diff --git a/.gitea/workflows/agent-release.yml b/.gitea/workflows/agent-release.yml
index 6b48b9f..06eb1cc 100644
--- a/.gitea/workflows/agent-release.yml
+++ b/.gitea/workflows/agent-release.yml
@@ -53,3 +53,49 @@ jobs:
                       agent/dist/vantage-agent-linux-arm64
                       agent/dist/vantage-agent-windows-amd64.exe
                       agent/dist/checksums.txt
+
+    msi:
+        needs: build
+        runs-on: ubuntu-docker
+        container: mcr.microsoft.com/dotnet/sdk:9.0
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v4
+
+            - name: Set up Go
+              uses: actions/setup-go@v5
+              with:
+                  go-version: "1.26"
+                  cache: true
+                  cache-dependency-path: agent/go.sum
+
+            - name: Build agent exe
+              working-directory: agent
+              run: |
+                  GOOS=windows GOARCH=amd64 go build \
+                    -o ../installer/vantage-agent-windows-amd64.exe ./cmd
+
+            - name: Fetch nssm
+              working-directory: installer
+              run: |
+                  apt-get update && apt-get install -y unzip curl
+                  curl -fsSL -o nssm.zip https://nssm.cc/release/nssm-2.24.zip
+                  unzip -j nssm.zip 'nssm-2.24/win64/nssm.exe' -d .
+
+            - name: Install WiX
+              run: dotnet tool install --global wix --version 5.*
+
+            - name: Build MSI
+              working-directory: installer
+              run: |
+                  export PATH="$PATH:/root/.dotnet/tools"
+                  wix build vantage-agent.wxs -o vantage-agent.msi
+                  sha256sum vantage-agent.msi > checksums-msi.txt
+
+            - name: Attach MSI to release
+              uses: https://gitea.com/actions/gitea-release-action@v1
+              with:
+                  token: ${{ secrets.RELEASE_TOKEN }}
+                  files: |
+                      installer/vantage-agent.msi
+                      installer/checksums-msi.txt
diff --git a/.gitignore b/.gitignore
index 7056799..c50d078 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,10 @@
 node_modules
 dist
 build
-.env
\ No newline at end of file
+.env
+docs
+.superpowers
+installer/*.exe
+installer/*.msi
+installer/nssm.zip
+installer/checksums-msi.txt
\ No newline at end of file
diff --git a/installer/setup.ps1 b/installer/setup.ps1
new file mode 100644
index 0000000..e7449d4
--- /dev/null
+++ b/installer/setup.ps1
@@ -0,0 +1,25 @@
+param(
+  [string]$ServerId,
+  [string]$Token,
+  [string]$ServerUrl,
+  [string]$InstallDir
+)
+$cfgDir = Join-Path $env:ProgramData "vantage"
+New-Item -ItemType Directory -Force -Path $cfgDir | Out-Null
+$cfg = @"
+server_url: "$ServerUrl"
+server_id: "$ServerId"
+pre_reg_token: "$Token"
+agent_token: ""
+poll_interval: 30s
+tls: true
+"@
+Set-Content -Path (Join-Path $cfgDir "config.yaml") -Value $cfg -Encoding utf8
+# Lock down ACL: SYSTEM + Administrators only
+icacls (Join-Path $cfgDir "config.yaml") /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" | Out-Null
+
+$nssm = Join-Path $InstallDir "nssm.exe"
+$exe  = Join-Path $InstallDir "vantage-agent.exe"
+& $nssm install VantageAgent $exe
+& $nssm set VantageAgent Start SERVICE_AUTO_START
+& $nssm start VantageAgent
diff --git a/installer/vantage-agent.wxs b/installer/vantage-agent.wxs
new file mode 100644
index 0000000..9e012b8
--- /dev/null
+++ b/installer/vantage-agent.wxs
@@ -0,0 +1,44 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+  <Package Name="Vantage Agent" Manufacturer="Vantage"
+           Version="1.0.0.0" UpgradeCode="7d1e6d2c-2a5f-4b3e-9c3a-8a1b2c3d4e5f"
+           Scope="perMachine">
+    <MajorUpgrade DowngradeErrorMessage="A newer version is already installed." />
+    <MediaTemplate EmbedCab="yes" />
+
+    <!-- Public properties settable via msiexec: SERVERID, TOKEN, SERVERURL -->
+    <Property Id="SERVERID" Secure="yes" />
+    <Property Id="TOKEN" Secure="yes" />
+    <Property Id="SERVERURL" Secure="yes" />
+
+    <StandardDirectory Id="ProgramFiles64Folder">
+      <Directory Id="INSTALLDIR" Name="Vantage">
+        <Component Id="AgentExe" Guid="*">
+          <File Id="AgentExe" Source="vantage-agent-windows-amd64.exe" Name="vantage-agent.exe" KeyPath="yes" />
+        </Component>
+        <Component Id="NssmExe" Guid="*">
+          <File Id="NssmExe" Source="nssm.exe" Name="nssm.exe" KeyPath="yes" />
+        </Component>
+        <Component Id="SetupScript" Guid="*">
+          <File Id="SetupScript" Source="setup.ps1" Name="setup.ps1" KeyPath="yes" />
+        </Component>
+      </Directory>
+    </StandardDirectory>
+
+    <Feature Id="Main">
+      <ComponentRef Id="AgentExe" />
+      <ComponentRef Id="NssmExe" />
+      <ComponentRef Id="SetupScript" />
+    </Feature>
+
+    <!-- Write config.yaml, then install + start the service via nssm.
+         Implemented as sequenced CustomActions running a helper script. -->
+    <CustomAction Id="WriteConfig" Directory="INSTALLDIR"
+      ExeCommand='cmd.exe /c powershell -ExecutionPolicy Bypass -File "[INSTALLDIR]setup.ps1" -ServerId "[SERVERID]" -Token "[TOKEN]" -ServerUrl "[SERVERURL]" -InstallDir "[INSTALLDIR]"'
+      Execute="deferred" Impersonate="no" Return="check" />
+
+    <InstallExecuteSequence>
+      <Custom Action="WriteConfig" After="InstallFiles" Condition="NOT Installed" />
+    </InstallExecuteSequence>
+  </Package>
+</Wix>