diff --git a/README.md b/README.md
index 5ce59461..4264c272 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ chmod +x ~/.local/bin/subminer
 
 **Windows (Installer/ZIP):** download the latest `SubMiner-<version>.exe` installer or portable `.zip` from [GitHub Releases](https://github.com/ksyasuda/SubMiner/releases/latest). Keep `mpv` installed and available on `PATH`.
 
-**From source** — initialize submodules first (`git submodule update --init --recursive`). Bundled Yomitan is built from the `vendor/subminer-yomitan` submodule into `build/yomitan` during `bun run build`, so source builds only need Bun for the JS toolchain. Packaged macOS and Windows installs do not require Bun. Full install guide: [docs.subminer.moe/installation#from-source](https://docs.subminer.moe/installation#from-source).
+**From source** — initialize submodules first (`git submodule update --init --recursive`). Bundled Yomitan is built from the `vendor/subminer-yomitan` submodule into `build/yomitan` during `bun run build`, so source builds only need Bun for the JS toolchain. Packaged macOS and Windows installs do not require Bun. Windows installer builds go through `electron-builder`; its bundled `app-builder-lib` NSIS templates already use the third-party `WinShell` plugin for shortcut AppUserModelID assignment, and the `WinShell.dll` binary is supplied by electron-builder's cached `nsis-resources` bundle, so `bun run build:win` does not need a separate repo-local plugin install step. Full install guide: [docs.subminer.moe/installation#from-source](https://docs.subminer.moe/installation#from-source).
 
 ### 2. Launch the app once
 
diff --git a/build/installer.nsh b/build/installer.nsh
index 408e613d..4ba2d416 100644
--- a/build/installer.nsh
+++ b/build/installer.nsh
@@ -125,6 +125,8 @@ FunctionEnd
       CreateDirectory "$SMPROGRAMS\${MENU_FILENAME}"
     !endif
     CreateShortCut "$WindowsMpvShortcutStartMenuPath" "$appExe" "--launch-mpv" "$appExe" 0 "" "" "Launch mpv with the SubMiner profile"
+    # electron-builder's upstream NSIS templates use the same WinShell call for AppUserModelID wiring.
+    # WinShell.dll comes from electron-builder's cached nsis-resources bundle, so bun run build:win needs no extra repo-local setup.
     ClearErrors
     WinShell::SetLnkAUMI "$WindowsMpvShortcutStartMenuPath" "${APP_ID}"
   ${else}
@@ -133,6 +135,7 @@ FunctionEnd
 
   ${if} $WindowsMpvShortcutDesktopEnabled == "1"
     CreateShortCut "$WindowsMpvShortcutDesktopPath" "$appExe" "--launch-mpv" "$appExe" 0 "" "" "Launch mpv with the SubMiner profile"
+    # ClearErrors keeps the optional AUMI assignment non-fatal if the packaging environment is missing WinShell.
     ClearErrors
     WinShell::SetLnkAUMI "$WindowsMpvShortcutDesktopPath" "${APP_ID}"
   ${else}
diff --git a/build/signpath-windows-artifact-config.xml b/build/signpath-windows-artifact-config.xml
index 65366927..87de13b1 100644
--- a/build/signpath-windows-artifact-config.xml
+++ b/build/signpath-windows-artifact-config.xml
@@ -12,6 +12,9 @@
         <pe-file path="*.dll" max-matches="unbounded">
           <authenticode-sign />
         </pe-file>
+        <pe-file path="*.node" max-matches="unbounded">
+          <authenticode-sign />
+        </pe-file>
       </directory>
     </zip-file>
   </zip-file>
diff --git a/src/main/runtime/windows-mpv-shortcuts.test.ts b/src/main/runtime/windows-mpv-shortcuts.test.ts
index c033649a..a0c864f6 100644
--- a/src/main/runtime/windows-mpv-shortcuts.test.ts
+++ b/src/main/runtime/windows-mpv-shortcuts.test.ts
@@ -67,8 +67,8 @@ test('applyWindowsMpvShortcuts creates enabled shortcuts and removes disabled on
       desktopPath: 'C:\\Desktop\\SubMiner mpv.lnk',
     },
     exePath: 'C:\\Apps\\SubMiner\\SubMiner.exe',
-    writeShortcutLink: (shortcutPath, _operation, details) => {
-      writes.push(`${shortcutPath}|${details.target}|${details.args}`);
+    writeShortcutLink: (shortcutPath, operation, details) => {
+      writes.push(`${shortcutPath}|${operation}|${details.target}|${details.args}`);
       return true;
     },
     rmSync: (candidate) => {
@@ -80,7 +80,7 @@ test('applyWindowsMpvShortcuts creates enabled shortcuts and removes disabled on
   assert.equal(result.ok, true);
   assert.equal(result.status, 'installed');
   assert.deepEqual(writes, [
-    'C:\\Programs\\SubMiner mpv.lnk|C:\\Apps\\SubMiner\\SubMiner.exe|--launch-mpv',
+    'C:\\Programs\\SubMiner mpv.lnk|replace|C:\\Apps\\SubMiner\\SubMiner.exe|--launch-mpv',
   ]);
   assert.deepEqual(removes, ['C:\\Desktop\\SubMiner mpv.lnk']);
 });
diff --git a/src/main/runtime/windows-mpv-shortcuts.ts b/src/main/runtime/windows-mpv-shortcuts.ts
index c6cb03a7..4dc349b2 100644
--- a/src/main/runtime/windows-mpv-shortcuts.ts
+++ b/src/main/runtime/windows-mpv-shortcuts.ts
@@ -77,7 +77,7 @@ export function applyWindowsMpvShortcuts(options: {
 
   const ensureShortcut = (shortcutPath: string): void => {
     mkdirSync(path.dirname(shortcutPath), { recursive: true });
-    const ok = options.writeShortcutLink(shortcutPath, 'create', details);
+    const ok = options.writeShortcutLink(shortcutPath, 'replace', details);
     if (!ok) {
       failures.push(shortcutPath);
     }