diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c94f3a6..51a51a0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -114,13 +114,18 @@ jobs:
 
       - uses: Swatinem/rust-cache@v2.9.1
 
-      # mingw-w64 for the cross compile, wixl for the .msi — Debian and Ubuntu
-      # ship it apart from `msitools`, which has only the msi* tools — and
-      # p7zip for the mpv-dev archive.
+      # mingw-w64 for the cross compile and p7zip for the mpv-dev archive.
       - name: Install the cross toolchain
         run: |
           sudo apt-get update
-          sudo apt-get install -y mingw-w64 wixl zip p7zip-full
+          sudo apt-get install -y mingw-w64 zip p7zip-full
+
+      # Not `apt install wixl`: noble has msitools 0.103, and <Environment> —
+      # the PATH entry for pstr.exe — arrived in 0.105. An older wixl core dumps
+      # on the .wxs rather than declining it. 0.106 is in 25.10 but its .deb
+      # wants a libxml2 noble does not have, so this builds from source (~2 min).
+      - name: Install wixl >= 0.105
+        run: scripts/install-wixl.sh
 
       - name: Build the portable .zip and the .msi
         env:
diff --git a/packaging/windows/proton-stream.wixl.wxs b/packaging/windows/proton-stream.wixl.wxs
index cfd7092..94b7e74 100644
--- a/packaging/windows/proton-stream.wixl.wxs
+++ b/packaging/windows/proton-stream.wixl.wxs
@@ -36,7 +36,9 @@
 
   Keep in sync with proton-stream.wxs
   ===================================
-  UpgradeCode and every Component Guid are shared with that file, deliberately.
+  One attribute deliberately disagrees — Environment/@Permanent, because wixl
+  reads it backwards; see the comment on that element. UpgradeCode and every
+  Component Guid are shared with that file, deliberately.
   They are what lets an .msi built here upgrade one built on Windows (and the
   reverse) instead of the two stacking up or corrupting each other's component
   reference counts. Never regenerate them; a new *payload file* gets a new
@@ -108,11 +110,23 @@
 
           <!-- The CLI, and the PATH entry that makes it worth installing. Tied
                to the same component so uninstalling takes the PATH edit with
-               it. -->
+               it.
+
+               Permanent="yes" here against Permanent="no" in the WiX file, and
+               the two mean the same thing. wixl has the attribute inverted: it
+               appends the Environment table's "-" prefix — "remove this value
+               on uninstall" — when Permanent is *true*, so Permanent="no"
+               builds an .msi whose uninstall leaves the PATH entry behind.
+               Verify with `msiinfo export out.msi Environment`; the Name must
+               come out "=-*PATH".
+
+               <Environment> itself needs msitools >= 0.105. Older wixl aborts
+               on this element with a core dump rather than an error, which is
+               why scripts/build-windows.sh checks the version first. -->
           <Component Id="CliExe" Guid="6440650e-281f-4842-a75a-4cbea8be0d71" Win64="yes">
             <File Id="CliExe" Source="$(var.BinDir)/pstr.exe" Name="pstr.exe" KeyPath="yes" />
             <Environment Id="PstrPath" Name="PATH" Value="[INSTALLDIR]"
-                         Part="last" Action="set" System="yes" Permanent="no" />
+                         Part="last" Action="set" System="yes" Permanent="yes" />
           </Component>
 
           <!-- libmpv does the demuxing and decoding. There is no static build
diff --git a/scripts/build-windows.sh b/scripts/build-windows.sh
index 8fb958d..387ebc0 100755
--- a/scripts/build-windows.sh
+++ b/scripts/build-windows.sh
@@ -30,6 +30,7 @@
 # Prerequisites (Arch names; every distro has them):
 #   mingw-w64-gcc  msitools  zip                 pacman -S mingw-w64-gcc msitools zip
 #   Debian/Ubuntu split wixl out of msitools:    apt install mingw-w64 wixl zip
+#   wixl >= 0.105 (Ubuntu 24.04 has 0.103):      scripts/install-wixl.sh
 #   rustup target add x86_64-pc-windows-gnu
 #   osslsigncode                                 only for --sign
 
@@ -41,6 +42,9 @@ readonly OUTDIR="$DIST/windows"
 readonly PKG="$ROOT/packaging/windows"
 
 readonly PKGNAME="proton-stream"
+
+# msitools 0.105 is where wixl grew <Environment>; see make_msi.
+readonly WIXL_MIN="0.105"
 readonly GUI_BIN="proton-stream.exe"
 readonly CLI_BIN="pstr.exe"
 
@@ -270,6 +274,17 @@ make_msi() {
   # package has the msi* tools and not this one. Arch puts both in msitools.
   have wixl || die 'the .msi needs wixl (pacman -S msitools / apt install wixl)'
 
