diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 57a1e5d..2fc8c4f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -58,7 +58,7 @@ jobs:
 
   launcher-windows:
     name: Windows launcher
-    runs-on: windows-latest
+    runs-on: scopenet
     steps:
       - uses: actions/checkout@v5
       - name: Install Windows build dependencies
@@ -69,6 +69,21 @@ jobs:
         working-directory: launcher
       - run: npm run build
         working-directory: launcher
+      - name: Build NSIS installer
+        working-directory: launcher
+        shell: pwsh
+        env:
+          SCOPENET_PANEL_URL: ${{ vars.PANEL_URL }}
+          SCOPENET_LOCK_PANEL: ${{ vars.LOCK_PANEL }}
+          SCOPENET_REPO: ${{ gitea.server_url }}/${{ gitea.repository }}
+        run: |
+          npx tauri build --bundles nsis
+          if ($LASTEXITCODE -ne 0) { throw "NSIS build failed with exit code $LASTEXITCODE" }
+      - uses: actions/upload-artifact@v4
+        with:
+          name: windows-installer-ci
+          path: target/release/bundle/nsis/*-setup.exe
+          if-no-files-found: error
       - run: cargo clippy -p scopenet-launcher --locked -- -D warnings
       - run: cargo test -p scopenet-launcher -p scopenet-core -p scopenet-shared --locked
 
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 5ab9d9f..04dd48e 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -50,7 +50,7 @@ jobs:
   launcher:
     name: Windows installer
     needs: version
-    runs-on: windows-latest
+    runs-on: scopenet
     steps:
       - uses: actions/checkout@v5
       - name: Install Windows build dependencies
diff --git a/README.md b/README.md
index 1a128ed..3d98857 100644
--- a/README.md
+++ b/README.md
@@ -82,7 +82,7 @@ The workflow builds the **Windows installer**, pushes the **panel image to Gitea
 
 ### Gitea runner setup
 
-Register a Linux host runner with the `ubuntu-latest` label and a Windows host runner with `windows-latest`. Linux builds the panel Docker image and server JARs; Windows builds the NSIS installer. The workflows use [the Linux setup tool](scripts/ci/install-linux.sh) and [the Windows setup tool](scripts/ci/install-windows.ps1) to install or check job dependencies. Linux Node 22 and Java 21/25 are downloaded by `setup-node` and `setup-java`; the Linux tool installs Rust, Tauri system packages, and release utilities. The Windows tool downloads PowerShell 7.6.6 and Node 22 if unavailable, then installs Rust and Microsoft C++ Build Tools. Docker and Buildx are set up by Docker's Actions. The Linux runner must allow a Docker daemon to start or provide one, and system package installation needs root or passwordless sudo. Enable Actions for the repository and allow its job token to write releases and packages. See [Gitea's runner labels](https://docs.gitea.com/runner/labels/) and [token permissions](https://docs.gitea.com/usage/actions/token-permissions/).
+Register a Linux host runner with the `ubuntu-latest` label and a Windows host runner with `scopenet:host` (selected by `runs-on: scopenet`). Linux builds the panel Docker image and server JARs; Windows builds the NSIS installer. CI also builds and uploads a Windows NSIS artifact so the installer can be checked without publishing a release. The workflows use [the Linux setup tool](scripts/ci/install-linux.sh) and [the Windows setup tool](scripts/ci/install-windows.ps1) to install or check job dependencies. Linux Node 22 and Java 21/25 are downloaded by `setup-node` and `setup-java`; the Linux tool installs Rust, Tauri system packages, and release utilities. The Windows tool downloads PowerShell 7.6.6 and Node 22 if unavailable, then installs Rust and Microsoft C++ Build Tools. Docker and Buildx are set up by Docker's Actions. The Linux runner must allow a Docker daemon to start or provide one, and system package installation needs root or passwordless sudo. Enable Actions for the repository and allow its job token to write releases and packages. See [Gitea's runner labels](https://docs.gitea.com/runner/labels/) and [token permissions](https://docs.gitea.com/usage/actions/token-permissions/).
 
 The setup tools also run directly on matching hosts: `bash scripts/ci/install-linux.sh rust` prepares Rust and Tauri builds, `bash scripts/ci/install-linux.sh image` checks Docker, `bash scripts/ci/install-linux.sh java 21` checks a Java integration runner, and `powershell -File scripts/ci/install-windows.ps1` prepares the Windows installer runner. Gitea uses them in CI and release jobs; GitHub provides a manual **Runner setup** workflow for both platforms. Run the Linux `rust` mode as root or with passwordless sudo; the Windows script may need administrator rights to install Microsoft C++ Build Tools.