diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 0bd944a..b2e9a33 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -17,6 +17,12 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
+    - name: Get version tag
+      shell: pwsh
+      run: |
+        $version = Get-Content -Path "VERSION"
+        echo "VERSION=$version" >> $env:GITHUB_ENV
+
     - name: Setup Go
       uses: actions/setup-go@v5
       with:
@@ -64,34 +70,47 @@ jobs:
         Expand-Archive -DestinationPath upx upx.zip
         upx/upx-5.0.2-win64/upx.exe --lzma -o src/ZeeCrypt.exe src/5.exe
 
+    - name: Install WiX
+      shell: pwsh
+      run: dotnet tool install --global wix
+
+    - name: Build installer (MSI)
+      shell: pwsh
+      run: |
+        wix build dist/windows/installer.wxs `
+          -d ExePath=src/ZeeCrypt.exe `
+          -d IconPath=images/lock.ico `
+          -d ProductVersion="$($env:VERSION).0.0" `
+          -o ZeeCrypt-Installer.msi
+
     - name: Upload artifact
       uses: actions/upload-artifact@v4
       with:
         name: build-windows
-        path: src/*.exe
+        path: |
+          src/*.exe
+          ZeeCrypt-Installer.msi
         if-no-files-found: error
         compression-level: 9
 
-    - name: Get version tag
-      shell: pwsh
-      run: |
-        $version = Get-Content -Path "VERSION"
-        echo "VERSION=$version" >> $env:GITHUB_ENV
-
     - name: Generate checksums
       shell: pwsh
       run: |
-        $hash = Get-FileHash "src/ZeeCrypt.exe" -Algorithm SHA256
-        echo "CHECKSUM_ZEECRYPT=$($hash.Hash)" >> $env:GITHUB_ENV
+        $exeHash = Get-FileHash "src/ZeeCrypt.exe" -Algorithm SHA256
+        echo "CHECKSUM_ZEECRYPT=$($exeHash.Hash)" >> $env:GITHUB_ENV
+        $msiHash = Get-FileHash "ZeeCrypt-Installer.msi" -Algorithm SHA256
+        echo "CHECKSUM_INSTALLER=$($msiHash.Hash)" >> $env:GITHUB_ENV
 
