diff --git a/.goreleaser.yml b/.goreleaser.yml
index a485ed5..46972c4 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -10,7 +10,7 @@ builds:
     env:
       - CGO_ENABLED=0
     binary: OliveTin
-    main: main.go
+    main: .
     dir: service
     goos:
       - linux
diff --git a/var/windows/OliveTin.wxs b/var/windows/OliveTin.wxs
index 7884d8a..ebb8345 100644
--- a/var/windows/OliveTin.wxs
+++ b/var/windows/OliveTin.wxs
@@ -17,7 +17,7 @@
     <MajorUpgrade
       AllowSameVersionUpgrades="yes"
       DowngradeErrorMessage="A newer version of OliveTin is already installed." />
-    <MediaTemplate />
+    <MediaTemplate EmbedCab="yes" />
 
     <Feature Id="ProductFeature" Title="OliveTin" Level="1">
       <ComponentGroupRef Id="CG.AppFiles" />
diff --git a/var/windows/build-msi.sh b/var/windows/build-msi.sh
index 2efca19..b1eb6fe 100755
--- a/var/windows/build-msi.sh
+++ b/var/windows/build-msi.sh
@@ -63,6 +63,15 @@ if [[ ! -f "${SOURCE_ROOT}/config.yaml" ]]; then
   exit 1
 fi
 
+if ! command -v objdump >/dev/null; then
+  echo "objdump is required to verify OliveTin.exe Windows resources" >&2
+  exit 1
+fi
+if ! objdump -h "${SOURCE_ROOT}/OliveTin.exe" | grep -q '[[:space:]]\.rsrc[[:space:]]'; then
+  echo "OliveTin.exe is missing embedded Windows resources (.rsrc); use main: . in .goreleaser.yml" >&2
+  exit 1
+fi
+
 mkdir -p "${APP_STAGING}/webui"
 cp "${SOURCE_ROOT}/OliveTin.exe" "${APP_STAGING}/"
 cp -a "${SOURCE_ROOT}/webui/." "${APP_STAGING}/webui/"
@@ -89,4 +98,9 @@ wixl \
   "${SCRIPT_DIR}/OliveTin.wxs" \
   "${HEAT_WXS}"
 
+if ! msiinfo export "${MSI_PATH}" Media 2>/dev/null | grep -q '#cab1.cab'; then
+  echo "MSI cabinet is not embedded (expected #cab1.cab in Media table); check EmbedCab in OliveTin.wxs" >&2
+  exit 1
+fi
+
 echo "Built ${MSI_PATH}"
diff --git a/var/windows/generate-resources.sh b/var/windows/generate-resources.sh
index d1ad41c..7830b74 100755
--- a/var/windows/generate-resources.sh
+++ b/var/windows/generate-resources.sh
@@ -91,4 +91,10 @@ trap 'rm -rf "${WORK_DIR}" "${TOOL_BIN%/*}"' EXIT
 
 rm -f "${SERVICE_DIR}"/resource_windows_*.syso
 mv "${WORK_DIR}"/resource_windows_*.syso "${SERVICE_DIR}/"
+
+if ! compgen -G "${SERVICE_DIR}/resource_windows_*.syso" >/dev/null; then
+  echo "goversioninfo did not produce resource_windows_*.syso files" >&2
+  exit 1
+fi
+
 echo "Wrote Windows resource files to ${SERVICE_DIR}"