diff --git a/installer/nssm.exe b/installer/nssm.exe
new file mode 100644
index 0000000..6ccfe3c
Binary files /dev/null and b/installer/nssm.exe differ
diff --git a/installer/setup.ps1 b/installer/setup.ps1
index d32cb6f..74c34a0 100644
--- a/installer/setup.ps1
+++ b/installer/setup.ps1
@@ -32,6 +32,10 @@ function Invoke-Native {
 function Invoke-NativeSoft {
   param([string]$File, [string[]]$Arguments)
   Write-Log ("RUN(soft): {0} {1}" -f $File, ($Arguments -join " "))
+  # Native stderr merged via 2>&1 becomes terminating errors under
+  # ErrorActionPreference=Stop; force Continue in this scope so a benign nssm
+  # message (e.g. "service has not been started") never aborts setup.
+  $ErrorActionPreference = "Continue"
   $out = & $File @Arguments 2>&1
   if ($out) { Write-Log ("OUT: {0}" -f ($out -join "`n")) }
   Write-Log ("EXIT: {0}" -f $LASTEXITCODE)
@@ -121,8 +125,10 @@ tls: true
   Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateOnline", "1")
   Invoke-Native -File $nssm -Arguments @("set", "VantageAgent", "AppRotateBytes", "1048576")
 
-  # restart (not just start) so an upgrade picks up the new binary
-  Invoke-NativeSoft -File $nssm -Arguments @("restart", "VantageAgent")
+  # Service is freshly (re)installed and stopped here (teardown removed the old
+  # one on upgrade), so start it. "restart" would try to stop a not-running
+  # service and emit a stderr error.
+  Invoke-NativeSoft -File $nssm -Arguments @("start", "VantageAgent")
 
   Write-Log "=== setup ok ==="
   exit 0