diff --git a/.github/workflows/windows-build.yml b/.github/workflows/windows-build.yml
index ea00c469..641eeddc 100644
--- a/.github/workflows/windows-build.yml
+++ b/.github/workflows/windows-build.yml
@@ -2,125 +2,230 @@ name: Windows Build
 
 on:
   push:
+    branches:
+      - master
   pull_request:
+    branches:
+      - master
 
 jobs:
-  build:
+  windows_build:
     runs-on: windows-2019
+
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
+      artifact-metadata: write
+
     strategy:
-      fail-fast: false
       matrix:
         platform: [x64, win32]
+        arch: [x64, x86]
+        exclude:
+          - platform: x64
+            arch: x86
+          - platform: win32
+            arch: x64
+      fail-fast: false
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - uses: actions/checkout@v4
 
-      - name: Setup Python (for gen + embedded)
-        uses: actions/setup-python@v5
+      - uses: actions/setup-python@v5
         with:
           python-version: "3.14.2"
-          architecture: ${{ matrix.platform == 'win32' && 'x86' || 'x64' }}
+          architecture: ${{ matrix.arch }}
 
-      - name: Install GTK bundle
-        shell: pwsh
+      - name: Install Dependencies (GTK3 toolchain + packagers)
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           $ErrorActionPreference = "Stop"
 
-          $plat = "${{ matrix.platform }}"
-          $gtkBuildRoot = "C:\gtk-build"
-          $gtkLinkRoot  = Join-Path $gtkBuildRoot "gtk"
-          $pyLinkRoot   = Join-Path $gtkBuildRoot "python-3.14"
+          New-Item -Name "deps" -ItemType "Directory" -Force | Out-Null
 
-          New-Item -ItemType Directory -Force -Path $gtkBuildRoot | Out-Null
+          # Inno Setup + IDP (kept as-is)
+          Invoke-WebRequest http://files.jrsoftware.org/is/5/innosetup-5.5.9-unicode.exe -OutFile deps\innosetup-unicode.exe
+          & deps\innosetup-unicode.exe /VERYSILENT | Out-Null
 
-          # Python junction expected by the VS projects
-          $pyActual = $env:pythonLocation
-          $pyTarget = Join-Path $pyLinkRoot $plat
-          if (Test-Path $pyTarget) { cmd /c rmdir $pyTarget | Out-Null }
-          cmd /c mklink /J "$pyTarget" "$pyActual" | Out-Null
+          Invoke-WebRequest https://github.com/zoitechat/gvsbuild/releases/download/zoitechat-2.17.0/idpsetup-1.5.1.exe -OutFile deps\idpsetup.exe
+          & deps\idpsetup.exe /VERYSILENT
 
-          if ($plat -eq "x64") {
-            # Pull latest GTK3 x64 bundle from wingtk/gvsbuild releases via GitHub API
-            $rel = Invoke-RestMethod "https://api.github.com/repos/wingtk/gvsbuild/releases/latest"
-            $asset = $rel.assets | Where-Object { $_.name -match '^GTK3_Gvsbuild_.*_x64\.zip$' } | Select-Object -First 1
-            if (-not $asset) { throw "No GTK3 x64 bundle found in latest wingtk/gvsbuild release." }
+          # WinSparkle / gendef / perl (kept as-is)
+          Invoke-WebRequest https://github.com/zoitechat/gvsbuild/releases/download/zoitechat-2.17.0/gendef-20111031.7z -OutFile deps\gendef.7z
+          & 7z.exe x deps\gendef.7z -oC:\gtk-build | Out-Null
 
-            $zip = Join-Path $env:RUNNER_TEMP $asset.name
-            Invoke-WebRequest $asset.browser_download_url -OutFile $zip
+          Invoke-WebRequest https://github.com/zoitechat/gvsbuild/releases/download/zoitechat-2.17.0/WinSparkle-20151011.7z -OutFile deps\WinSparkle.7z
+          & 7z.exe x deps\WinSparkle.7z -oC:\gtk-build\WinSparkle | Out-Null
 
