diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 537366b..029be90 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -404,7 +404,6 @@ jobs:
         run: |
           npm install
           cargo build -p ostp-tun-helper --release --target ${{ matrix.target }}
-          node stage-sidecar.js --release --target ${{ matrix.target }}
           npx tauri build --no-bundle --target ${{ matrix.target }}
 
       - name: Package Portable ZIP
@@ -421,9 +420,15 @@ jobs:
       # The installer is what removes the per-connect consent prompt: it runs
       # elevated, so its hook can register the helper's Scheduled Task once.
       # The portable zip above cannot, and falls back to asking on first connect.
+      # The sidecar and its config are confined to this step: declaring
+      # externalBin in an auto-merged tauri.windows.conf.json would force every
+      # Windows build, down to a bare `cargo check`, to have the helper staged
+      # first, and fail the build script when it is not.
       - name: Build NSIS Installer
         working-directory: ostp-gui
-        run: npx tauri build --bundles nsis --target ${{ matrix.target }}
+        run: |
+          node stage-sidecar.js --release --target ${{ matrix.target }}
+          npx tauri build --bundles nsis --target ${{ matrix.target }} --config src-tauri/tauri.installer.conf.json
 
       - name: Collect installer
         shell: pwsh
diff --git a/ostp-gui/package.json b/ostp-gui/package.json
index e1b9a1e..2b61daa 100644
--- a/ostp-gui/package.json
+++ b/ostp-gui/package.json
@@ -5,9 +5,9 @@
   "type": "module",
   "scripts": {
     "tauri": "tauri",
-    "dev": "cargo build -p ostp-tun-helper && node stage-sidecar.js && npx tauri dev",
-    "build": "cargo build -p ostp-tun-helper --release && node stage-sidecar.js --release && npx tauri build --no-bundle",
-    "build:installer": "cargo build -p ostp-tun-helper --release && node stage-sidecar.js --release && npx tauri build --bundles nsis",
+    "dev": "cargo build -p ostp-tun-helper && npx tauri dev",
+    "build": "cargo build -p ostp-tun-helper --release && npx tauri build --no-bundle",
+    "build:installer": "cargo build -p ostp-tun-helper --release && node stage-sidecar.js --release && npx tauri build --bundles nsis --config src-tauri/tauri.installer.conf.json",
     "build:dist": "npm run build && node build_dist.js",
     "sidecar": "node stage-sidecar.js"
   },
diff --git a/ostp-gui/src-tauri/tauri.windows.conf.json b/ostp-gui/src-tauri/tauri.installer.conf.json
similarity index 100%
rename from ostp-gui/src-tauri/tauri.windows.conf.json
rename to ostp-gui/src-tauri/tauri.installer.conf.json
diff --git a/ostp-gui/stage-sidecar.js b/ostp-gui/stage-sidecar.js
index 4b9959d..4adb5a7 100644
--- a/ostp-gui/stage-sidecar.js
+++ b/ostp-gui/stage-sidecar.js
@@ -1,13 +1,16 @@
 // Stages ostp-tun-helper where Tauri expects a sidecar.
 //
-// tauri.windows.conf.json declares `externalBin: ["binaries/ostp-tun-helper"]`,
+// tauri.installer.conf.json declares `externalBin: ["binaries/ostp-tun-helper"]`,
 // and Tauri resolves that to `binaries/ostp-tun-helper-<target-triple>.exe` at
 // build time, failing the build outright when the file is absent. Cargo writes
-// the plain name instead, so every Windows build — dev, portable zip and
-// installer alike — has to copy it across first.
+// the plain name instead, so it has to be copied across first.
 //
-// A no-op off Windows: externalBin lives in the Windows-only config, so the
-// Linux and macOS GUI builds neither need nor have a helper sidecar.
+// Only the installer build needs this. That config is passed explicitly with
+// --config rather than being named tauri.windows.conf.json, which Tauri would
+// merge into every Windows build automatically — and then even a bare
+// `cargo check` would fail on the missing sidecar.
+//
+// A no-op off Windows: the Linux and macOS GUI builds have no helper sidecar.
 
 const fs = require('fs');
 const path = require('path');