+  # The .wxs puts pstr.exe's PATH entry in an <Environment>, which wixl only
+  # implements from msitools 0.105. Older ones do not decline it — they abort in
+  # wix.vala with a core dump — and Ubuntu 24.04, the release runner, ships
+  # 0.103. Check before handing it the file.
+  local wixl_version
+  wixl_version="$(wixl --version 2>/dev/null | head -1)"
+  if [[ -z "$wixl_version" ]] ||
+     [[ "$(printf '%s\n%s\n' "$WIXL_MIN" "$wixl_version" | sort -V | head -1)" != "$WIXL_MIN" ]]; then
+    die "wixl ${wixl_version:-unknown} is too old for <Environment> (need >= $WIXL_MIN); run scripts/install-wixl.sh"
+  fi
+
   local out="$DIST/${PKGNAME}-${VERSION}-x64.msi"
   log "msi -> $(basename "$out")"
   rm -f "$out"
diff --git a/scripts/install-wixl.sh b/scripts/install-wixl.sh
new file mode 100755
index 0000000..a37760a
--- /dev/null
+++ b/scripts/install-wixl.sh
@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+#
+# Builds msitools' wixl from source, for hosts whose distribution ships one too
+# old to package proton-stream.
+#
+#   scripts/install-wixl.sh                 # build + install if wixl < 0.105
+#   scripts/install-wixl.sh --force         # build even if a new enough one is here
+#   scripts/install-wixl.sh --prefix ~/.local
+#   scripts/install-wixl.sh --no-deps       # do not touch apt
+#
+# Why this exists
+# ===============
+# packaging/windows/proton-stream.wixl.wxs puts the PATH entry for pstr.exe in
+# an <Environment> element. wixl only learned that element in msitools 0.105;
+# older ones abort on it, and not gracefully:
+#
+#   ** (wixl): ERROR: wix.vala:232: unhandled child Component node Environment
+#   Trace/breakpoint trap (core dumped)
+#
+# Arch has 0.106, so a hand-built release is fine. Ubuntu 24.04 — the release
+# workflow's runner — has 0.103, and 0.106 first appears in 25.10, so there is
+# nothing to apt-install and nothing to backport: the questing .deb wants
+# libxml2-16, which noble does not have. Hence a source build.
+#
+# Installs to /usr/local by default, with sudo when not already root.
+
+set -euo pipefail
+
+readonly MSITOOLS_TAG="v0.106"
+readonly MIN_VERSION="0.105"
+readonly REPO="https://gitlab.gnome.org/GNOME/msitools.git"
+
+PREFIX="/usr/local"
+FORCE=0
+DEPS=1
+
+usage() {
+  cat <<EOF
+usage: scripts/install-wixl.sh [--prefix DIR] [--force] [--no-deps]
+
+Builds msitools ${MSITOOLS_TAG} and installs wixl into PREFIX (default ${PREFIX}).
+Does nothing if wixl ${MIN_VERSION} or newer is already on PATH.
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --prefix)   PREFIX="$2"; shift 2 ;;
+    --force)    FORCE=1; shift ;;
+    --no-deps)  DEPS=0; shift ;;
+    -h|--help)  usage; exit 0 ;;
+    *)          echo "unknown option: $1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+
+log()  { printf '\033[35m==>\033[0m %s\n' "$*"; }
+die()  { printf '\033[31merror:\033[0m %s\n' "$*" >&2; exit 1; }
+have() { command -v "$1" >/dev/null 2>&1; }
+
+# Root in a container, sudo on a runner or a workstation.
+SUDO=""
+[[ $EUID -eq 0 ]] || SUDO="sudo"
+
+if [[ $FORCE -eq 0 ]] && have wixl; then
+  current="$(wixl --version 2>/dev/null | head -1)"
+  if [[ -n "$current" && "$(printf '%s\n%s\n' "$MIN_VERSION" "$current" | sort -V | head -1)" == "$MIN_VERSION" ]]; then
+    log "wixl $current is new enough (>= $MIN_VERSION), nothing to do"
+    exit 0
+  fi
+  log "wixl ${current:-unknown} predates <Environment> support, building $MSITOOLS_TAG"
+fi
+
+# Ubuntu 24.04's meson is 1.3.2 and msitools wants >= 1.4, so meson comes from
+# pip rather than apt. gobject-introspection is not optional in libmsi's
+# meson.build, and the bats test harness is a submodule — hence --recursive
+# below rather than a release tarball, which does not carry submodules.
+if [[ $DEPS -eq 1 ]] && have apt-get; then
+  log "installing build dependencies"
+  $SUDO apt-get update -qq
+  $SUDO apt-get install -y --no-install-recommends \
+    build-essential ninja-build valac bison pkg-config gettext git python3-pip \
+    libgcab-dev libgirepository1.0-dev libgsf-1-dev libxml2-dev uuid-dev
+fi
+
+if ! have meson || [[ "$(printf '1.4\n%s\n' "$(meson --version)" | sort -V | head -1)" != "1.4" ]]; then
+  log "installing meson >= 1.4 from pip"
+  pip3 install --break-system-packages --quiet 'meson>=1.4' \
+    || pip3 install --quiet 'meson>=1.4'
+fi
+
+src="$(mktemp -d)"
+trap 'rm -rf "$src"' EXIT
+
+log "cloning msitools $MSITOOLS_TAG"
+git clone -q --depth 1 --branch "$MSITOOLS_TAG" --recursive "$REPO" "$src/msitools"
+
+log "building"
+meson setup "$src/msitools/build" "$src/msitools" --prefix "$PREFIX" --buildtype=release
+ninja -C "$src/msitools/build"
+
+log "installing into $PREFIX"
+if [[ -w "$PREFIX" ]]; then
+  ninja -C "$src/msitools/build" install
+else
+  $SUDO ninja -C "$src/msitools/build" install
+fi
+[[ $EUID -eq 0 || -n "$SUDO" ]] && $SUDO ldconfig 2>/dev/null || true
+
+# A distro wixl left in place would still win on PATH; say which one answers.
+hash -r 2>/dev/null || true
+have wixl || die "$PREFIX/bin is not on PATH"
+log "wixl $(wixl --version) at $(command -v wixl)"