diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cfe3563bb2..27096a3ff9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,8 +38,8 @@ jobs:
       - run: yarn install --immutable
       - run: yarn check
 
-  # Windows-only logic on a real Windows runner: packaging tests, updates,
-  # window options, pwsh sandbox, and volume diagnostics.
+  # Windows-only logic and an unsigned NSIS build on a real Windows runner:
+  # updates, window options, pwsh sandbox, volume diagnostics, and packaging.
   desktop-windows:
     runs-on: windows-latest
     steps:
@@ -59,7 +59,7 @@ jobs:
           path: ${{ steps.yarn-cache.outputs.dir }}
           key: yarn-${{ runner.os }}-${{ hashFiles('yarn.lock') }}
       - run: yarn install --immutable
-      - run: yarn workspace dsh-plugin-desktop check:win-package
+      - run: yarn workspace dsh-plugin-desktop dist:win
 
   # Upstream toolchain smoke: the portable-shell scripts must resolve the
   # pinned submodule's own Yarn/pnpm release on Windows.
diff --git a/dsh-plugin-desktop/package.json b/dsh-plugin-desktop/package.json
index 7573baa49b..3ddfd1de2a 100644
--- a/dsh-plugin-desktop/package.json
+++ b/dsh-plugin-desktop/package.json
@@ -98,7 +98,7 @@
     "verify:licenses": "node scripts/verify-licenses.mjs",
     "verify:notices": "node scripts/verify-licenses.mjs --notices THIRD_PARTY_NOTICES.md",
     "check": "yarn run build && yarn run typecheck && yarn run test && yarn run verify:closure && yarn run verify:cli && yarn run verify:loader && yarn run verify:profile && yarn run verify:licenses",
-    "check:win-package": "yarn run build && yarn run typecheck && vitest run tests/package.spec.ts tests/package-win.spec.ts tests/update-checker.spec.ts tests/update-download.spec.ts tests/verify-win-installer.spec.ts tests/verify-packaged-runtime.spec.ts tests/windows-pwsh-sandbox.spec.ts tests/window-options.spec.ts && yarn run verify:closure",
+    "check:win-package": "yarn run build && yarn run typecheck && vitest run tests/package.spec.ts tests/package-win.spec.ts tests/update-checker.spec.ts tests/update-download.spec.ts tests/verify-win-installer.spec.ts tests/verify-packaged-runtime.spec.ts tests/windows-pwsh-sandbox.spec.ts tests/windows-volume-diagnostics.spec.ts tests/window-options.spec.ts && yarn run verify:closure",
     "start": "node lib/bin.js",
     "dev": "yarn run build && node lib/bin.js",
     "package:dir": "yarn run build && node scripts/package-dir.mjs",
@@ -233,7 +233,6 @@
   "build": {
     "appId": "ai.deepseek.dsh.desktop",
     "productName": "DSH Desktop",
-    "license": "THIRD_PARTY_NOTICES.md",
     "asar": true,
     "asarUnpack": [
       "package.json",
@@ -280,6 +279,7 @@
       "icon": "build/app-icon.png"
     },
     "nsis": {
+      "license": "THIRD_PARTY_NOTICES.md",
       "oneClick": false,
       "perMachine": false,
       "allowElevation": true,
diff --git a/dsh-plugin-desktop/tests/package.spec.ts b/dsh-plugin-desktop/tests/package.spec.ts
index 32fb8ebd1a..3bb20aaf47 100644
--- a/dsh-plugin-desktop/tests/package.spec.ts
+++ b/dsh-plugin-desktop/tests/package.spec.ts
@@ -167,6 +167,7 @@ describe('published package surface', () => {
       arch: ['x64'],
     }])
     expect(manifest.build?.nsis).toEqual({
+      license: 'THIRD_PARTY_NOTICES.md',
       oneClick: false,
       perMachine: false,
       allowElevation: true,
@@ -194,6 +195,7 @@ describe('published package surface', () => {
     expect(manifest.scripts?.['check:win-package']).toContain('tests/package-win.spec.ts')
     expect(manifest.scripts?.['check:win-package']).toContain('tests/update-checker.spec.ts')
     expect(manifest.scripts?.['check:win-package']).toContain('tests/update-download.spec.ts')
+    expect(manifest.scripts?.['check:win-package']).toContain('tests/windows-volume-diagnostics.spec.ts')
     expect(manifest.scripts?.['check:win-package']).toContain('yarn run verify:closure')
     expect(manifest.scripts?.['verify:cli']).toBe('node scripts/verify-cli-runtime.mjs')
     expect(manifest.scripts?.check).toContain('yarn run verify:cli')
diff --git a/dsh-plugin-desktop/tests/update-download.spec.ts b/dsh-plugin-desktop/tests/update-download.spec.ts
index be5a76b631..9edc6454f4 100644
--- a/dsh-plugin-desktop/tests/update-download.spec.ts
+++ b/dsh-plugin-desktop/tests/update-download.spec.ts
@@ -252,11 +252,11 @@ describe('desktop update installer download', () => {
     expect(requested).toBe(false)
   })
 
-  it.skipIf(process.platform === 'win32')('rejects a symlink user-data path before requesting', async () => {
+  it('rejects a linked user-data path before requesting', async () => {
     const userDataPath = await temporaryUserData()
     const linked = `${userDataPath}-link`
     temporaryRoots.push(linked)
-    await symlink(userDataPath, linked, 'dir')
+    await symlink(userDataPath, linked, process.platform === 'win32' ? 'junction' : 'dir')
     let requested = false
     const request = async (): Promise<Response> => {
       requested = true
diff --git a/dsh-plugin-desktop/tests/windows-volume-diagnostics.spec.ts b/dsh-plugin-desktop/tests/windows-volume-diagnostics.spec.ts
index f385b7beea..6f696aec1a 100644
--- a/dsh-plugin-desktop/tests/windows-volume-diagnostics.spec.ts
+++ b/dsh-plugin-desktop/tests/windows-volume-diagnostics.spec.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
   diagnoseWindowsVolumes,
   formatWindowsVolumeConcern,
+  windowsVolumeQuery,
   type WindowsVolumeInfo,
 } from '../src/windows-volume-diagnostics.ts'
 
@@ -10,6 +11,14 @@ function query(info: WindowsVolumeInfo) {
 }
 
 describe('Windows volume diagnostics', () => {
+  it.runIf(process.platform === 'win32')('queries the host volume through Windows APIs', () => {
+    const info = windowsVolumeQuery()(process.cwd())
+
+    expect(info.root).toMatch(/^[A-Z]:\\$/iu)
+    expect(info.fileSystem.length).toBeGreaterThan(0)
+    expect(info.driveType).toBeGreaterThan(0)
+  })
+
   it('skips non-Windows hosts without touching the query', () => {
     const result = diagnoseWindowsVolumes('darwin', [{ label: 'DSH home', path: '/Users/a/.dsh' }], () => {
       throw new Error('should not run')