FrodeHus · Sep 19, 2026 · Sep 19, 2026 · Sep 19, 2026
diff --git a/README.md b/README.md
@@ -26,12 +26,13 @@ tenants, and finding your way around the panel. The rest of the user guides are
 
 - **macOS 26**: Homebrew cask or DMG, see [macos/README.md](macos/README.md#install). The cask
   and the pkg also install the `elevate` CLI; the DMG is the app alone.
-- **Windows 11**: per-user MSI, which installs the app and the `elevate` CLI, see
-  [windows/README.md](windows/README.md#install).
-- **CLI on its own** (Linux, Intel Macs, servers): a single binary from the release, see
-  [cli/README.md](cli/README.md#install).
-- **Audit tool**: Homebrew formula `frodehus/elevate/elevate-audit`, or a single binary from the
-  release, see [docs/audit.md](docs/audit.md#1-install).
+- **Windows 11**: `winget install Reothor.Elevate`, or the per-user MSI from the release; either
+  installs the app and the `elevate` CLI, see [windows/README.md](windows/README.md#install).
+- **CLI on its own** (Linux, Intel Macs, servers): `winget install Reothor.Elevate.CLI` on
+  Windows, or a single binary from the release, see [cli/README.md](cli/README.md#install).
+- **Audit tool**: `winget install Reothor.Elevate.Audit` on Windows, the Homebrew formula
+  `frodehus/elevate/elevate-audit`, or a single binary from the release, see
+  [docs/audit.md](docs/audit.md#1-install).
 
 The app and the CLI sign in with an Entra app registration — your own, a company one, or the project's
 optional [shared Elevate app](docs/shared-app-registration.md), which has no SLA; the Microsoft
@@ -121,12 +122,6 @@ build and test commands, and the conventions this repository keeps. Bugs and fea
 the [issue tracker](https://github.com/FrodeHus/elevate/issues); what changed in each release is in
 [CHANGELOG.md](CHANGELOG.md).
 
-## Roadmap
-
-- **Windows: winget** — the first `Reothor.Elevate`, `Reothor.Elevate.CLI` and
-  `Reothor.Elevate.Audit` submissions are in `microsoft/winget-pkgs` review; every release
-  after that opens its update pull requests automatically.
-
 ## License
 
 MIT, see [LICENSE](LICENSE).
diff --git a/cli/README.md b/cli/README.md
@@ -42,9 +42,10 @@ brew install frodehus/elevate/elevate-cli
 
 Shell completions are installed with it. Upgrade with `brew upgrade frodehus/elevate/elevate-cli`.
 
-**Windows, standalone.** `winget install Reothor.Elevate.CLI` (winget
-moderation requires signed binaries, so the manifest is a release artifact until Azure Artifact
-Signing is set up, like the app's). Until then, download `elevate-cli-<version>-win-x64.zip` (or
+**Windows, standalone.** `winget install Reothor.Elevate.CLI`, and
+`winget upgrade Reothor.Elevate.CLI` later. Each release opens its own pull request against
+`microsoft/winget-pkgs`, so the published version can lag the GitHub release by a day or two;
+to take a release the moment it lands, download `elevate-cli-<version>-win-x64.zip` (or
 `-win-arm64.zip`) from the [latest release](https://github.com/FrodeHus/elevate/releases/latest)
 and put `elevate.exe` on your PATH. Do not combine this with the MSI's copy: two `elevate` entries
 on the PATH means whichever comes first wins.

diff --git a/docs/getting-started.md b/docs/getting-started.md
@@ -22,10 +22,10 @@ Pick your platform:
   which also puts the `elevate` command on your PATH on Apple Silicon. Releases are signed and
   notarized, so the app opens without Gatekeeper prompts. After the first launch, its icon (a
   double chevron) sits in the menu bar. Click it to open the panel.
-- **Windows 11.** Download the per-user MSI from the
+- **Windows 11.** `winget install Reothor.Elevate`, or download the per-user MSI from the
   [latest release](https://github.com/FrodeHus/elevate/releases/latest) and run it; the steps,
   including the .NET runtime it needs, are in [windows/README.md](../windows/README.md#install).
-  The MSI installs the app and the `elevate` command for the current user, no admin rights needed.
+  Either installs the app and the `elevate` command for the current user, no admin rights needed.
   The MSI is code-signed (publisher "Open Source Developer Frode Hus"). SmartScreen may still
   ask once while a new release builds reputation: check that the publisher name is shown, then
   choose **More info** and **Run anyway**. Elevate then lives in the notification area:

