diff --git a/installer/setup.ps1 b/installer/setup.ps1
new file mode 100644
index 0000000..e7449d4
--- /dev/null
+++ b/installer/setup.ps1
@@ -0,0 +1,25 @@
+param(
+  [string]$ServerId,
+  [string]$Token,
+  [string]$ServerUrl,
+  [string]$InstallDir
+)
+$cfgDir = Join-Path $env:ProgramData "vantage"
+New-Item -ItemType Directory -Force -Path $cfgDir | Out-Null
+$cfg = @"
+server_url: "$ServerUrl"
+server_id: "$ServerId"
+pre_reg_token: "$Token"
+agent_token: ""
+poll_interval: 30s
+tls: true
+"@
+Set-Content -Path (Join-Path $cfgDir "config.yaml") -Value $cfg -Encoding utf8
+# Lock down ACL: SYSTEM + Administrators only
+icacls (Join-Path $cfgDir "config.yaml") /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" | Out-Null
+
+$nssm = Join-Path $InstallDir "nssm.exe"
+$exe  = Join-Path $InstallDir "vantage-agent.exe"
+& $nssm install VantageAgent $exe
+& $nssm set VantageAgent Start SERVICE_AUTO_START
+& $nssm start VantageAgent
diff --git a/installer/vantage-agent.wxs b/installer/vantage-agent.wxs
new file mode 100644
index 0000000..9e012b8
--- /dev/null
+++ b/installer/vantage-agent.wxs
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <Package Name="Vantage Agent" Manufacturer="Vantage"
+           Version="1.0.0.0" UpgradeCode="7d1e6d2c-2a5f-4b3e-9c3a-8a1b2c3d4e5f"
+           Scope="perMachine">
+    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed." />
+    <MediaTemplate EmbedCab="yes" />
+
+    <!-- Public properties settable via msiexec: SERVERID, TOKEN, SERVERURL -->
+    <Property Id="SERVERID" Secure="yes" />
+    <Property Id="TOKEN" Secure="yes" />
+    <Property Id="SERVERURL" Secure="yes" />
+
+    <StandardDirectory Id="ProgramFiles64Folder">
+      <Directory Id="INSTALLDIR" Name="Vantage">
+        <Component Id="AgentExe" Guid="*">
+          <File Id="AgentExe" Source="vantage-agent-windows-amd64.exe" Name="vantage-agent.exe" KeyPath="yes" />
+        </Component>
+        <Component Id="NssmExe" Guid="*">
+          <File Id="NssmExe" Source="nssm.exe" Name="nssm.exe" KeyPath="yes" />
+        </Component>
+        <Component Id="SetupScript" Guid="*">
+          <File Id="SetupScript" Source="setup.ps1" Name="setup.ps1" KeyPath="yes" />
+        </Component>
+      </Directory>
+    </StandardDirectory>
+
+    <Feature Id="Main">
+      <ComponentRef Id="AgentExe" />
+      <ComponentRef Id="NssmExe" />
+      <ComponentRef Id="SetupScript" />
+    </Feature>
+
+    <!-- Write config.yaml, then install + start the service via nssm.
+         Implemented as sequenced CustomActions running a helper script. -->
+    <CustomAction Id="WriteConfig" Directory="INSTALLDIR"
+      ExeCommand='cmd.exe /c powershell -ExecutionPolicy Bypass -File "[INSTALLDIR]setup.ps1" -ServerId "[SERVERID]" -Token "[TOKEN]" -ServerUrl "[SERVERURL]" -InstallDir "[INSTALLDIR]"'
+      Execute="deferred" Impersonate="no" Return="check" />
+
+    <InstallExecuteSequence>
+      <Custom Action="WriteConfig" After="InstallFiles" Condition="NOT Installed" />
+    </InstallExecuteSequence>
+  </Package>
+</Wix>