diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
new file mode 100644
index 0000000..7b6f17d
--- /dev/null
+++ b/.github/workflows/installer.yml
@@ -0,0 +1,60 @@
+name: Installer
+
+# Builds the Windows installer from a tag or branch on a GitHub-hosted runner and keeps it as a
+# workflow artifact. Started by hand for now; it publishes nothing. Code signing through the
+# SignPath Foundation needs exactly this: every job up to the signing request on GitHub-hosted
+# runners, and the unsigned file stored as a workflow artifact first (docs/code-signing-policy.md).
+# The self-hosted runners of ADR 0022 are therefore not used here.
+
+on:
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Tag or branch to build
+        type: string
+        default: main
+
+permissions:
+  contents: read
+
+concurrency:
+  group: installer-${{ inputs.ref }}
+  cancel-in-progress: false
+
+jobs:
+  windows:
+    name: Windows installer
+    runs-on: windows-2025
+    timeout-minutes: 30
+    steps:
+      - name: Check out
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ inputs.ref }}
+          lfs: true
+          persist-credentials: false
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+
+      - name: Set up Node.js
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version-file: .node-version
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build the installer
+        run: pnpm --filter @partbuddy/desktop dist
+
+      - name: Keep the installer
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: partbuddy-installer-windows
+          path: |
+            apps/desktop/dist/PartBuddy-Setup-*.exe
+            apps/desktop/dist/PartBuddy-Setup-*.exe.blockmap
+            apps/desktop/dist/latest.yml
+          if-no-files-found: error
+          retention-days: 14