diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a8cbebf..6e7bd33 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -132,6 +132,25 @@ jobs:
           -p:PublishSingleFile=true
           -p:PublishTrimmed=false
 
+      # The installer script is only otherwise compiled when a tag is pushed, which is the
+      # worst place to discover it does not compile. This runs against the publish output
+      # that already exists a few steps up, with a stand-in for the 146 MB ffmpeg download
+      # the real pipeline fetches - what is being checked is that offstream.iss is valid and
+      # packages the layout it is given, not that ffmpeg is in it.
+      - name: The installer still compiles
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $staging = 'artifacts/installer-check'
+          $publish = "src/Offstream.App/bin/Release/$((Select-Xml -Path Directory.Build.props -XPath '//TargetFramework').Node.InnerText)/win-x64/publish"
+
+          New-Item -ItemType Directory -Path "$staging/ffmpeg" -Force | Out-Null
+          Copy-Item "$publish/*" $staging -Recurse -Force
+          Copy-Item LICENSE, NOTICE $staging
+          'not ffmpeg' | Out-File "$staging/ffmpeg/ffmpeg.exe"
+
+          ./build/windows/build-installer.ps1 -Version 0.0.0 -SourceDir $staging | Out-Null
+
       - name: Assert trimming and AOT stayed off
         shell: pwsh
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..6741d7f
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,329 @@
+name: Release
+
+# A `v*` tag is the trigger and the source of the version number. Nothing in the repo
+# records the released version, so the tag and the build can never disagree about what
+# shipped - see the note above VersionPrefix in Directory.Build.props.
+#
+# workflow_dispatch builds the same artefacts and publishes nothing, which is how to find
+# out whether the pipeline works without spending a version number to do it.
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to build (no leading v). Produces artefacts only, no release.'
+        required: true
+        default: '0.1.0-dev'
+
+permissions:
+  contents: read
+
+env:
+  DOTNET_NOLOGO: true
+  DOTNET_CLI_TELEMETRY_OPTOUT: true
+  DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
+
+jobs:
+  release:
+    # Windows for the same reason CI is: net10.0-windows, WPF, WASAPI and the routing COM
+    # interop build nowhere else. signtool is Windows-only too.
+    runs-on: windows-latest
+
+    permissions:
+      # Only this job creates the release, so the workflow-level read stays read.
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up .NET 10
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '10.0.x'
+
+      - name: Cache NuGet packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.nuget/packages
+          key: nuget-${{ runner.os }}-${{ hashFiles('**/Directory.Packages.props') }}
+          restore-keys: nuget-${{ runner.os }}-
+
+      # Rejecting a malformed tag here rather than shipping whatever it happened to say.
+      # A tag is not editable in any useful sense once people have fetched it, so the
+      # cheap moment to be strict about its shape is before anything is built from it.
+      - name: Work out the version
+        id: version
+        shell: pwsh
+        env:
+          # Through the environment, never interpolated into the script body. `inputs` is
+          # attacker-controlled in the general case, and a value substituted into the
+          # source of a shell script runs as script rather than arriving as data. The
+          # regex below is what makes every later use of this value safe to interpolate.
+          INPUT_VERSION: ${{ inputs.version }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          if ($env:GITHUB_REF_TYPE -eq 'tag') {
+            $raw = $env:GITHUB_REF_NAME
+            if ($raw -notmatch '^v(?<v>\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?)$') {
+              throw "Tag '$raw' is not a release tag. Expected vMAJOR.MINOR.PATCH, optionally with a prerelease suffix (v1.2.3, v1.2.3-rc.1)."
+            }
+            $version = $Matches.v
+            $publish = 'true'
+          }
+          else {
+            $version = $env:INPUT_VERSION
+            if ($version -notmatch '^\d+\.\d+\.\d+(?:-[0-9A-Za-z][0-9A-Za-z.-]*)?$') {
+              throw "Version '$version' is not semantic versioning. Expected MAJOR.MINOR.PATCH, optionally with a prerelease suffix."
+            }
+            $publish = 'false'
+          }
+
+          # A prerelease suffix marks the GitHub release as one, so `v1.2.3-rc.1` does not
+          # become what "latest release" resolves to for everyone.
+          $prerelease = if ($version -like '*-*') { 'true' } else { 'false' }
+
+          "version=$version"       | Out-File $env:GITHUB_OUTPUT -Append
+          "publish=$publish"       | Out-File $env:GITHUB_OUTPUT -Append
+          "prerelease=$prerelease" | Out-File $env:GITHUB_OUTPUT -Append
+
+          Write-Host "Building $version (publish: $publish, prerelease: $prerelease)"
+
+      # Before the build, not after: a tag whose release notes do not exist should fail in
+      # seconds rather than at the end of a five-minute pipeline.
+      #
+      # Cutting a release is two steps, and this is what makes the first one impossible to
+      # skip. `## [Unreleased]` is renamed to `## [1.2.3] - YYYY-MM-DD` in a pull request,
+      # *then* the tag is pushed. The alternative - having this workflow rewrite the
+      # changelog and commit it back - would need write access to repository contents from a
+      # tag build and would leave a commit no one reviewed.
+      #
+      # Falling back to `[Unreleased]` here instead would work exactly once. Every later
+      # release would republish everything above it, including entries that shipped in the
+      # previous one, and the only fix is amending a release people have already read.
+      - name: The changelog names this version
+        if: steps.version.outputs.publish == 'true'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $version = '${{ steps.version.outputs.version }}'
+          $heading = "## [$version]"
+
+          # -not (array -match ...) and not (array -notmatch ...): the second returns every
+          # line that failed to match, which is a non-empty array on any real changelog and
+          # therefore true every single time.
+          if (-not ((Get-Content CHANGELOG.md) -match "^$([regex]::Escape($heading))")) {
+            throw @"
+          CHANGELOG.md has no '$heading' section, so this release has no notes.
+
+          Cutting a release is two steps:
+            1. In a pull request, rename '## [Unreleased]' to '$heading - $(Get-Date -Format yyyy-MM-dd)'
+               and open a fresh empty '## [Unreleased]' above it.
+            2. Tag the merge commit and push the tag.
+
+          Delete the tag, do step 1, and tag again.
+          "@
+          }
+
+          Write-Host "Found $heading."
+
+      - name: Restore
+        run: dotnet restore Offstream.slnx
+
+      - name: Build
+        run: dotnet build Offstream.slnx --configuration Release --no-restore -p:Version=${{ steps.version.outputs.version }}
+
+      # A tag can be pushed at any commit, including one that never went through CI, so the
+      # suite runs again here rather than being assumed. The encode-integration tests are
+      # the exception: they shell out to a downloaded ffmpeg, they gate every pull request
+      # already, and re-downloading a 30 MB toolchain to re-prove them at tag time buys
+      # nothing this step does not.
+      - name: Test
+        run: >
+          dotnet test Offstream.slnx
+          --configuration Release
+          --no-build
+          --filter "Category!=Ffmpeg"
+          -p:Version=${{ steps.version.outputs.version }}
+
+      # Self-contained, untrimmed, non-AOT. These three are correctness constraints, not
+      # size preferences - the routing COM interop does not survive AOT and WPF trims
+      # poorly (CLAUDE.md, plan §2.2).
+      - name: Publish
+        run: >
+          dotnet publish src/Offstream.App/Offstream.App.csproj
+          --configuration Release
+          --runtime win-x64
+          --self-contained true
