diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 811377a..4270a66 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,6 +35,11 @@ jobs:
             goos: darwin
             goarch: arm64
             binary_name: sstart
+          - build_id: sstart-windows-amd64
+            runner: windows-latest
+            goos: windows
+            goarch: amd64
+            binary_name: sstart.exe
     runs-on: ${{ matrix.runner }}
     steps:
       - name: Checkout code
@@ -86,6 +91,7 @@ jobs:
             ./cmd/sstart
 
       - name: Prepare release archive
+        if: matrix.goos != 'windows'
         run: |
           mkdir -p release
           
@@ -115,6 +121,30 @@ jobs:
           echo "Archive contents:"
           tar -tzf "release/${ARCHIVE_NAME}.tar.gz" | head -10
 
+      # Windows ships a .zip instead of a .tar.gz: it is what Windows users
+      # expect, and Compress-Archive is guaranteed present on the runner
+      # image, unlike zip(1). The publish job already collects *.zip.
+      - name: Prepare release archive (Windows)
+        if: matrix.goos == 'windows'
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          New-Item -ItemType Directory -Force -Path release | Out-Null
+
+          $archiveName = "sstart-${{ steps.version.outputs.version }}-${{ matrix.goos }}-${{ matrix.goarch }}"
+          $stageDir = (New-Item -ItemType Directory -Force -Path (Join-Path $env:RUNNER_TEMP $archiveName)).FullName
+
+          Copy-Item "${{ matrix.binary_name }}" -Destination $stageDir
+          Copy-Item LICENSE, README.md -Destination $stageDir -ErrorAction SilentlyContinue
+
+          Write-Host "Archive contents:"
+          Get-ChildItem $stageDir | ForEach-Object { Write-Host "  $($_.Name)" }
+
+          # Archive the staged contents, not the folder itself, so the binary
+          # sits at the archive root like it does in the tar.gz builds
+          Compress-Archive -Path (Join-Path $stageDir '*') -DestinationPath "release/$archiveName.zip" -Force
+          Remove-Item $stageDir -Recurse -Force
+
       - name: Upload build artifacts
         uses: actions/upload-artifact@v7
         with:
@@ -179,7 +209,7 @@ jobs:
             Release ${{ steps.version.outputs.version }}
             
             ## Assets
-            - Pre-built binaries for Linux (amd64, arm64) and macOS (amd64, arm64)
+            - Pre-built binaries for Linux (amd64, arm64), macOS (amd64, arm64), and Windows (amd64)
             - Checksums file for verification
           files: release/*
           draft: false
diff --git a/README.md b/README.md
index f2915d9..bd0faa9 100644
--- a/README.md
+++ b/README.md
@@ -29,28 +29,33 @@ You define all your required secrets from all your sources in a single, declarat
 
 ### Install from GitHub Releases (Recommended)
 
-Download the pre-built binary for your platform from the [latest release](https://github.com/dirathea/sstart/releases/latest):
+Download the pre-built binary for your platform from the [latest release](https://github.com/securestart/sstart/releases/latest).
 
-**Linux (amd64):**
-```bash
-curl -L https://github.com/dirathea/sstart/releases/latest/download/sstart_Linux_x86_64.tar.gz | tar -xz
-sudo mv sstart /usr/local/bin/
-```
+Release assets are named `sstart-<version>-<os>-<arch>.tar.gz` (`.zip` on Windows), so the
+version is part of the filename. Resolve the latest tag first, then download:
 
-**macOS (amd64):**
+**Linux and macOS:**
 ```bash
-curl -L https://github.com/dirathea/sstart/releases/latest/download/sstart_Darwin_x86_64.tar.gz | tar -xz
+VERSION=$(curl -s https://api.github.com/repos/securestart/sstart/releases/latest | sed -n 's/.*"tag_name": *"v\{0,1\}\([^"]*\)".*/\1/p' | head -1)
+OS=$(uname -s | tr '[:upper:]' '[:lower:]')          # linux | darwin
+ARCH=$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')  # amd64 | arm64
+
+curl -L "https://github.com/securestart/sstart/releases/download/v${VERSION}/sstart-${VERSION}-${OS}-${ARCH}.tar.gz" | tar -xz
 sudo mv sstart /usr/local/bin/
 ```
 
-**macOS (Apple Silicon/arm64):**
-```bash
-curl -L https://github.com/dirathea/sstart/releases/latest/download/sstart_Darwin_arm64.tar.gz | tar -xz
-sudo mv sstart /usr/local/bin/
+Supported combinations: `linux-amd64`, `linux-arm64`, `darwin-amd64`, `darwin-arm64`.
+
+**Windows (amd64), PowerShell:**
+```powershell
+$version = (Invoke-RestMethod https://api.github.com/repos/securestart/sstart/releases/latest).tag_name.TrimStart('v')
+Invoke-WebRequest "https://github.com/securestart/sstart/releases/download/v$version/sstart-$version-windows-amd64.zip" -OutFile sstart.zip
+Expand-Archive sstart.zip -DestinationPath .
+# then move sstart.exe somewhere on your PATH
 ```
 
 **Using a specific version:**
-Replace `latest` with a version tag (e.g., `v1.0.0`) in the URLs above.
+Set `VERSION` (or `$version`) to the release you want, e.g. `0.0.11`, instead of querying the API.
 
 ### Install via Go