diff --git a/.github/workflows/package-win.yml b/.github/workflows/package-win.yml
index 5f659683d..fcc24085d 100644
--- a/.github/workflows/package-win.yml
+++ b/.github/workflows/package-win.yml
@@ -13,6 +13,13 @@
 name: Package Windows
 
 on:
+  # Keep the workflow discoverable when it first lands on the default branch.
+  # Subsequent app changes remain manual; only edits to this workflow package
+  # the exact main commit automatically.
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/package-win.yml
   workflow_dispatch:
     inputs:
       ref:
@@ -20,6 +27,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   package:
     name: NSIS installer