+          -p:PublishSingleFile=true
+          -p:PublishTrimmed=false
+          -p:Version=${{ steps.version.outputs.version }}
+          --output artifacts/publish
+
+      - name: Sign
+        shell: pwsh
+        env:
+          OFFSTREAM_SIGNING_PFX_BASE64: ${{ secrets.OFFSTREAM_SIGNING_PFX_BASE64 }}
+          OFFSTREAM_SIGNING_PASSWORD: ${{ secrets.OFFSTREAM_SIGNING_PASSWORD }}
+          OFFSTREAM_SIGNING_TIMESTAMP_URL: ${{ vars.OFFSTREAM_SIGNING_TIMESTAMP_URL }}
+        run: ./build/windows/sign.ps1 -Path artifacts/publish/Offstream.exe
+
+      # Symbols travel separately. They belong to whoever is reading a crash dump, not in
+      # every user's download, and a single-file publish leaves them beside the executable
+      # where they would otherwise be swept into the zip.
+      - name: Package
+        id: package
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $version = '${{ steps.version.outputs.version }}'
+
+          # One folder at the root of the zip, not loose files. Unzipping into Downloads is
+          # what people actually do, and an archive that scatters five files through it is
+          # the kind of thing that gets an app deleted before it is ever run.
+          $name = "Offstream-$version-win-x64"
+          $staging = "artifacts/staging/$name"
+
+          New-Item -ItemType Directory -Path artifacts/symbols, $staging -Force | Out-Null
+          Move-Item artifacts/publish/*.pdb artifacts/symbols -ErrorAction SilentlyContinue
+
+          Copy-Item artifacts/publish/* $staging -Recurse
+          Copy-Item LICENSE, NOTICE, README.md, CHANGELOG.md $staging
+
+          # Into the subfolder FFmpegLocator looks in, so the shipped app finds its own copy
+          # without the user installing anything. A configured path still overrides it.
+          ./build/windows/fetch-ffmpeg.ps1 -Destination "$staging/ffmpeg"
+
+          $zip = "artifacts/$name.zip"
+          Compress-Archive -Path $staging -DestinationPath $zip
+
+          # Checksums matter more here than they would for a signed build: with no
+          # signature to check, this is the only way to tell a download apart from
+          # something that looks like one.
+          $hash = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLowerInvariant()
+          "$hash  $(Split-Path $zip -Leaf)" | Out-File "$zip.sha256" -Encoding ascii
+
+          "zip=$zip" | Out-File $env:GITHUB_OUTPUT -Append
+          "staging=$staging" | Out-File $env:GITHUB_OUTPUT -Append
+          Write-Host "$hash  $(Split-Path $zip -Leaf)"
+
+      # From the same staged folder the zip was made from, so the two downloads cannot hold
+      # different software under one version number. Inno Setup 6 is on the runner image.
+      - name: Build the installer
+        id: installer
+        shell: pwsh
+        env:
+          OFFSTREAM_SIGNING_PFX_BASE64: ${{ secrets.OFFSTREAM_SIGNING_PFX_BASE64 }}
+          OFFSTREAM_SIGNING_PASSWORD: ${{ secrets.OFFSTREAM_SIGNING_PASSWORD }}
+          OFFSTREAM_SIGNING_TIMESTAMP_URL: ${{ vars.OFFSTREAM_SIGNING_TIMESTAMP_URL }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+
+          ./build/windows/build-installer.ps1 `
+            -Version '${{ steps.version.outputs.version }}' `
+            -SourceDir '${{ steps.package.outputs.staging }}' | Out-Null
+
+          $installer = "artifacts/Offstream-${{ steps.version.outputs.version }}-setup.exe"
+          $hash = (Get-FileHash $installer -Algorithm SHA256).Hash.ToLowerInvariant()
+          "$hash  $(Split-Path $installer -Leaf)" | Out-File "$installer.sha256" -Encoding ascii
+
+          "path=$installer" | Out-File $env:GITHUB_OUTPUT -Append
+          Write-Host "$hash  $(Split-Path $installer -Leaf)"
+
+      # Distributing LGPL binaries means distributing the source they were built from.
+      # Attaching it beats a written offer: an offer has to outlive whatever was going to
+      # host it, and this one cannot, because the source is sitting next to the binary.
+      - name: Fetch ffmpeg's source
+        id: ffmpeg-source
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $manifest = Get-Content build/windows/ffmpeg.json -Raw | ConvertFrom-Json
+          $out = "artifacts/ffmpeg-$($manifest.version)-source.tar.gz"
+
+          $previous = $ProgressPreference
+          $ProgressPreference = 'SilentlyContinue'
+          try { Invoke-WebRequest -Uri $manifest.sourceUrl -OutFile $out }
+          finally { $ProgressPreference = $previous }
+
+          "path=$out" | Out-File $env:GITHUB_OUTPUT -Append
+          Write-Host "Fetched $([math]::Round((Get-Item $out).Length / 1MB, 1)) MB of ffmpeg source."
+
+      - name: Upload build artefacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: offstream-${{ steps.version.outputs.version }}-win-x64
+          path: |
+            artifacts/*.zip
+            artifacts/*setup.exe
+            artifacts/*.sha256
+
+      - name: Upload symbols
+        uses: actions/upload-artifact@v4
+        with:
+          name: offstream-${{ steps.version.outputs.version }}-symbols
+          path: artifacts/symbols
+          if-no-files-found: ignore
+
+      # Everything above runs for a manual dispatch too. Only this step is tag-only.
+      - name: Publish the GitHub release
+        if: steps.version.outputs.publish == 'true'
+        shell: pwsh
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $version = '${{ steps.version.outputs.version }}'
+          $notes = 'artifacts/notes.md'
+          $manifest = Get-Content build/windows/ffmpeg.json -Raw | ConvertFrom-Json
+
+          # The changelog is the release notes, and only this version's own section is. The
+          # step near the top of this job has already refused to get here without one.
+          $changelog = Get-Content CHANGELOG.md -Raw
+          $section = [regex]::Match(
+            $changelog,
+            "(?ms)^## \[$([regex]::Escape($version))\][^`n]*`n(?<body>.*?)(?=^## \[|\z)")
+
+          $body = $section.Groups['body'].Value.Trim()
+
+          @(
+            "**Install it** with ``Offstream-$version-setup.exe`` — a per-user install that never asks"
+            'for administrator rights — or take the zip and run it from wherever you unpack it.'
+            'Both hold the same build.'
+            ''
+            '> **This build is not code-signed.** Windows SmartScreen will warn the first time you'
+            '> run it: choose **More info** and then **Run anyway**. Verify the download against its'
+            '> SHA-256 below before you do.'
+            ''
+            '> **VB-CABLE is not included.** Offstream detects it and tells you if it is missing;'
+            '> install it yourself from <https://vb-audio.com/Cable/> if you want to record Spotify'
+            '> alone rather than everything the machine plays.'
+            ''
+            "**ffmpeg $($manifest.version) is included** ($($manifest.licence)), unmodified and run as a"
+            'separate process. Its source is attached to this release as required, and its licence'
+            'travels in the `ffmpeg` folder beside it.'
+            ''
+            '```'
+            (Get-Content "${{ steps.installer.outputs.path }}.sha256" -Raw).Trim()
+            (Get-Content "${{ steps.package.outputs.zip }}.sha256" -Raw).Trim()
+            '```'
+            ''
+            $body
+          ) | Out-File $notes -Encoding utf8
+
+          $arguments = @(
+            'release', 'create', $env:GITHUB_REF_NAME
+            '--title', "Offstream $version"
+            '--notes-file', $notes
+          )
+
+          if ('${{ steps.version.outputs.prerelease }}' -eq 'true') { $arguments += '--prerelease' }
+
+          & gh @arguments `
+            '${{ steps.installer.outputs.path }}' `
+            "${{ steps.installer.outputs.path }}.sha256" `
+            '${{ steps.package.outputs.zip }}' `
+            "${{ steps.package.outputs.zip }}.sha256" `
+            '${{ steps.ffmpeg-source.outputs.path }}'
+          if ($LASTEXITCODE -ne 0) { throw "gh release create failed (exit $LASTEXITCODE)." }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9c46afb..0146bdc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,62 @@ phase plan these entries follow.
 
