diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
new file mode 100644
index 0000000..4390d64
--- /dev/null
+++ b/.github/workflows/build-windows.yml
@@ -0,0 +1,53 @@
+# Phase 1: build unsigned Windows installers on demand, upload as run artifacts.
+#
+# To graduate to Phase 2 (signed + published to GCS):
+#   1. Add GCP auth step (`google-github-actions/auth@v2` via WIF) + `setup-gcloud`.
+#      Swap `yarn make:win` for a new `yarn release:win` script that runs
+#      `electron-forge publish` per arch and a gsutil cache-control step.
+#   2. Add an Azure Trusted Signing setup step that downloads the
+#      Microsoft.Trusted.Signing.Client dlib and writes a metadata JSON file,
+#      then exports AZURE_DLIB_PATH + AZURE_METADATA_JSON_PATH. Set
+#      AZURE_TENANT_ID / AZURE_CLIENT_ID / AZURE_CLIENT_SECRET from secrets.
+#      The dormant `windowsSign` branch in js/forge.config.ts activates
+#      automatically once AZURE_METADATA_JSON_PATH is set.
+
+name: Build Windows
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: windows-latest
+    defaults:
+      run:
+        working-directory: js
+    env:
+      APP_ENV: prod
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Enable corepack
+        run: corepack enable
+        shell: pwsh
+        working-directory: .
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: yarn
+          cache-dependency-path: js/yarn.lock
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile --network-timeout 600000
+
+      - name: Build Windows installers (x64 + arm64, unsigned)
+        run: yarn make:win
+
+      - name: Upload installers
+        uses: actions/upload-artifact@v4
+        with:
+          name: flowy-llink-windows-unsigned
+          path: js/out/make/**/*
+          if-no-files-found: error
diff --git a/js/forge.config.ts b/js/forge.config.ts
index c38cb49..06d32e4 100644
--- a/js/forge.config.ts
+++ b/js/forge.config.ts
@@ -41,7 +41,20 @@ const config: ForgeConfig = {
   rebuildConfig: {},
   makers: [
     new MakerSquirrel((arch) => ({
-      remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`
+      remoteReleases: `https://storage.googleapis.com/flowy-releases/llink/win32/${arch}`,
+      // Windows code signing via Azure Trusted Signing. Dormant unless the workflow
+      // provisions the dlib + metadata file and exports these env vars, so local
+      // `yarn make` and unsigned CI builds both work unchanged.
+      windowsSign: process.env.AZURE_METADATA_JSON_PATH ? {
+        signWithParams: [
+          '/v',
+          '/fd', 'SHA256',
+          '/tr', 'http://timestamp.acs.microsoft.com',
+          '/td', 'SHA256',
+          '/dlib', process.env.AZURE_DLIB_PATH,
+          '/dmdf', process.env.AZURE_METADATA_JSON_PATH,
+        ].join(' '),
+      } : undefined,
     })),
     new MakerZIP((arch) => ({
       macUpdateManifestBaseUrl: `https://storage.googleapis.com/flowy-releases/llink/darwin/${arch}`
diff --git a/js/package.json b/js/package.json
index b903f79..c845ee0 100644
--- a/js/package.json
+++ b/js/package.json
@@ -9,6 +9,7 @@
     "start": "electron-forge start",
     "package": "APP_ENV=prod electron-forge package --arch=arm64 && APP_ENV=prod electron-forge package --arch=x64",
     "make": "APP_ENV=prod electron-forge make --arch=arm64 && APP_ENV=prod electron-forge make --arch=x64",
+    "make:win": "electron-forge make --platform=win32 --arch=x64 && electron-forge make --platform=win32 --arch=arm64",
     "release": "echo '\n⚠️  Have you bumped the version in package.json? (current: '$(node -p \"require('./package.json').version\")') [y/N]' && read -r answer && [ \"$answer\" = \"y\" ] && APP_ENV=prod electron-forge publish --arch=arm64 && APP_ENV=prod electron-forge publish --arch=x64 && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/arm64/RELEASES.json && gsutil setmeta -h 'Cache-Control:no-cache, no-store, must-revalidate' gs://flowy-releases/llink/darwin/x64/RELEASES.json",
     "invalidate-gcs-cache": "gsutil -h \"Cache-Control:no-cache, no-store, max-age=0\" cp gs://flowy-releases/llink/darwin/arm64/RELEASES.json gs://flowy-releases/llink/darwin/arm64/RELEASES.json ; gsutil -h \"Cache-Control:no-cache, no-store, max-age=0\" cp gs://flowy-releases/llink/darwin/x64/RELEASES.json gs://flowy-releases/llink/darwin/x64/RELEASES.json",
     "lint": "eslint --ext .ts,.tsx .",