diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a1b3bbb..7645885 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -43,10 +43,12 @@ jobs:
         run: npm run rebuild
 
       - name: Build installer (electron-builder)
-        # --publish never: only package the artifacts here. Publishing is
-        # handled by the dedicated "Publish GitHub Release" step below.
-        # Without this, electron-builder auto-publishes on a tag and fails
-        # with "GitHub Personal Access Token is not set".
+        # --publish never: build the multi-arch NSIS installers (x64 + arm64)
+        # locally only; the "Publish GitHub Release" step below uploads them.
+        # Without this, electron-builder auto-detects the tag and tries to
+        # publish itself, failing because GH_TOKEN isn't set in this step.
+        # NOTE: dist is a single electron-builder invocation, so --publish never
+        # is applied exactly once (no duplicate-flag array problem).
         run: npm run dist -- --publish never
 
       - name: Publish GitHub Release
diff --git a/package.json b/package.json
index ca829eb..bc489c0 100644
--- a/package.json
+++ b/package.json
@@ -13,7 +13,7 @@
     "start": "cross-env NODE_ENV=development electron .",
     "start:prod": "cross-env NODE_ENV=production electron .",
     "rebuild": "electron-rebuild -f -w better-sqlite3",
-    "dist": "vite build && electron-builder --win --x64 --publish never && electron-builder --win --arm64 --publish never",
+    "dist": "vite build && electron-builder --win --x64 --arm64",
     "release": "powershell -ExecutionPolicy Bypass -File scripts/release.ps1",
     "demo:gif": "node scripts/make-demo-gif.mjs",
     "check:license": "node scripts/check-license-headers.mjs",
@@ -62,16 +62,20 @@
     "win": {
       "target": [
         {
-          "target": "nsis"
+          "target": "nsis",
+          "arch": [
+            "x64",
+            "arm64"
+          ]
         }
       ],
-      "icon": "public/icon.ico"
+      "icon": "public/icon.ico",
+      "artifactName": "${productName} Setup ${version} ${arch}.${ext}"
     },
     "nsis": {
       "oneClick": false,
       "perMachine": false,
       "allowToChangeInstallationDirectory": false,
-      "artifactName": "${productName} Setup ${version} ${arch}.${ext}",
       "include": "installer/installer.nsh",
       "installerIcon": "public/icon.ico",
       "uninstallerIcon": "public/icon.ico",