diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index ce9420d..2b53897 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -17,23 +17,30 @@ jobs:
         shell: pwsh
         run: |
           $ErrorActionPreference = "Stop"
+          # Use a pre-installed Python if the runner has one; otherwise set up a
+          # self-contained embeddable Python (no MSI, no admin, no registry).
+          $py = "python"
           if (-not (Get-Command python -ErrorAction SilentlyContinue)) {
-            Write-Host "Python not found; installing 3.12 to a fixed dir (no admin needed)..."
-            $url = "https://www.python.org/ftp/python/3.12.7/python-3.12.7-amd64.exe"
-            Invoke-WebRequest -Uri $url -OutFile "$env:TEMP\py.exe"
-            $dir = "$env:LOCALAPPDATA\Python312"
-            $p = Start-Process -Wait -PassThru -FilePath "$env:TEMP\py.exe" `
-                   -ArgumentList "/quiet","TargetDir=$dir","PrependPath=1","Include_test=0"
-            Write-Host "installer exit code: $($p.ExitCode)"
+            $dir = "$env:LOCALAPPDATA\obdash-python"
             if (-not (Test-Path "$dir\python.exe")) {
-              throw "python.exe not found at $dir after install (exit $($p.ExitCode))"
+              Write-Host "Setting up embeddable Python 3.12 at $dir ..."
+              $zip = "$env:TEMP\pyembed.zip"
+              Invoke-WebRequest "https://www.python.org/ftp/python/3.12.7/python-3.12.7-embed-amd64.zip" -OutFile $zip
+              if (Test-Path $dir) { Remove-Item -Recurse -Force $dir }
+              Expand-Archive $zip -DestinationPath $dir -Force
+              # enable site-packages so pip-installed packages import
+              $pth = Get-ChildItem "$dir\python*._pth" | Select-Object -First 1
+              (Get-Content $pth) -replace '^#\s*import site','import site' | Set-Content $pth
+              Invoke-WebRequest "https://bootstrap.pypa.io/get-pip.py" -OutFile "$dir\get-pip.py"
+              & "$dir\python.exe" "$dir\get-pip.py" --no-warn-script-location
             }
+            $py = "$dir\python.exe"
             $env:Path = "$dir;$dir\Scripts;$env:Path"
           }
-          python --version
-          python -m pip install --upgrade pip
-          pip install -r requirements-gui.txt pyinstaller
-          pyinstaller --noconfirm --onefile --windowed --name OBDash --add-data "profiles;profiles" run_gui.py
+          & $py --version
+          & $py -m pip install --upgrade pip
+          & $py -m pip install -r requirements-gui.txt pyinstaller
+          & $py -m PyInstaller --noconfirm --onefile --windowed --name OBDash --add-data "profiles;profiles" run_gui.py
           Copy-Item dist/OBDash.exe OBDash-windows.exe
       - name: Publish to release
         if: startsWith(github.ref, 'refs/tags/')