diff --git a/windows/CONTINUING.md b/windows/CONTINUING.md
@@ -72,7 +72,7 @@ work added these:
 - **Option-click is Ctrl-click.** `PanelView` reads the Control key state at click time (`InputKeyboardSource.GetKeyStateForCurrentThread`) for Activate, Extend and the profile chips.
 - **The global shortcut is `RegisterHotKey` on the tray's hidden window**, which receives `WM_HOTKEY`; `HotKeyCenter` implements the model's `IHotKeyCenter` seam. A binding is a virtual key plus `MOD_*` flags, recorded by `HotKeyRecorder` (a button that captures the next key press; Ctrl, Alt or Win required) and stored in `settings.json`.
 - **The update check reads the releases list**, not `releases/latest`, and keeps the first published `v*` release that carries an MSI: both platforms share one tag, but a macOS-only hotfix without an MSI must not offer itself to Windows users.
-- **`BuildInfo`** takes the version from the assembly's informational version (`installer/build.ps1` sets it from the tag) and the signing state from the executable's Authenticode signature; "Unsigned" for the current releases.
+- **`BuildInfo`** takes the version from the assembly's informational version (`installer/build.ps1` sets it from the tag) and the signing state from the executable's Authenticode signature: `Signed: <certificate subject>`, which release builds have shown since 1.2.2 ("Open Source Developer Frode Hus", the Certum certificate), and "Unsigned" for a local build.
 - **Windows App SDK 1.8** (1.8.260804001), self-contained in the MSI; .NET itself is framework-dependent (`Microsoft.DotNet.Runtime.10`).
 - **The winget manifest is generated, not committed, and submitted by the publish job** (`scripts/submit-winget.sh`, needs the `WINGET_TOKEN` secret): one microsoft/winget-pkgs pull request per package and release. winget-pkgs nests dotted identifiers, so the CLI's manifests live at `manifests/r/Reothor/Elevate/CLI/<version>`.
 
@@ -95,5 +95,5 @@ work added these:
 
 ## What is left
 
-- **Issue #17, code signing and winget submission**: done. Signing with the Certum SimplySign certificate needs the `CERTUM_USERNAME`, `CERTUM_OTP_URI` and `CERTUM_KEY_ID` secrets (`docs/releasing.md`, "Windows signing secrets"; `scripts/Connect-SimplySign.ps1` opens the cloud session on the runner); winget submission needs `WINGET_TOKEN`. The first submissions were opened on 2026-09-15 and await Microsoft's review. Releases are shared with macOS since 1.2.0: one `v*` tag, one release, `.github/workflows/release.yml`.
+- **Issue #17, code signing and winget submission**: done. Signing with the Certum SimplySign certificate needs the `CERTUM_USERNAME`, `CERTUM_OTP_URI` and `CERTUM_KEY_ID` secrets (`docs/releasing.md`, "Windows signing secrets"; `scripts/Connect-SimplySign.ps1` opens the cloud session on the runner); winget submission needs `WINGET_TOKEN`. The first submissions were opened on 2026-09-15 and Microsoft published them: `Reothor.Elevate` and `Reothor.Elevate.CLI` at 1.7.0, `Reothor.Elevate.Audit` at 1.0.1. Releases are shared with macOS since 1.2.0: one `v*` tag, one release, `.github/workflows/release.yml`.
 - The Windows design canvas in `docs/design` predates the profiles row, the Approvals group and the new windows; refresh it when the next visual change lands.
diff --git a/windows/README.md b/windows/README.md
@@ -9,10 +9,15 @@ flyout, windows, tray states and tokens; open the file in a browser, it follows
 
 ## Install
 
-Download `Elevate-<version>-x64.msi` (or `-arm64.msi` for Arm PCs) from the
-[latest release](https://github.com/FrodeHus/elevate/releases/latest) and run it. The MSI
-installs for the current user into `%LOCALAPPDATA%\Programs\Elevate` (no admin rights), adds a
-Start Menu entry and can launch Elevate when it finishes. It also installs the `elevate`
+```powershell
+winget install Reothor.Elevate
+```
+
+Or download `Elevate-<version>-x64.msi` (or `-arm64.msi` for Arm PCs) from the
+[latest release](https://github.com/FrodeHus/elevate/releases/latest) and run it: both routes
+install the same per-user MSI. It installs for the current user into
+`%LOCALAPPDATA%\Programs\Elevate` (no admin rights), adds a Start Menu entry and can launch
+Elevate when it finishes. It also installs the `elevate`
 command-line tool into a `cli` subfolder (`%LOCALAPPDATA%\Programs\Elevate\cli`) and adds that
 subfolder to your user PATH, so `elevate --version` works in a new terminal (an already-open
 terminal needs to be restarted). If you also installed the standalone CLI with winget
@@ -30,10 +35,10 @@ for an independent check:
 (Get-FileHash .\Elevate-<version>-x64.msi).Hash
 ```
 
-Upgrade by running a newer MSI; uninstall from Settings > Apps, which removes the app, the CLI
-and the PATH entry. Or install and upgrade with winget: `winget install Reothor.Elevate` (each
-release is submitted to `microsoft/winget-pkgs` and published once Microsoft's checks pass, so
-the newest version may lag the GitHub release by a day or two); see [Release](#release).
+Upgrade with `winget upgrade Reothor.Elevate` or by running a newer MSI; uninstall from
+Settings > Apps, which removes the app, the CLI and the PATH entry. Each release opens its own
+pull request against `microsoft/winget-pkgs`, so the published version may lag the GitHub
+release by a day or two; see [Release](#release).
 
 ## Use