     - name: Release
       uses: softprops/action-gh-release@v2
       with:
         files: |
           src/ZeeCrypt.exe
+          ZeeCrypt-Installer.msi
         tag_name: ${{ env.VERSION }}
         make_latest: true
         append_body: true
         body: |
           **Windows:**
           `sha256(ZeeCrypt.exe)  ${{ env.CHECKSUM_ZEECRYPT }}`
+          `sha256(ZeeCrypt-Installer.msi)  ${{ env.CHECKSUM_INSTALLER }}`
diff --git a/dist/windows/installer.wxs b/dist/windows/installer.wxs
new file mode 100644
index 0000000..cf47be0
--- /dev/null
+++ b/dist/windows/installer.wxs
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ZeeCrypt MSI installer, built with WiX Toolset v5 (https://wixtoolset.org/).
+
+  Build (from repo root, after ZeeCrypt.exe and images/lock.ico exist):
+    dotnet tool install --global wix
+    wix build dist/windows/installer.wxs -d ExePath=src/ZeeCrypt.exe -d IconPath=images/lock.ico -d ProductVersion=1.50.0.0 -o ZeeCrypt-Installer.msi
+
+  Installs per-user (no administrator privileges required), matching the
+  portable download's "no admin needed" promise in the README.
+
+  IMPORTANT: UpgradeCode must never change across releases - it's what lets
+  Windows Installer detect and upgrade a previous ZeeCrypt install instead of
+  treating a new version as an unrelated product.
+-->
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <Package Name="ZeeCrypt"
+           Manufacturer="Teddy Jones"
+           Version="$(var.ProductVersion)"
+           UpgradeCode="fcc59afd-06ce-40f0-8de0-46e02636afff"
+           Language="1033"
+           Compressed="yes"
+           Scope="perUser">
+
+    <MajorUpgrade DowngradeErrorMessage="A newer version of ZeeCrypt is already installed." />
+    <MediaTemplate EmbedCab="yes" />
+
+    <Icon Id="AppIcon.ico" SourceFile="$(var.IconPath)" />
+    <Property Id="ARPPRODUCTICON" Value="AppIcon.ico" />
+    <Property Id="ARPHELPLINK" Value="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/TheZeekA/ZeeCrypt" />
+    <Property Id="ARPURLINFOABOUT" Value="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/TheZeekA/ZeeCrypt" />
+
+    <StandardDirectory Id="LocalAppDataFolder">
+      <Directory Id="ProgramsFolder" Name="Programs">
+        <Directory Id="APPFOLDER" Name="ZeeCrypt" />
+      </Directory>
+    </StandardDirectory>
+
+    <StandardDirectory Id="ProgramMenuFolder">
+      <Directory Id="ApplicationProgramsFolder" Name="ZeeCrypt" />
+    </StandardDirectory>
+
+    <Feature Id="MainFeature" Title="ZeeCrypt" Level="1">
+      <ComponentGroupRef Id="ProductComponents" />
+    </Feature>
+  </Package>
+
+  <Fragment>
+    <ComponentGroup Id="ProductComponents" Directory="APPFOLDER">
+      <!-- Main executable + Start Menu shortcut -->
+      <Component Id="MainExecutable" Guid="*">
+        <File Id="ZeeCryptEXE" Source="$(var.ExePath)" KeyPath="yes">
+          <Shortcut Id="StartMenuShortcut"
+                     Directory="ApplicationProgramsFolder"
+                     Name="ZeeCrypt"
+                     WorkingDirectory="APPFOLDER"
+                     Icon="AppIcon.ico" />
+        </File>
+      </Component>
+
+      <!-- .pcv file association -->
+      <Component Id="FileAssociation" Guid="*">
+        <RegistryValue Root="HKCU" Key="Software\Classes\.pcv" Value="ZeeCrypt.pcv" Type="string" KeyPath="yes" />
+        <RegistryValue Root="HKCU" Key="Software\Classes\ZeeCrypt.pcv" Value="ZeeCrypt Encrypted Volume" Type="string" />
+        <RegistryValue Root="HKCU" Key="Software\Classes\ZeeCrypt.pcv\DefaultIcon" Value="[APPFOLDER]ZeeCrypt.exe,0" Type="string" />
+        <RegistryValue Root="HKCU" Key="Software\Classes\ZeeCrypt.pcv\shell\open\command" Value="&quot;[APPFOLDER]ZeeCrypt.exe&quot; &quot;%1&quot;" Type="string" />
+      </Component>
+
+      <!-- Clean up the Start Menu folder on uninstall -->
+      <Component Id="RemoveStartMenuShortcut" Directory="ApplicationProgramsFolder" Guid="*">
+        <RemoveFolder Id="ApplicationProgramsFolder" On="uninstall" />
+        <RegistryValue Root="HKCU" Key="Software\ZeeCrypt" Name="StartMenuShortcut" Type="integer" Value="1" KeyPath="yes" />
+      </Component>
+    </ComponentGroup>
+  </Fragment>
+</Wix>
diff --git a/dist/windows/versioninfo.rc b/dist/windows/versioninfo.rc
index 6b4becc..f2c36a6 100644
--- a/dist/windows/versioninfo.rc
+++ b/dist/windows/versioninfo.rc
@@ -8,6 +8,7 @@ BLOCK "StringFileInfo"
 {
 	BLOCK "040904B0"
 	{
+		VALUE "CompanyName", "Teddy Jones"
 		VALUE "FileVersion", "1.50"
 		VALUE "LegalCopyright", "\xA9 Evan Su & contributors, GPLv3"
 		VALUE "ProductName", "ZeeCrypt"