-            $extract = "C:\gtk-bundle"
-            if (Test-Path $extract) { Remove-Item -Recurse -Force $extract }
-            New-Item -ItemType Directory -Force -Path $extract | Out-Null
-            Expand-Archive -Force $zip -DestinationPath $extract
+          Invoke-WebRequest https://github.com/zoitechat/gvsbuild/releases/download/zoitechat-2.17.0/perl-5.20.0-${{ matrix.arch }}.7z -OutFile deps\perl-${{ matrix.arch }}.7z
+          & 7z.exe x deps\perl-${{ matrix.arch }}.7z -oC:\gtk-build\perl-5.20\${{ matrix.platform }} | Out-Null
 
-            # Find the *release* prefix that actually contains bin/include/lib
-            $prefix = Get-ChildItem -Path $extract -Directory -Recurse |
-              Where-Object {
-                (Test-Path (Join-Path $_.FullName "bin")) -and
-                (Test-Path (Join-Path $_.FullName "include")) -and
-                (Test-Path (Join-Path $_.FullName "lib"))
-              } |
-              Where-Object { $_.FullName -match '\\x64\\release$' } |
+          # ------------------------------------------
+          # GTK: Prefer wingtk/gvsbuild GTK3 bundles.
+          # If x86 GTK3 asset is not published, fall back to legacy bundle for win32 to keep builds working.
+          # ------------------------------------------
+          $wantArch = if ("${{ matrix.platform }}" -eq "x64") { "x64" } else { "x86" }
+          $wantPlat = "${{ matrix.platform }}"
+
+          $extractRoot = "C:\_gtk_extract"
+          if (Test-Path $extractRoot) { Remove-Item $extractRoot -Recurse -Force }
+          New-Item -Path $extractRoot -ItemType Directory -Force | Out-Null
+
+          $gtkPrefix = $null
+
+          $headers = @{
+            "User-Agent" = "zoitechat-ci"
+            "Authorization" = "Bearer $env:GITHUB_TOKEN"
+            "X-GitHub-Api-Version" = "2022-11-28"
+          }
+
+          try {
+            $release = Invoke-RestMethod -Headers $headers -Uri "https://api.github.com/repos/wingtk/gvsbuild/releases/latest"
+
+            # Expect names like: GTK3_Gvsbuild_2026.1.0_x64.zip (your log shows this style)
+            $asset = $release.assets |
+              Where-Object { $_.name -match '^GTK3_Gvsbuild_.*_(x64|x86)\.zip$' -and $_.name -match "_$wantArch\.zip$" } |
               Select-Object -First 1
 
-            if (-not $prefix) {
-              # fallback: first directory containing gtk-3.0.lib
-              $lib = Get-ChildItem -Path $extract -File -Recurse -Filter "gtk-3.0.lib" | Select-Object -First 1
-              if (-not $lib) { throw "Could not locate gtk-3.0.lib inside extracted GTK bundle." }
-              $prefix = $lib.Directory.Parent
+            if (-not $asset) {
+              if ($wantArch -eq "x86") {
+                Write-Host "No GTK3 x86 asset found in wingtk/gvsbuild latest release. Falling back to legacy bundle for win32."
+              } else {
+                Write-Host "Available assets:"
+                $release.assets | ForEach-Object { Write-Host " - $($_.name)" }
+                throw "Could not find a GTK3 $wantArch release asset in wingtk/gvsbuild latest release."
+              }
             }
 
-            $depsRoot = Join-Path $gtkLinkRoot "$plat\release"
-            if (Test-Path $depsRoot) { cmd /c rmdir $depsRoot | Out-Null }
-            New-Item -ItemType Directory -Force -Path (Split-Path $depsRoot) | Out-Null
-            cmd /c mklink /J "$depsRoot" "$($prefix.FullName)" | Out-Null
+            if ($asset) {
+              $bundlePath = "deps\gtk3-$wantArch-bundle.zip"
+              Invoke-WebRequest $asset.browser_download_url -OutFile $bundlePath
+              Expand-Archive -Force $bundlePath -DestinationPath $extractRoot
 