 ### Added
 
+- **A release pipeline, with the git tag as the only place a version number lives.** Pushing `v1.2.3`
+  builds, tests, publishes, signs and attaches a self-contained `win-x64` zip and its SHA-256 to a
+  GitHub release; the changelog becomes the release notes. Nothing in the repository records a
+  released version, so a build cannot claim a number the tag disagrees with — a file that has to be
+  bumped in lockstep with a tag is a file that eventually is not. A malformed tag is rejected before
+  anything is built, because a tag stops being editable the moment anyone fetches it, and a
+  prerelease suffix (`v1.2.3-rc.1`) marks the GitHub release as one so it does not become what
+  "latest" resolves to. Unreleased builds call themselves `0.1.0-dev` rather than borrowing the last
+  release's number, which is what turns "which build is this?" into a question with an answer. The
+  same workflow runs from the Actions tab to exercise the pipeline without spending a version.
+  Cutting a release is two steps — close `## [Unreleased]` into `## [1.2.3]` in a pull request, then
+  tag — and a tag with no matching section fails in seconds rather than at the end of the pipeline.
+  Falling back to `[Unreleased]` would have worked exactly once, and every release after that would
+  republish the previous one's entries with no fix short of amending a release people had read.
+- **A per-user installer that never asks for administrator rights.** Offstream needs no elevation to
+  run — routing, session mute and loopback capture were all verified unelevated — so the thing that
+  installs it asks for none either. An elevation prompt is a decision the user has to make about
+  software they have not run yet. It installs into `%LOCALAPPDATA%\Programs\Offstream`, refuses
+  anything below Windows 11 with a sentence during setup rather than a crash on first run, notices a
+  running copy through the app's own single-instance mutex instead of failing halfway through
+  replacing a locked file, and is offered in English and French to match the app.
+  It is built from **the same staged folder the portable zip is made from**, so the two downloads
+  cannot hold different software under one version number, and the installer script is compiled on
+  every pull request — one that is only compiled when a tag is pushed is one that breaks when a tag
+  is pushed.
+  **Uninstalling asks about settings and logs rather than guessing.** Deleting them silently loses a
+  Last.fm API key and a Spotify sign-in; keeping them silently is wrong for someone uninstalling
+  because they are done. Recordings are never in scope: they live outside the install folder and no
+  uninstaller should reach them.
+- **ffmpeg travels with the app.** Releases carry an unmodified LGPL-3.0 build of ffmpeg in an
+  `ffmpeg` folder beside the executable, which is where the locator already looked, so a download
+  records audio without the user installing anything first. A copy on `PATH`, or one named on the
+  Settings page, still wins — bundling is a floor, not a preference. It costs about 45 MB of the
+  download, which is the price of the app working when it is opened.
+  The build is **pinned by SHA-256**, not fetched by name from a moving tag: an encoder that changes
+  between two builds of the same Offstream version turns a reproducible bug into an unreproducible
+  one, and a release asset can be replaced after the fact. A mismatch fails the release rather than
+  quietly shipping something else. The binaries are not committed — 108 MB of someone else's build
+  does not belong in a git history — so `build/windows/ffmpeg.json` records what to fetch and
+  `fetch-ffmpeg.ps1` fetches it, for the pipeline and for `build.ps1 -Publish -BundleFfmpeg` alike.
+  Only `ffmpeg.exe` ships; `ffprobe` is used by the integration tests and by nothing in the app, and
+  would have added another 108 MB.
+  **The LGPL obligation is met by attaching the source, not by offering it.** Every release carries
+  the FFmpeg source archive for the exact commit the binary was built from, because a written offer
+  has to outlive whatever was going to host it and this one does not have to. The bundle also carries
+  ffmpeg's own licence text and a `SOURCE.txt` naming that commit, and the vendor binary is never
+  re-signed or otherwise altered on its way in.
+- **Signing, wired and waiting.** `build/windows/sign.ps1` Authenticode-signs whatever it is given,
+  and when no certificate is configured it says so and exits 0 rather than failing the build.
+  Offstream has no certificate yet, so **every artefact is currently unsigned and Windows SmartScreen
+  will warn on first run** — the release notes say this outright instead of letting users find out,
+  and ship a SHA-256 as the only integrity check available in the meantime. Building the step now
+  means acquiring a certificate later is two repository secrets rather than a pipeline change, and it
+  gets reviewed while nothing depends on it. Timestamping is on by default: without it every
+  signature stops verifying the day the certificate expires, including on copies installed years
+  earlier.
 - **A security policy, and the reporting channel it points at.** `SECURITY.md` says where to send a
   vulnerability and what the app actually handles that is worth attention — track metadata being
   untrusted input that reaches ffmpeg arguments and file paths, the PKCE sign-in, DPAPI token
diff --git a/Directory.Build.props b/Directory.Build.props
index 26337ff..49b8a35 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -38,6 +38,34 @@
     <InvariantGlobalization>false</InvariantGlobalization>
   </PropertyGroup>
 
