diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 611b51b..40bb862 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -66,7 +66,28 @@ jobs:
       - name: Build
         shell: bash
         run: GOBLIN_BUILD="${TAG#build}" cargo build --release
-      - name: Package
+      - name: Build MSI installer (cargo-wix / WiX 3 — same packaging as GRIM)
+        shell: pwsh
+        run: |
+          # The .msi is built from wix/main.wxs (the cargo-wix default template:
+          # WixUI_Minimal + launch-after-install), so `cargo wix` wires up the
+          # WixUI/WixUtil extensions, cultures and CargoTargetBinDir for us. The
+          # installer + shortcuts + Add/Remove-Programs entry carry wix/Product.ico
+          # (the yellow Goblin icon). --no-build reuses the release exe above so the
+          # embedded GOBLIN_BUILD number is preserved.
+          cargo install cargo-wix --locked
+          $wix = Get-ChildItem 'C:\Program Files (x86)' -Directory -Filter 'WiX Toolset v3*' -ErrorAction SilentlyContinue | Select-Object -Last 1
+          if (-not $wix) {
+            choco install wixtoolset --no-progress -y | Out-Null
+            $wix = Get-ChildItem 'C:\Program Files (x86)' -Directory -Filter 'WiX Toolset v3*' | Select-Object -Last 1
+          }
+          $env:WIX = "$($wix.FullName)\"
+          $env:PATH = "$($wix.FullName)\bin;$env:PATH"
+          $msi = "goblin-$env:TAG-win-x86_64.msi"
+          cargo wix --no-build --nocapture -o "$msi"
+          if ($LASTEXITCODE -ne 0 -or -not (Test-Path "$msi")) { throw "cargo wix failed to produce $msi" }
+          (Get-FileHash "$msi" -Algorithm SHA256).Hash.ToLower() + "  $msi" | Out-File -Encoding ascii "goblin-$env:TAG-win-x86_64-msi-sha256sum.txt"
+      - name: Package portable zip
         shell: bash
         run: |
           7z a "goblin-$TAG-win-x86_64.zip" ./target/release/goblin.exe
@@ -75,6 +96,8 @@ jobs:
         with:
           tag_name: ${{ inputs.tag || github.event.release.tag_name }}
           files: |
+            goblin-${{ inputs.tag || github.event.release.tag_name }}-win-x86_64.msi
+            goblin-${{ inputs.tag || github.event.release.tag_name }}-win-x86_64-msi-sha256sum.txt
             goblin-${{ inputs.tag || github.event.release.tag_name }}-win-x86_64.zip
             goblin-${{ inputs.tag || github.event.release.tag_name }}-win-x86_64-sha256sum.txt