-            # Make sure bin is on PATH for any custom tools
-            echo "$depsRoot\bin" | Out-File -FilePath $env:GITHUB_PATH -Append -Encoding utf8
+              # Find prefix by locating gtk.h under include\gtk-3.0\gtk\gtk.h
+              $candidates = Get-ChildItem -Path $extractRoot -Recurse -File -Filter "gtk.h" |
+                Where-Object { $_.FullName -match '\\include\\gtk-3\.0\\gtk\\gtk\.h$' }
 
-            # Optional compat aliases (only if something still hardcodes GTK2/OpenSSL/libxml2 names)
-            $libDir = Join-Path $depsRoot "lib"
-            if (-not (Test-Path (Join-Path $libDir "gtk-win32-2.0.lib")) -and (Test-Path (Join-Path $libDir "gtk-3.0.lib"))) {
-              Copy-Item (Join-Path $libDir "gtk-3.0.lib") (Join-Path $libDir "gtk-win32-2.0.lib")
+              # Prefer arch-looking paths if present
+              $header = $candidates | Where-Object { $_.FullName -match "\\$wantArch\\release\\include\\gtk-3\.0\\gtk\\gtk\.h$" } | Select-Object -First 1
+              if (-not $header) { $header = $candidates | Select-Object -First 1 }
+
+              if (-not $header) { throw "GTK3 bundle extracted, but gtk.h not found. Layout unexpected." }
+
+              $gtkPrefix = $header.Directory.Parent.Parent.Parent.FullName  # ...\include\gtk-3.0\gtk\gtk.h -> prefix = 3 parents up
+              if (-not (Test-Path (Join-Path $gtkPrefix "bin"))) { throw "GTK3 prefix located, but missing bin/. Layout unexpected: $gtkPrefix" }
+              if (-not (Test-Path (Join-Path $gtkPrefix "lib"))) { throw "GTK3 prefix located, but missing lib/. Layout unexpected: $gtkPrefix" }
             }
-            if (-not (Test-Path (Join-Path $libDir "gdk-win32-2.0.lib")) -and (Test-Path (Join-Path $libDir "gdk-3.0.lib"))) {
-              Copy-Item (Join-Path $libDir "gdk-3.0.lib") (Join-Path $libDir "gdk-win32-2.0.lib")
+          } catch {
+            if ($wantArch -eq "x86") {
+              Write-Host "Wingtk GTK3 discovery failed for x86. Using legacy GTK bundle for win32."
+            } else {
+              throw
             }
-            if (-not (Test-Path (Join-Path $libDir "libxml2.lib")) -and (Test-Path (Join-Path $libDir "libxml2-2.0.lib"))) {
-              Copy-Item (Join-Path $libDir "libxml2-2.0.lib") (Join-Path $libDir "libxml2.lib")
-            }
-            if (-not (Test-Path (Join-Path $libDir "ssleay32.lib")) -and (Test-Path (Join-Path $libDir "libssl.lib"))) {
-              Copy-Item (Join-Path $libDir "libssl.lib") (Join-Path $libDir "ssleay32.lib")
-            }
-            if (-not (Test-Path (Join-Path $libDir "libeay32.lib")) -and (Test-Path (Join-Path $libDir "libcrypto.lib"))) {
-              Copy-Item (Join-Path $libDir "libcrypto.lib") (Join-Path $libDir "libeay32.lib")
+          }
+
+          if (-not $gtkPrefix) {
+            # Legacy bundle path (your original, GTK2-era) to preserve win32 builds
+            Invoke-WebRequest https://github.com/zoitechat/gvsbuild/releases/download/zoitechat-2.17.0/gtk-${{ matrix.platform }}-2018-08-29-openssl1.1.7z -OutFile deps\gtk-${{ matrix.arch }}.7z
+            & 7z.exe x deps\gtk-${{ matrix.arch }}.7z -oC:\gtk-build\gtk | Out-Null
+          } else {
+            # Normalize GTK location to the path your solution already expects:
+            # C:\gtk-build\gtk\<platform>\release\...
+            $normBase = "C:\gtk-build\gtk\$wantPlat"
+            New-Item -Path $normBase -ItemType Directory -Force | Out-Null
+
+            $normRel = Join-Path $normBase "release"
+            if (Test-Path $normRel) {
+              cmd /c rmdir /s /q "$normRel" | Out-Null
             }
 