+  <!--
+    Version and product identity.
+
+    The git tag is the source of truth for a released version, not this file. The release
+    workflow reads `v1.2.3` off the tag and passes `-p:Version=1.2.3`, which overrides
+    VersionPrefix/VersionSuffix below - so there is no number here to remember to bump in
+    lockstep with a tag, and no way for the two to disagree about what shipped.
+
+    What is left here is the version an *unreleased* build reports. It says `-dev` on
+    purpose: a local or CI build is not a release, and a build that claims to be 0.1.0 when
+    it is one commit of work past it is the kind of thing that gets reported as a bug in a
+    version that never existed. VersionSuffix is dropped the moment Version is supplied,
+    which is what makes a tagged build the only one without it.
+
+    VersionPrefix does still want a nudge when a release goes out, so `-dev` builds sort
+    after the last release rather than before it. Nothing breaks if it is forgotten -
+    the shipped number is still the tag's.
+  -->
+  <PropertyGroup>
+    <VersionPrefix>0.1.0</VersionPrefix>
+    <VersionSuffix Condition="'$(Version)' == ''">dev</VersionSuffix>
+
+    <Product>Offstream</Product>
+    <Company>Offstream contributors</Company>
+    <Copyright>Copyright (c) 2026 Offstream contributors</Copyright>
+    <Authors>Offstream contributors</Authors>
+  </PropertyGroup>
+
   <!--
     Load-bearing, not preferences. The audio-routing interop uses built-in COM interop,
     which NativeAOT does not support, and WPF trims poorly. See CLAUDE.md.
diff --git a/NOTICE b/NOTICE
index 632f296..57779f2 100644
--- a/NOTICE
+++ b/NOTICE
@@ -33,8 +33,31 @@ Third-party components
   Serilog, and its Console and File sinks      Apache-2.0
   TagLibSharp                   LGPL-2.1-only
 
-ffmpeg is invoked as an external process and never linked into Offstream. Offstream
-resolves an LGPL build, or the one on the user's PATH; no GPL build is bundled.
+
+ffmpeg
+------
+
+ffmpeg is invoked as an external process and never linked into Offstream. Nothing in this
+repository is a derivative work of it, and its licence governs ffmpeg alone.
+
+Releases bundle an unmodified LGPL-3.0-or-later build of ffmpeg, in the `ffmpeg` folder
+beside the executable, along with its own LICENSE.txt and a SOURCE.txt naming the exact
+commit it was built from. No GPL build is ever bundled: a GPL build would reach Offstream's
+own licensing, and buys nothing this app uses - libmp3lame, libopus and native flac and aac
+are all present in an LGPL build. A copy on the user's PATH, or one they point the setting
+at, is used in preference and may be any build they like.
+
+The precise build, its digest and its source are pinned in build/windows/ffmpeg.json.
+Distributing an LGPL binary obliges distributing the source it was built from, and every
+Offstream release attaches that source archive rather than offering to supply it later - an
+offer has to outlive whatever was going to host it, and this one does not have to.
+
+The bundled ffmpeg is never re-signed or otherwise altered on its way into a release. It
+ships exactly as its publisher built it.
+
+
+VB-CABLE
+--------
 
 VB-CABLE is not bundled. It is donationware from VB-Audio Software, installed by the user
 from vb-audio.com; Offstream only detects whether it is present.
diff --git a/README.md b/README.md
index aed63c8..8e767ce 100644
--- a/README.md
+++ b/README.md
@@ -34,9 +34,10 @@ drops into the list below as it is completed.*
 
 Three things worth knowing up front, so nothing is a surprise:
 
-**There's no installer yet.** Offstream is still in development, so there is no download — you build
-it from source — a few downloads and one build, with every step below. Packaging is the next piece
-of work.
+**There's no release yet.** Offstream is still in development, so there is nothing to download — you
+build it from source, which is a few downloads and one build, with every step below. The installer
+and the release pipeline are built and waiting on a version tag; check
+[Releases](https://github.com/revtex/offstream/releases) before assuming this is still true.
 
 **It records your PC's sound, not Spotify specifically.** By default Offstream captures whatever
 your speakers are playing, so a Windows notification chime or a YouTube tab in the background lands
@@ -45,8 +46,10 @@ in the recording too. Either keep the machine quiet while it records, or install
 settings, and record that instead — then only Spotify is captured. Offstream tells you on the
 Settings page whether VB-CABLE is installed.
 
-**You need ffmpeg.** It's the free tool Offstream uses to turn the captured audio into MP3s. One
-command installs it; see [Getting Offstream running](#getting-offstream-running).
+**You need ffmpeg — for now.** It's the free tool Offstream uses to turn the captured audio into
+MP3s. One command installs it; see [Getting Offstream running](#getting-offstream-running).
+Releases bundle their own copy, so this is only true while building from source. If you have one
+installed anyway, or point Offstream at a particular build on the Settings page, yours wins.
 
 ## Getting Offstream running
 
@@ -497,6 +500,63 @@ docs/    modernization plan, decision records, screenshots
 
 </details>
 
+<details>
+<summary><b>Releasing</b></summary>
+
+**The tag is the version.** Nothing in the repo records a released version number, so the two cannot
+disagree about what shipped.
+
+Cutting a release is two steps, and the pipeline refuses to skip the first.
+
+**1. Close the changelog, in a pull request.** Rename `## [Unreleased]` to `## [0.1.0] - 2026-08-14`
+and open a fresh empty `## [Unreleased]` above it. That section becomes the release notes verbatim.
+
+**2. Tag the merge commit and push the tag.** Everything else is automatic — build, test, publish,
+sign, package, GitHub release.
+
+```powershell
+git tag v0.1.0
+git push origin v0.1.0
+```
+
+Pushing a tag with no matching changelog section fails in seconds, before anything is built, and says
+what to do. Falling back to `[Unreleased]` instead would work exactly once: every later release would
+republish everything above it, including entries that shipped in the previous one, and the only fix
+is amending a release people have already read.
+
+A tag that is not `vMAJOR.MINOR.PATCH` — optionally with a prerelease suffix, `v1.2.3-rc.1` — is
+rejected before anything is built, since a tag is not meaningfully editable once anyone has fetched
+it. A prerelease suffix also marks the GitHub release as a prerelease, so it does not become what
+"latest" resolves to.
+
+To exercise the pipeline without spending a version number, run the **Release** workflow manually
+from the Actions tab: it builds and uploads the same artefacts and creates no release.
+
+`VersionPrefix` in `Directory.Build.props` only decides what an *unreleased* build calls itself
+(`0.1.0-dev`). Nudge it after a release so dev builds sort after it; nothing breaks if you forget.
+
+**The installer is per-user and never asks for administrator rights** — `build/windows/offstream.iss`,
+compiled by `build-installer.ps1` from the same staged folder the portable zip is made from, so the
+two downloads cannot hold different software under one version number. It installs into
+`%LOCALAPPDATA%\Programs\Offstream`, refuses to run on anything below Windows 11, and asks on
+uninstall whether to remove settings and logs as well. Recordings are never in its scope. CI compiles
+the script on every pull request, because a script that is only compiled at tag time is one that
+breaks at tag time.
+
+**ffmpeg is bundled, and pinned.** `build/windows/ffmpeg.json` names the exact LGPL build, its
+SHA-256 and the commit it came from; `fetch-ffmpeg.ps1` refuses anything that does not match. The
+binaries are not in this repository — 108 MB of someone else's build does not belong in a git
+history — so a release fetches them, and `build.ps1 -Publish -BundleFfmpeg` reproduces that locally.
+Distributing an LGPL binary obliges distributing its source, so each release attaches the matching
+source archive rather than offering to supply it later.
+
+**Builds are not code-signed yet.** `build/windows/sign.ps1` is wired into the pipeline and does
+nothing while no certificate is configured — it says so and exits 0. Setting the
+`OFFSTREAM_SIGNING_PFX_BASE64` and `OFFSTREAM_SIGNING_PASSWORD` repository secrets is all that is
+needed to turn it on. Until then, SmartScreen warns on first run and the release notes say so.
+
+</details>
+
 ## Licence
 
