diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 83a19e9c..cbb0898a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -266,6 +266,7 @@ jobs:
             --dist dist \
             --tag "$GITHUB_REF_NAME" \
             --base-url "$OPENLOGI_UPDATE_BASE_URL" \
+            --include-windows \
             --output dist/latest.json
 
       - name: Upload static updater assets to R2
@@ -282,22 +283,18 @@ jobs:
           release_prefix="s3://${R2_BUCKET}/releases/${GITHUB_REF_NAME}"
           channel_manifest="s3://${R2_BUCKET}/channels/stable/latest.json"
 
-          # The Windows binaries' distribution channel is the GitHub Release;
-          # latest.json is still dmg-only, so nothing in the updater bucket
-          # references the zip/msi or their minisigs — keep them all out of
-          # the immutable releases/ prefix until the Windows auto-updater
-          # lands (#347 PR 4). SHA256SUMS still lists them — it describes the
-          # GitHub Release's asset set. *.exe stays excluded defensively even
-          # though no bare exe ships anymore.
+          # latest.json now carries the Windows msi/zip entries (notify-only:
+          # a Windows check resolves and routes to the GitHub Release for the
+          # download — the client's install flow stays off, INSTALL_SUPPORTED
+          # is false). Their asset + signature URLs point into this prefix, so
+          # the zip/msi and their minisigs must ship here too or the manifest
+          # would reference 404s. *.exe stays excluded defensively — no bare
+          # exe ships anymore.
           aws s3 cp dist/ "$release_prefix/" \
             --recursive \
             --exclude latest.json \
             --exclude "*.exe" \
             --exclude "*.exe.minisig" \
-            --exclude "*.zip" \
-            --exclude "*.zip.minisig" \
-            --exclude "*.msi" \
-            --exclude "*.msi.minisig" \
             --cache-control "public, max-age=31536000, immutable" \
             --endpoint-url "$endpoint"
 
diff --git a/crates/openlogi-gui/themes/openlogi.json b/crates/openlogi-gui/themes/openlogi.json
index e62fc20b..e214a09e 100644
--- a/crates/openlogi-gui/themes/openlogi.json
+++ b/crates/openlogi-gui/themes/openlogi.json
@@ -129,7 +129,7 @@
         "chart_bullish": "green-600",
         "chart_bearish": "red-600",
         "danger.background": "#ef4444",
-        "danger.foreground": "red-600",
+        "danger.foreground": "neutral-50",
         "description_list_label.background": "#171717",
         "description_list_label.foreground": "#f5f5f5",
         "drag_border": "#3b82f6",
diff --git a/xtask/src/commands/release/latest_json.rs b/xtask/src/commands/release/latest_json.rs
index ae4813e8..f47cb8b8 100644
--- a/xtask/src/commands/release/latest_json.rs
+++ b/xtask/src/commands/release/latest_json.rs
@@ -30,8 +30,10 @@ pub(crate) struct Args {
     base_url: String,
     /// Also emit the per-arch Windows `.msi`/`.zip` entries. Off by default so
     /// the manifest can never reference objects the release workflow's R2
-    /// upload step doesn't ship: flip this in the same workflow change that
-    /// stops excluding the zip/msi from the `releases/` prefix (#347 PR 4).
+    /// upload step doesn't ship. The release workflow passes it and ships the
+    /// zip/msi to the `releases/` prefix; the entries are notify-only (the
+    /// Windows client resolves a check but installs from the GitHub Release —
+    /// `INSTALL_SUPPORTED` is false).
     #[arg(long)]
     include_windows: bool,
 }