diff --git a/Cargo.lock b/Cargo.lock
index f11f0515..e40917fa 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1200,7 +1200,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "90dbd31c98227229239363921e60fcf5e558e43ec69094d46fc4996f08d1d5bc"
 dependencies = [
  "bitcoin_hashes 0.14.100",
- "rand 0.7.3",
+ "rand 0.8.6",
  "rand_core 0.6.4",
  "serde",
  "unicode-normalization",
@@ -4547,6 +4547,7 @@ dependencies = [
  "uuid 0.8.2",
  "wgpu",
  "winit",
+ "winresource",
 ]
 
 [[package]]
@@ -13542,6 +13543,21 @@ dependencies = [
  "winnow 0.7.14",
 ]
 
+[[package]]
+name = "toml"
+version = "1.0.6+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "399b1124a3c9e16766831c6bba21e50192572cdd98706ea114f9502509686ffc"
+dependencies = [
+ "indexmap 2.13.0",
+ "serde_core",
+ "serde_spanned 1.0.4",
+ "toml_datetime 1.1.1+spec-1.1.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 0.7.14",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.6.11"
@@ -13560,6 +13576,15 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "toml_datetime"
+version = "1.1.1+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3165f65f62e28e0115a00b2ebdd37eb6f3b641855f9d636d3cd4103767159ad7"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "toml_edit"
 version = "0.22.27"
@@ -15534,6 +15559,16 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "winresource"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0986a8b1d586b7d3e4fe3d9ea39fb451ae22869dcea4aa109d287a374d866087"
+dependencies = [
+ "toml 1.0.6+spec-1.1.0",
+ "version_check",
+]
+
 [[package]]
 name = "wit-bindgen"
 version = "0.51.0"
diff --git a/Cargo.toml b/Cargo.toml
index f57e2882..264dd6b1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -171,6 +171,12 @@ eframe = { version = "0.33.2", default-features = false, features = ["glow", "an
 [build-dependencies]
 built = "0.8.0"
 
+# Windows hosts only: embed the Goblin icon (wix/Product.ico) into goblin.exe via
+# build.rs. Not compiled on Linux/macOS/Android hosts, so other builds are
+# unaffected.
+[target.'cfg(windows)'.build-dependencies]
+winresource = "0.1"
+
 [dev-dependencies]
 nostr-sdk = { version = "0.44", features = ["nip06", "nip44", "nip49", "nip59", "nip98"] }
 tokio = { version = "1.49.0", features = ["full"] }
diff --git a/build.rs b/build.rs
index 8b12eef0..3ec3e0fb 100644
--- a/build.rs
+++ b/build.rs
@@ -59,4 +59,30 @@ fn main() {
 	// Goblin links the Nym mixnet SDK in-process (see src/nym/) — no sidecar
 	// subprocess, no bundled/embedded helper binary, and no Tor/webtunnel. There
 	// is nothing transport-related to build or embed here.
+
+	// Embed the Goblin icon into goblin.exe so Explorer, the taskbar and Alt-Tab
+	// show it even for the bare exe (the .msi shortcuts already carry it). No-op
+	// on every non-Windows platform.
+	embed_windows_icon();
 }
+
+/// Embed `wix/Product.ico` (the yellow Goblin icon) as goblin.exe's application
+/// icon resource. Gated to Windows hosts — that's where the `winresource`
+/// build-dependency is compiled and where the MSVC resource compiler (`rc.exe`,
+/// shipped on the windows-latest runner) is available; our Windows builds are
+/// always native MSVC, so host == target == windows.
+#[cfg(windows)]
+fn embed_windows_icon() {
+	if env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
+		return;
+	}
+	let mut res = winresource::WindowsResource::new();
+	res.set_icon("wix/Product.ico");
+	if let Err(e) = res.compile() {
+		// Don't fail the build over the icon — just flag it.
+		println!("cargo:warning=winresource icon embed failed: {e}");
+	}
+}
+
+#[cfg(not(windows))]
+fn embed_windows_icon() {}