 MIT. Portions of the logic derive from the predecessor, which is MIT-licensed; its copyright notice
diff --git a/build.ps1 b/build.ps1
index b3bfcbc..2061e18 100644
--- a/build.ps1
+++ b/build.ps1
@@ -21,6 +21,7 @@
     .\build.ps1 -Clean -Test             # rebuild from scratch, then test
     .\build.ps1 -VerifyFormat            # what CI enforces
     .\build.ps1 -Publish                 # self-contained win-x64 publish
+    .\build.ps1 -Publish -BundleFfmpeg   # ...with the ffmpeg a release ships (108 MB)
     .\build.ps1 -Run                     # build and launch the app
 #>
 [CmdletBinding()]
@@ -35,6 +36,7 @@ param(
     [switch] $Format,
     [switch] $VerifyFormat,
     [switch] $Publish,
+    [switch] $BundleFfmpeg,
     [switch] $Run,
 
     [string] $Runtime = 'win-x64'
@@ -159,6 +161,16 @@ if ($Publish) {
     if (-not $tfm) { throw 'Could not read TargetFramework from Directory.Build.props.' }
 
     $out = Join-Path $app "bin\Release\$tfm\$Runtime\publish"
+
+    # Off by default: a developer machine has ffmpeg on PATH, which FFmpegLocator finds on
+    # its own, and 108 MB is a lot to fetch for a publish that is only being smoke-tested.
+    # A release always bundles - this switch is for reproducing that locally.
+    if ($BundleFfmpeg) {
+        Step 'Bundling ffmpeg...'
+        & (Join-Path $PSScriptRoot 'build\windows\fetch-ffmpeg.ps1') -Destination (Join-Path $out 'ffmpeg')
+        Assert-ExitCode 'Bundling ffmpeg'
+    }
+
     Write-Host "`nPublished to: $out" -ForegroundColor Green
 }
 