-            # Lua headers: if deps prefix doesn't ship them, copy from repo if present
-            $luaDst = Join-Path $depsRoot "include\luajit-2.1"
-            if (-not (Test-Path (Join-Path $luaDst "lua.h"))) {
-              $luaSrc = Join-Path $env:GITHUB_WORKSPACE "plugins\lua\luajit\src"
-              if (Test-Path (Join-Path $luaSrc "lua.h")) {
-                New-Item -ItemType Directory -Force -Path $luaDst | Out-Null
-                Copy-Item (Join-Path $luaSrc "*.h") $luaDst -Force
+            New-Item -Path $normRel -ItemType Junction -Value $gtkPrefix | Out-Null
+
+            $gtkBin = Join-Path $normRel "bin"
+            $gtkLib = Join-Path $normRel "lib"
+            $gtkInc = Join-Path $normRel "include"
+
+            # glib-genmarshal: vcxproj calls python.exe <path>\glib-genmarshal (no extension)
+            # Make a python wrapper named "glib-genmarshal" that dispatches to the real tool.
+            $genExe = Get-ChildItem -Path $gtkBin -File -Filter "glib-genmarshal*.exe" | Select-Object -First 1
+            if (-not $genExe) { throw "GTK3 bundle extracted, but glib-genmarshal.exe not found under $gtkBin." }
+
+            $genTarget = Join-Path $gtkBin "glib-genmarshal"
+            $wrapper = @(
+              "import os, subprocess, sys",
+              "tool = os.path.join(os.path.dirname(__file__), `"$($genExe.Name)`")",
+              "sys.exit(subprocess.call([tool] + sys.argv[1:]))"
+            )
+            $wrapper | Set-Content -Path $genTarget -Encoding ASCII
+
+            # Compatibility aliases (don’t explode if naming differs)
+            function Copy-AliasLib([string]$targetName, [string[]]$sourcePatterns) {
+              $target = Join-Path $gtkLib $targetName
+              if (Test-Path $target) { return }
+
+              $src = $null
+              foreach ($pat in $sourcePatterns) {
+                $src = Get-ChildItem -Path $gtkLib -File -Filter "*.lib" | Where-Object { $_.Name -match $pat } | Select-Object -First 1
+                if ($src) { break }
+              }
+
+              if ($src) {
+                Copy-Item $src.FullName $target -Force
+                Write-Host "Alias: $targetName <= $($src.Name)"
+              } else {
+                Write-Host "Alias not created: $targetName (no match in $gtkLib)"
+              }
+            }
+
+            # GTK2 name expected by older vcxproj
+            Copy-AliasLib "gtk-win32-2.0.lib" @(
+              '^gtk-3\.0\.lib$',
+              '^gtk-3-0\.lib$',
+              '^gtk-3\.lib$',
+              '^gtk-3.*\.lib$'
+            )
+
+            # OpenSSL legacy names
+            Copy-AliasLib "ssleay32.lib" @('^libssl\.lib$', '^ssl\.lib$')
+            Copy-AliasLib "libeay32.lib" @('^libcrypto\.lib$', '^crypto\.lib$')
+
+            # libxml2 legacy name
+            Copy-AliasLib "libxml2.lib" @('^libxml2.*\.lib$')
+
+            # Lua headers: if luajit headers exist, copy them to include\ so <lua.h> works
+            $luajitDir = Join-Path $gtkInc "luajit-2.1"
+            if (Test-Path $luajitDir) {
+              foreach ($h in @("lua.h", "lualib.h", "lauxlib.h", "luaconf.h")) {
+                $src = Join-Path $luajitDir $h
+                if (Test-Path $src) {
+                  Copy-Item $src (Join-Path $gtkInc $h) -Force
+                }
               }
             }
           }
-          else {
-            # win32: keep your existing GTK2 path/tooling here
-            # (Pin whatever you were already using for x86 builds.)
-            Write-Host "win32 build: keeping GTK2 toolchain (GTK3 x86 not available in latest wingtk/gvsbuild)."
+
+          # Resolve python root from setup-python
+          $pyRoot = $env:pythonLocation
+          if (-not $pyRoot) { $pyRoot = & python -c "import sys; print(sys.prefix)" }
+
+          # Create BOTH paths because the .vcxproj hard-codes python-3.14\...
+          foreach ($pyDir in @("C:\gtk-build\python-3.14.2", "C:\gtk-build\python-3.14")) {
+            New-Item -Path $pyDir -ItemType Directory -Force | Out-Null
+            $target = Join-Path $pyDir "${{ matrix.platform }}"
+            if (Test-Path $target) { Remove-Item $target -Recurse -Force }
+            New-Item -Path $pyDir -Name "${{ matrix.platform }}" -ItemType Junction -Value $pyRoot | Out-Null
           }
 
