diff --git a/.gitea/workflows/build-windows.yml b/.gitea/workflows/build-windows.yml
new file mode 100644
index 0000000..a5e0420
--- /dev/null
+++ b/.gitea/workflows/build-windows.yml
@@ -0,0 +1,80 @@
+name: Build Windows
+
+# Windows-only build. Runs on the self-hosted org runner labelled
+# "windows-latest". Produces dist/macropad.exe as a build artifact, and on a
+# version tag (v*) creates/updates a Gitea release and attaches the exe.
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  build-windows:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        shell: pwsh
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          pip install pyinstaller
+
+      - name: Build Windows executable
+        shell: pwsh
+        run: pyinstaller --noconfirm macropad.spec
+
+      - name: Verify build output
+        shell: pwsh
+        run: |
+          if (-not (Test-Path dist/macropad.exe)) {
+            throw "Build failed: dist/macropad.exe not found"
+          }
+          Get-Item dist/macropad.exe | Format-List Name, Length, LastWriteTime
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: macropad-windows
+          path: dist/macropad.exe
+          if-no-files-found: error
+
+      - name: Publish release asset (tags only)
+        if: startsWith(github.ref, 'refs/tags/')
+        shell: pwsh
+        env:
+          GITEA_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          $api  = $env:GITHUB_API_URL
+          $repo = $env:GITHUB_REPOSITORY
+          $tag  = $env:GITHUB_REF_NAME
+          $headers = @{ Authorization = "token $env:GITEA_TOKEN" }
+
+          # Create the release for this tag, or fetch it if it already exists.
+          $body = @{ tag_name = $tag; name = $tag; draft = $false; prerelease = $false } | ConvertTo-Json
+          try {
+            $rel = Invoke-RestMethod -Method Post -Uri "$api/repos/$repo/releases" `
+              -Headers $headers -ContentType 'application/json' -Body $body
+          } catch {
+            $rel = Invoke-RestMethod -Method Get -Uri "$api/repos/$repo/releases/tags/$tag" -Headers $headers
+          }
+
+          # Attach the executable (delete a prior asset of the same name first).
+          $existing = $rel.assets | Where-Object { $_.name -eq 'macropad.exe' }
+          if ($existing) {
+            Invoke-RestMethod -Method Delete -Headers $headers `
+              -Uri "$api/repos/$repo/releases/$($rel.id)/assets/$($existing.id)"
+          }
+          Invoke-RestMethod -Method Post -Headers $headers `
+            -Uri "$api/repos/$repo/releases/$($rel.id)/assets?name=macropad.exe" `
+            -InFile dist/macropad.exe -ContentType 'application/octet-stream'
+          Write-Host "Attached macropad.exe to release $tag"
diff --git a/macropad.spec b/macropad.spec
index 52c2283..bf2b376 100644
--- a/macropad.spec
+++ b/macropad.spec
@@ -48,6 +48,9 @@ a = Analysis(
         'netifaces',
         'websockets',
         'multipart',
+        # Relay client (imported lazily in the GUI, so declare explicitly)
+        'relay_client',
+        'aiohttp',
     ],
     hookspath=[],
     hooksconfig={},