diff --git a/build/windows/build-installer.ps1 b/build/windows/build-installer.ps1
new file mode 100644
index 0000000..48417e1
--- /dev/null
+++ b/build/windows/build-installer.ps1
@@ -0,0 +1,98 @@
+<#
+.SYNOPSIS
+    Compiles the Inno Setup installer from a staged publish folder, and signs it.
+
+.DESCRIPTION
+    The staged folder is what the portable zip contains: the self-contained application, the
+    bundled ffmpeg, and the licence files. The installer is a second wrapping of the same
+    bytes rather than a separate build, so the two downloads can never contain different
+    software under the same version number.
+
+    Signing runs through sign.ps1, which is a no-op until a certificate is configured. An
+    unsigned installer is worse than an unsigned executable - it is the file SmartScreen
+    challenges first - which is why the step is here rather than being left to the pipeline
+    to remember.
+
+.PARAMETER Version
+    The version to stamp, without a leading v. Comes from the git tag.
+
+.PARAMETER SourceDir
+    The staged publish folder to package.
+
+.PARAMETER OutputDir
+    Where to write the installer. Defaults to artifacts/ at the repository root.
+
+.EXAMPLE
+    .\build-installer.ps1 -Version 0.1.0 -SourceDir ..\..\artifacts\staging\Offstream-0.1.0-win-x64
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string] $Version,
+
+    [Parameter(Mandatory)]
+    [string] $SourceDir,
+
+    [string] $OutputDir
+)
+
+$ErrorActionPreference = 'Stop'
+
+$repositoryRoot = (Resolve-Path (Join-Path $PSScriptRoot '..\..')).Path
+$script = Join-Path $PSScriptRoot 'offstream.iss'
+
+if (-not $OutputDir) { $OutputDir = Join-Path $repositoryRoot 'artifacts' }
+
+$SourceDir = (Resolve-Path -LiteralPath $SourceDir).Path
+New-Item -ItemType Directory -Path $OutputDir -Force | Out-Null
+$OutputDir = (Resolve-Path -LiteralPath $OutputDir).Path
+
+# Refuse to package a folder that is missing the things the .iss assumes are there, so the
+# failure names what is absent instead of producing an installer that installs a broken app.
+foreach ($required in 'Offstream.exe', 'LICENSE', 'NOTICE', 'ffmpeg\ffmpeg.exe') {
+    if (-not (Test-Path -LiteralPath (Join-Path $SourceDir $required))) {
+        throw "$SourceDir has no '$required'. Publish and stage before building the installer."
+    }
+}
+
+# --- Locate the Inno Setup compiler -----------------------------------------
+
+# Preinstalled on GitHub's windows-latest images, so this normally finds it without help.
+$compiler = Get-Command iscc.exe -ErrorAction SilentlyContinue |
+    Select-Object -First 1 -ExpandProperty Source
+
+if (-not $compiler) {
+    $compiler = @(
+        (Join-Path ${env:ProgramFiles(x86)} 'Inno Setup 6\ISCC.exe')
+        (Join-Path $env:ProgramFiles 'Inno Setup 6\ISCC.exe')
+    ) | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1
+}
+
+if (-not $compiler) {
+    throw 'Inno Setup 6 was not found. Install it with: winget install --id JRSoftware.InnoSetup'
+}
+
+# --- Compile ----------------------------------------------------------------
+
+Write-Host "Compiling the installer for $Version..."
+
+& $compiler `
+    "/DAppVersion=$Version" `
+    "/DSourceDir=$SourceDir" `
+    "/DOutputDir=$OutputDir" `
+    $script
+
+if ($LASTEXITCODE -ne 0) { throw "Inno Setup failed (exit $LASTEXITCODE)." }
+
+$installer = Join-Path $OutputDir "Offstream-$Version-setup.exe"
+if (-not (Test-Path -LiteralPath $installer)) { throw "Inno Setup reported success but $installer is not there." }
+
+# --- Sign -------------------------------------------------------------------
+
+& (Join-Path $PSScriptRoot 'sign.ps1') -Path $installer
+if ($LASTEXITCODE -ne 0) { throw "Signing the installer failed (exit $LASTEXITCODE)." }
+
+$size = [math]::Round((Get-Item $installer).Length / 1MB, 1)
+Write-Host "Built $installer ($size MB)." -ForegroundColor Green
+
+$installer
diff --git a/build/windows/fetch-ffmpeg.ps1 b/build/windows/fetch-ffmpeg.ps1
new file mode 100644
index 0000000..0650726
--- /dev/null
+++ b/build/windows/fetch-ffmpeg.ps1
@@ -0,0 +1,137 @@
+<#
+.SYNOPSIS
+    Downloads the pinned LGPL ffmpeg build and stages it for bundling.
+
+.DESCRIPTION
+    Offstream ships ffmpeg rather than asking every user to install it (plan §5.1, DR-0001),
+    but the binaries are not in this repository: they are 108 MB, they are not ours, and a
+    git history is the wrong place for either. This fetches them instead, from the release
+    and with the digest recorded in ffmpeg.json beside this script.
+
+    The digest is the point. A build fetched by name from a moving tag is a build nobody
+    can reproduce: an encoder that changes between two builds of the same Offstream version
+    turns a reproducible bug into an unreproducible one. A mismatch fails, loudly, rather
+    than quietly shipping something else.
+
+    What lands in -Destination is what ships:
+
+      ffmpeg.exe        the encoder, and the only executable of the three that is bundled
+      LICENSE.txt       ffmpeg's own licence text, as LGPL-3.0 requires travel with it
+      SOURCE.txt        written here, naming the exact commit and where its source is
+
+.PARAMETER Destination
+    Where to put the bundle. The release pipeline points this at the `ffmpeg` subfolder of
+    the staged application directory, which is where FFmpegLocator looks.
+
+.PARAMETER CacheDirectory
+    Where to keep the downloaded zip between runs. Defaults to a folder under TEMP, so a
+    second run on the same machine re-verifies rather than re-downloads 146 MB.
+
+.EXAMPLE
+    .\fetch-ffmpeg.ps1 -Destination .\artifacts\staging\Offstream-0.1.0-win-x64\ffmpeg
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory)]
+    [string] $Destination,
+
+    [string] $CacheDirectory = (Join-Path ([System.IO.Path]::GetTempPath()) 'offstream-ffmpeg-cache')
+)
+
+$ErrorActionPreference = 'Stop'
+
+$manifest = Get-Content (Join-Path $PSScriptRoot 'ffmpeg.json') -Raw | ConvertFrom-Json
+$url = "https://github.com/BtbN/FFmpeg-Builds/releases/download/$($manifest.release)/$($manifest.asset)"
+
+New-Item -ItemType Directory -Path $CacheDirectory, $Destination -Force | Out-Null
+$zip = Join-Path $CacheDirectory $manifest.asset
+
+# --- Download ---------------------------------------------------------------
+
+# A cached file that no longer matches is treated as absent rather than as an error: a
+# half-written download from an interrupted run is the ordinary reason for it, and there is
+# nothing to diagnose. A *fresh* download that does not match is the alarming case, below.
+if (Test-Path -LiteralPath $zip) {
+    if ((Get-FileHash $zip -Algorithm SHA256).Hash -ieq $manifest.sha256) {
+        Write-Host "Using cached $($manifest.asset)."
+    }
+    else {
+        Write-Host 'Cached copy does not match its digest; discarding it.'
+        Remove-Item -LiteralPath $zip -Force
+    }
+}
+
+if (-not (Test-Path -LiteralPath $zip)) {
+    Write-Host "Downloading $($manifest.asset) (146 MB)..."
+
+    # Invoke-WebRequest's progress bar makes this several times slower in a non-interactive
+    # host, which is every host this runs in.
+    $previous = $ProgressPreference
+    $ProgressPreference = 'SilentlyContinue'
+    try { Invoke-WebRequest -Uri $url -OutFile $zip }
+    finally { $ProgressPreference = $previous }
+
+    $actual = (Get-FileHash $zip -Algorithm SHA256).Hash.ToLowerInvariant()
+
+    if ($actual -ne $manifest.sha256) {
+        Remove-Item -LiteralPath $zip -Force
+        throw @"
+ffmpeg download does not match the pinned digest.
+
+  expected  $($manifest.sha256)
+  actual    $actual
+  from      $url
+