+          python -m pip install --upgrade pip
+          python -m pip install cffi
+
       - name: Build
-        shell: cmd
         run: |
-          setlocal enabledelayedexpansion
-
-          set "PLAT=${{ matrix.platform }}"
-          set "PYTHON_DIR=C:\gtk-build\python-3.14\%PLAT%"
+          call "C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\Common7\Tools\VsDevCmd.bat"
 
+          set "PYTHON_DIR=C:\gtk-build\python-3.14.2\${{ matrix.platform }}"
           if not exist "%PYTHON_DIR%\libs\python314.lib" (
             echo Missing %PYTHON_DIR%\libs\python314.lib
             dir "%PYTHON_DIR%\libs"
@@ -130,4 +235,39 @@ jobs:
           set "LIB=%PYTHON_DIR%\libs;%LIB%"
           set "INCLUDE=%PYTHON_DIR%\include;%INCLUDE%"
 
-          msbuild win32\zoitechat.sln /m /verbosity:minimal /p:Configuration=Release /p:Platform=%PLAT%
+          msbuild win32\zoitechat.sln /m /verbosity:minimal /p:Configuration=Release /p:Platform=${{ matrix.platform }}
+        shell: cmd
+
+      - name: Preparing Artifacts
+        run: |
+          move ..\zoitechat-build\${{ matrix.platform }}\ZoiteChat*.exe .\
+          move ..\zoitechat-build .\
+        shell: cmd
+
+      - name: Upload Installer
+        id: upload_installer
+        uses: actions/upload-artifact@v4
+        with:
+          name: Installer ${{ matrix.arch }}
+          path: ZoiteChat*.exe
+
+      - name: Attest Installer (Artifact Attestation)
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: Installer ${{ matrix.arch }}
+          subject-digest: sha256:${{ steps.upload_installer.outputs.artifact-digest }}
+
+      - name: Upload Build Files
+        id: upload_buildfiles
+        uses: actions/upload-artifact@v4
+        with:
+          name: Build Files ${{ matrix.arch }}
+          path: zoitechat-build
+
+      - name: Attest Build Files (Artifact Attestation)
+        if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-name: Build Files ${{ matrix.arch }}
+          subject-digest: sha256:${{ steps.upload_buildfiles.outputs.artifact-digest }}