
+  it("contains every reviewed size and matches the tracked derivative", async () => {
+    const generated = windowsIcon(await readFile("assets/AppIcon.png"));
+    assert.deepEqual(generated, await readFile("assets/AppIcon.ico"));
+    assert.equal(generated.readUInt16LE(0), 0);
+    assert.equal(generated.readUInt16LE(2), 1);
+    assert.equal(generated.readUInt16LE(4), WINDOWS_ICON_SIZES.length);
+    WINDOWS_ICON_SIZES.forEach((size, index) => {
+      const entry = 6 + index * 16;
+      assert.equal(generated.readUInt8(entry), size === 256 ? 0 : size);
+      assert.equal(generated.readUInt8(entry + 1), size === 256 ? 0 : size);
+      const length = generated.readUInt32LE(entry + 8);
+      const offset = generated.readUInt32LE(entry + 12);
+      const png = PNG.sync.read(generated.subarray(offset, offset + length));
+      assert.equal(png.width, size);
+      assert.equal(png.height, size);
+    });
+  });
+});
diff --git a/tests/unit/windows-native-host.test.ts b/tests/unit/windows-native-host.test.ts
index 83e592c2..42809629 100644
--- a/tests/unit/windows-native-host.test.ts
+++ b/tests/unit/windows-native-host.test.ts
@@ -6,6 +6,7 @@ import { parseProfileId } from "../../src/shared/multiple-accounts.js";
 import { multiSecretSlot } from "../../src/main/core/native-keychain.js";
 import {
   WindowsCredentialKeychain,
+  windowsExecutableTrusted,
   windowsNativeHostPath,
 } from "../../src/main/windows-native-host.js";
 
@@ -36,6 +37,7 @@ describe("Windows native host boundary", () => {
     const calls: unknown[][] = [];
     const host = {
       localAppData: () => "unused",
+      currentExecutableTrusted: () => true,
       load: async (...args: unknown[]) => {
         calls.push(["load", ...args]);
         return Buffer.from("saved");
@@ -60,5 +62,6 @@ describe("Windows native host boundary", () => {
       ["save", "io.github.mat4m0.gwonmac.preview", slot, Buffer.from("replacement")],
       ["clear", "io.github.mat4m0.gwonmac.preview", slot],
     ]);
+    assert.equal(windowsExecutableTrusted(host), true);
   });
 });
diff --git a/tests/unit/windows-package-probe.test.ts b/tests/unit/windows-package-probe.test.ts
new file mode 100644
index 00000000..6dd0fd5b
--- /dev/null
+++ b/tests/unit/windows-package-probe.test.ts
@@ -0,0 +1,37 @@
+/** The Windows package probe refuses marker, artifact, and feed drift. */
+import assert from "node:assert/strict";
+import { mkdtemp, mkdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { describe, it } from "node:test";
+import { probeWindowsPackage } from "../../scripts/windows-package-probe.ts";
+
+describe("Windows package probe", () => {
+  it("accepts one unsigned full package and refuses a capability marker", async () => {
+    const root = await mkdtemp(path.join(tmpdir(), "gwonmac-windows-package-"));
+    const product = "Guild Wars Reforged";
+    const resources = path.join(root, "out", `${product}-win32-x64`, "resources");
+    const native = path.join(resources, "app.asar.unpacked", "build", "native");
+    const make = path.join(root, "out", "make", "squirrel.windows", "x64");
+    const setup = "Guild-Wars-Reforged-2026.8.10-Windows-x64-Setup.exe";
+    const packageName = "GuildWarsReforged-2026.8.10-full.nupkg";
+    try {
+      await mkdir(native, { recursive: true });
+      await mkdir(make, { recursive: true });
+      await writeFile(path.join(root, "package.json"), JSON.stringify({ version: "2026.8.10" }));
+      for (const file of [
+        path.join(root, "out", `${product}-win32-x64`, `${product}.exe`),
+        path.join(native, "windows-host.node"),
+        path.join(native, "gw-dat-decode.exe"),
+        path.join(make, setup),
+      ]) await writeFile(file, "MZfixture");
+      await writeFile(path.join(make, packageName), "package");
+      await writeFile(path.join(make, "RELEASES"), `${"a".repeat(40)} ${packageName} 7\n`);
+      assert.equal((await probeWindowsPackage(root)).setup, setup);
+      await writeFile(path.join(resources, "distribution-channel.json"), "{}");
+      await assert.rejects(() => probeWindowsPackage(root));
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/tests/unit/windows-squirrel-startup.test.ts b/tests/unit/windows-squirrel-startup.test.ts
new file mode 100644
index 00000000..1a4324ea
--- /dev/null
+++ b/tests/unit/windows-squirrel-startup.test.ts
@@ -0,0 +1,66 @@
+/** Squirrel lifecycle switches never enter the product startup path. */
+import assert from "node:assert/strict";
+import path from "node:path";
+import { describe, it } from "node:test";
+import {
+  handleWindowsSquirrelStartup,
+  windowsSquirrelEvent,
+  windowsSquirrelFirstRun,
+  windowsSquirrelUpdateArguments,
+} from "../../src/main/windows-squirrel-startup.ts";
+
+describe("Squirrel.Windows startup", () => {
+  it("recognizes one exact lifecycle switch and refuses conflicts", () => {
+    assert.equal(windowsSquirrelEvent(["app.exe", "--squirrel-install"]), "--squirrel-install");
+    assert.equal(windowsSquirrelEvent(["app.exe", "--squirrel-firstrun"]), null);
+    assert.equal(windowsSquirrelFirstRun(["app.exe", "--squirrel-firstrun"]), true);
+    assert.equal(windowsSquirrelFirstRun(["app.exe"]), false);
+    assert.throws(() => windowsSquirrelEvent([
+      "--squirrel-install",
+      "--squirrel-uninstall",
+    ]));
+  });
+
+  it("creates or removes only the installed executable shortcut", () => {
+    assert.deepEqual(
+      windowsSquirrelUpdateArguments("--squirrel-updated", "Guild Wars Reforged.exe"),
+      ["--createShortcut", "Guild Wars Reforged.exe"],
+    );
+    assert.deepEqual(
+      windowsSquirrelUpdateArguments("--squirrel-uninstall", "Guild Wars Reforged.exe"),
+      ["--removeShortcut", "Guild Wars Reforged.exe"],
+    );
+    assert.equal(
+      windowsSquirrelUpdateArguments("--squirrel-obsolete", "Guild Wars Reforged.exe"),
+      null,
+    );
+  });
+
+  it("runs Update.exe detached and quits before normal startup", () => {
+    const calls: unknown[][] = [];
+    const handled = handleWindowsSquirrelStartup({
+      argv: ["app.exe", "--squirrel-install"],
+      execPath: "C:\\Users\\Player\\AppData\\Local\\GuildWarsReforged\\app-1.0.0\\Guild Wars Reforged.exe",
+      executableName: "Guild Wars Reforged.exe",
+      quit: () => calls.push(["quit"]),
+      spawnUpdate: (executable, args) => {
+        calls.push(["spawn", executable, args]);
+        return { unref: () => calls.push(["unref"]) };
+      },
+    });
+    assert.equal(handled, true);
+    assert.deepEqual(calls, [
+      [
+        "spawn",
+        path.win32.resolve(
+          "C:\\Users\\Player\\AppData\\Local\\GuildWarsReforged\\app-1.0.0",
+          "..",
+          "Update.exe",
+        ),
+        ["--createShortcut", "Guild Wars Reforged.exe"],
+      ],
+      ["unref"],
+      ["quit"],
+    ]);
+  });
+});