+Nothing was staged. Either the release asset was replaced - GitHub allows it, and it is why
+this check exists - or the download was tampered with. Do not update the digest to make this
+pass without establishing which.
+"@
+    }
+
+    Write-Host "Verified $actual."
+}
+
+# --- Extract ----------------------------------------------------------------
+
+# Into a scratch folder, then move the two files out: the archive has a versioned root
+# folder, so extracting straight to the destination would bury ffmpeg.exe one level deeper
+# than FFmpegLocator looks.
+$scratch = Join-Path $CacheDirectory 'extract'
+if (Test-Path -LiteralPath $scratch) { Remove-Item -LiteralPath $scratch -Recurse -Force }
+
+Expand-Archive -LiteralPath $zip -DestinationPath $scratch
+
+$executable = Get-ChildItem -Path $scratch -Filter 'ffmpeg.exe' -Recurse | Select-Object -First 1
+$licence = Get-ChildItem -Path $scratch -Filter 'LICENSE.txt' -Recurse | Select-Object -First 1
+
+if (-not $executable) { throw "ffmpeg.exe was not in $($manifest.asset). The asset's layout has changed." }
+if (-not $licence) { throw "LICENSE.txt was not in $($manifest.asset), and it cannot ship without one." }
+
+Copy-Item $executable.FullName (Join-Path $Destination 'ffmpeg.exe') -Force
+Copy-Item $licence.FullName (Join-Path $Destination 'LICENSE.txt') -Force
+
+@"
+ffmpeg $($manifest.version)
+$($manifest.licence)
+
+This copy of ffmpeg is redistributed with Offstream, unmodified. Offstream runs it as a
+separate process and links no part of it; ffmpeg's licence is LICENSE.txt beside this file
+and governs ffmpeg alone.
+
+The source it was built from is FFmpeg commit
+
+  $($manifest.sourceCommit)
+  $($manifest.sourceUrl)
+
+and the scripts that built it are
+
+  $($manifest.buildScriptsUrl)
+
+Every Offstream release attaches that source archive as a release asset, so it travels with
+the binary rather than depending on a link outliving it.
+"@ | Out-File (Join-Path $Destination 'SOURCE.txt') -Encoding utf8
+
+Remove-Item -LiteralPath $scratch -Recurse -Force
+
+$size = [math]::Round((Get-Item (Join-Path $Destination 'ffmpeg.exe')).Length / 1MB)
+Write-Host "Staged ffmpeg $($manifest.version) ($size MB) into $Destination." -ForegroundColor Green
diff --git a/build/windows/ffmpeg.json b/build/windows/ffmpeg.json
new file mode 100644
index 0000000..738b230
--- /dev/null
+++ b/build/windows/ffmpeg.json
@@ -0,0 +1,32 @@
+{
+  "$comment": [
+    "The ffmpeg Offstream ships. Pinned rather than tracked: 'latest' is a moving target,",
+    "and an encoder that changes between two builds of the same Offstream version turns a",
+    "reproducible bug into an unreproducible one. Nothing here is fetched at build time",
+    "without its sha256 matching.",
+
+    "LGPL, not GPL. This build is configured without --enable-gpl and with --enable-version3,",
+    "which makes it LGPL-3.0-or-later. Every encoder Offstream needs is present: libmp3lame,",
+    "libopus, and native flac and aac. A GPL build would drag Offstream's own licensing along",
+    "with it, and buys nothing this app uses.",
+
+    "The whole zip is 146 MB and holds ffmpeg, ffprobe, ffplay and the HTML manual. Only",
+    "ffmpeg.exe and the licence are bundled - ffprobe is used by the integration tests and",
+    "nothing in the app, and shipping it would add another 108 MB to every download.",
+
+    "sourceCommit is the obligation, not a courtesy: distributing LGPL binaries means",
+    "distributing the source they were built from. The release attaches that archive rather",
+    "than promising it on request, so the offer cannot outlive whatever was going to host it."
+  ],
+
+  "version": "n8.1.2-40-g852b0552f0",
+  "licence": "LGPL-3.0-or-later",
+
+  "release": "autobuild-2026-08-14-13-16",
+  "asset": "ffmpeg-n8.1.2-40-g852b0552f0-win64-lgpl-8.1.zip",
+  "sha256": "928a2215433d2060698b07037bfe301638b477978a525b7af41d79a98e357a11",
+
+  "sourceCommit": "852b0552f072826723749db6891928d839f536d8",
+  "sourceUrl": "https://github.com/FFmpeg/FFmpeg/archive/852b0552f072826723749db6891928d839f536d8.tar.gz",
+  "buildScriptsUrl": "https://github.com/BtbN/FFmpeg-Builds/tree/autobuild-2026-08-14-13-16"
+}
diff --git a/build/windows/offstream.iss b/build/windows/offstream.iss
new file mode 100644
index 0000000..967b613
--- /dev/null
+++ b/build/windows/offstream.iss
@@ -0,0 +1,128 @@
+; Offstream installer (Inno Setup 6).
+;
+; Per-user by design, and that is the whole reason WiX/MSI was not chosen: Offstream needs no
+; administrator rights to run - routing, session mute and loopback capture were all verified
+; unelevated in Phase 0 - so the thing that installs it should not ask for any either. An
+; elevation prompt is a decision the user has to make about software they have not run yet.
+;
+; Built by build/windows/build-installer.ps1, which passes AppVersion and SourceDir. Building
+; this file directly needs both:
+;
+;   iscc offstream.iss /DAppVersion=1.2.3 /DSourceDir=..\..\artifacts\staging\Offstream-1.2.3-win-x64
+
+#ifndef AppVersion
+  #error AppVersion is required. Pass /DAppVersion=1.2.3 - the version comes from the git tag.
+#endif
+
+#ifndef SourceDir
+  #error SourceDir is required. Pass /DSourceDir=<the staged publish folder>.
+#endif
+
+#ifndef OutputDir
+  #define OutputDir "..\..\artifacts"
+#endif
+
+#define AppName "Offstream"
+#define AppPublisher "Offstream contributors"
+#define AppUrl "https://github.com/revtex/offstream"
+#define AppExeName "Offstream.exe"
+
+[Setup]
+; Never regenerate this. It is how Windows knows an upgrade from a second installation, and a
+; new one strands the previous version in Apps & features with no way to remove it.
+AppId={{BA198809-2F62-4C20-AF9C-968CDDB7FE4A}
+
+AppName={#AppName}
+AppVersion={#AppVersion}
+AppVerName={#AppName} {#AppVersion}
+VersionInfoVersion={#AppVersion}
+AppPublisher={#AppPublisher}
+AppPublisherURL={#AppUrl}
+AppSupportURL={#AppUrl}/issues
+AppUpdatesURL={#AppUrl}/releases
+
+; lowest, and {autopf} therefore resolves to {localappdata}\Programs rather than Program Files.
+; PrivilegesRequiredOverridesAllowed is deliberately not set: there is no supported machine-wide
+; install, so offering one would create a second install location nothing else knows about.
+PrivilegesRequired=lowest
+DefaultDirName={autopf}\{#AppName}
+DefaultGroupName={#AppName}
+DisableProgramGroupPage=yes
+AllowNoIcons=yes
+
+; Offstream is Windows 11 only (decided 2026-08-11) and ships win-x64 only. Both are checked
+; here so the failure is a sentence during setup rather than a crash on first run.
+MinVersion=10.0.22000
+ArchitecturesAllowed=x64compatible
+ArchitecturesInstallIn64BitMode=x64compatible
+
+; The app's own single-instance mutex (OffstreamPaths.InstanceMutex). Setup asks the user to
+; close a running copy instead of failing halfway through replacing a locked executable.
+AppMutex=Local\Offstream
+
+LicenseFile={#SourceDir}\LICENSE
+InfoAfterFile={#SourceDir}\NOTICE
+OutputDir={#OutputDir}
+OutputBaseFilename={#AppName}-{#AppVersion}-setup
+SetupIconFile=..\..\src\Offstream.App\Assets\offstream.ico
+UninstallDisplayIcon={app}\{#AppExeName}
+UninstallDisplayName={#AppName}
+
+; The payload is a self-contained .NET publish plus a 108 MB ffmpeg, so compression is worth
+; the build minutes. Solid compression pays off precisely because there are a few very large,
+; similar files rather than many small ones.
+Compression=lzma2/max
+SolidCompression=yes
+WizardStyle=modern
+
+[Languages]
+; Matching the app's own en/fr localisation. An installer in one language for an app that
+; offers two is a seam the user meets before anything else.
+Name: "en"; MessagesFile: "compiler:Default.isl"
+Name: "fr"; MessagesFile: "compiler:Languages\French.isl"
+
+[Tasks]
+Name: "desktopicon"; Description: "{cm:CreateDesktopIcon}"; GroupDescription: "{cm:AdditionalIcons}"; Flags: unchecked
+
+[Files]
+; recursesubdirs picks up the ffmpeg folder, which has to keep its name: FFmpegLocator looks
+; for {app}\ffmpeg\ffmpeg.exe and falls through to PATH if it is not there.
+Source: "{#SourceDir}\*"; DestDir: "{app}"; Flags: ignoreversion recursesubdirs createallsubdirs
+
+[Icons]
+Name: "{autoprograms}\{#AppName}"; Filename: "{app}\{#AppExeName}"
+Name: "{autodesktop}\{#AppName}"; Filename: "{app}\{#AppExeName}"; Tasks: desktopicon
+
+[Run]
+Filename: "{app}\{#AppExeName}"; Description: "{cm:LaunchProgram,{#AppName}}"; Flags: nowait postinstall skipifsilent
+
+[UninstallDelete]
+; Anything the app wrote inside its own install folder. Recordings are not here - they go to
+; the user's Music folder by default and are never touched.
+Type: filesandordirs; Name: "{app}\ffmpeg"
+
+[Code]
+{ Uninstalling leaves settings and logs behind unless the user says otherwise, and asks rather
+  than guessing. Deleting them silently loses a Last.fm API key and a Spotify sign-in that
+  reinstalling will ask for again; keeping them silently is the wrong answer for someone who is
+  uninstalling because they are done. Recordings are never in scope: they are the point of the
+  app, they live outside this folder, and no uninstaller should reach them. }
+procedure CurUninstallStepChanged(CurUninstallStep: TUninstallStep);
+var
+  DataDir: string;
+begin
+  if CurUninstallStep <> usPostUninstall then
+    Exit;
+
+  DataDir := ExpandConstant('{userappdata}\Offstream');
+
+  if not DirExists(DataDir) then
+    Exit;
+
+  if MsgBox('Remove Offstream''s settings and logs as well?' + #13#10#13#10 +
+            DataDir + #13#10#13#10 +
+            'This includes your Last.fm API key and Spotify sign-in. Your recordings are ' +
+            'stored elsewhere and are never removed.',
+            mbConfirmation, MB_YESNO or MB_DEFBUTTON2) = IDYES then
+    DelTree(DataDir, True, True, True);
+end;
diff --git a/build/windows/sign.ps1 b/build/windows/sign.ps1
new file mode 100644
index 0000000..4de5eca
--- /dev/null
+++ b/build/windows/sign.ps1
@@ -0,0 +1,127 @@
+<#
+.SYNOPSIS
+    Authenticode-signs the files it is given, or explains why it did not.
+
+.DESCRIPTION
+    Offstream has no code-signing certificate yet (open question 3, deferred 2026-08-14),
+    and buying one is procurement rather than engineering. So this script is deliberately
+    a no-op when none is configured: it says so on stdout and exits 0, and the release
+    still builds.
+
+    That is the whole point of it existing now rather than later. Acquiring a certificate
+    becomes "set two secrets" instead of "change the release pipeline", and the shape of
+    the signing step gets reviewed while nothing depends on it.
+
+    Configuration is by environment variable, because that is what a GitHub Actions secret
+    reaches a script as:
+
+      OFFSTREAM_SIGNING_PFX_BASE64   base64 of a PKCS#12 (.pfx) certificate  [required]
+      OFFSTREAM_SIGNING_PASSWORD     its password                            [optional]
+      OFFSTREAM_SIGNING_TIMESTAMP_URL  RFC 3161 timestamp server             [optional]
+
+    Timestamping is not optional in effect, only in configuration: without it, every
+    signature this produces stops verifying the day the certificate expires, including on
+    copies users installed years earlier. The default below is DigiCert's public server.
+
+.NOTES
+    Nothing here prints the password, the certificate, or a signtool command line
+    containing either. The .pfx is written to a temporary file because signtool takes a
+    path and not bytes, and it is removed in a finally block so a failure part-way through
+    does not leave a private key on the runner.
+
+.EXAMPLE
+    .\sign.ps1 -Path .\publish\Offstream.exe
+    .\sign.ps1 -Path (Get-ChildItem .\publish -Filter *.exe)
+#>
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory, ValueFromPipeline)]
+    [string[]] $Path,
+
+    # Fail instead of skipping when no certificate is configured. The release workflow
+    # leaves this off; a pipeline that is *supposed* to produce signed output turns it on
+    # so a missing secret is a red build rather than a quietly unsigned artefact.
+    [switch] $Require
+)
+
+$ErrorActionPreference = 'Stop'
+
+$files = @($Path | ForEach-Object { (Resolve-Path -LiteralPath $_).Path })
+if (-not $files) { throw 'sign.ps1 was given no files to sign.' }
+
+$pfxBase64 = $env:OFFSTREAM_SIGNING_PFX_BASE64
+
+if ([string]::IsNullOrWhiteSpace($pfxBase64)) {
+    $message = 'No signing certificate is configured (OFFSTREAM_SIGNING_PFX_BASE64 is unset).'
+
+    if ($Require) { throw "$message This build was required to be signed." }
+
+    Write-Host $message -ForegroundColor Yellow
+    Write-Host 'Leaving the following unsigned. Windows SmartScreen will warn on first run:' -ForegroundColor Yellow
+    $files | ForEach-Object { Write-Host "  $_" }
+    exit 0
+}
+
+# --- Locate signtool --------------------------------------------------------
+
+# signtool ships in the Windows SDK and is not on PATH by default, including on GitHub's
+# windows-latest images. Newest version wins - the SDK installs side by side by version,
+# and older ones predate the SHA-256 and RFC 3161 switches used below.
+$signtool = Get-Command signtool.exe -ErrorAction SilentlyContinue |
+    Select-Object -First 1 -ExpandProperty Source
+
+if (-not $signtool) {
+    $kits = Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\bin'
+
+    if (Test-Path $kits) {
+        $signtool = Get-ChildItem -Path $kits -Filter 'signtool.exe' -Recurse -ErrorAction SilentlyContinue |
+            Where-Object { $_.FullName -match '\\x64\\' } |
+            Sort-Object -Property FullName -Descending |
+            Select-Object -First 1 -ExpandProperty FullName
+    }
+}
+
+if (-not $signtool) {
+    throw 'A signing certificate is configured but signtool.exe was not found. Install the Windows SDK signing tools.'
+}
+
+# --- Sign -------------------------------------------------------------------
+
+$pfx = Join-Path ([System.IO.Path]::GetTempPath()) ([System.IO.Path]::GetRandomFileName() + '.pfx')
+$timestamp = if ($env:OFFSTREAM_SIGNING_TIMESTAMP_URL) { $env:OFFSTREAM_SIGNING_TIMESTAMP_URL }
+             else { 'http://timestamp.digicert.com' }
+
+try {
+    [System.IO.File]::WriteAllBytes($pfx, [System.Convert]::FromBase64String($pfxBase64))
+
+    $arguments = @(
+        'sign'
+        '/f', $pfx
+        '/fd', 'sha256'          # SHA-1 file digests are rejected outright by current Windows.
+        '/tr', $timestamp
+        '/td', 'sha256'
+        '/d', 'Offstream'        # What the UAC and SmartScreen prompts call it.
+    )
+
+    if ($env:OFFSTREAM_SIGNING_PASSWORD) { $arguments += @('/p', $env:OFFSTREAM_SIGNING_PASSWORD) }
+
+    foreach ($file in $files) {
+        Write-Host "Signing $file"
+
+        # Passed as one array so the password never appears in a command string this script
+        # could log, and so a path with a space needs no quoting of its own.
+        & $signtool @arguments $file | Out-Null
+
+        if ($LASTEXITCODE -ne 0) { throw "signtool failed for $file (exit $LASTEXITCODE)." }
+    }
+
+    foreach ($file in $files) {
+        & $signtool verify /pa /v $file | Out-Null
+        if ($LASTEXITCODE -ne 0) { throw "The signature on $file did not verify." }
+    }
+
+    Write-Host "Signed and verified $($files.Count) file(s)." -ForegroundColor Green
+}
+finally {
+    if (Test-Path -LiteralPath $pfx) { Remove-Item -LiteralPath $pfx -Force }
+}