diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3e8924d..05bc322b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@
 
 ### Added
 
-- **`start.ps1`: native Windows launcher candidate-path expansion** — extends `start.ps1`'s hermes-agent auto-discovery to also check `%LOCALAPPDATA%\hermes\hermes-agent`, `%PROGRAMFILES%\hermes\hermes-agent`, and `%PROGRAMFILES(X86)%\hermes\hermes-agent` in addition to the existing `%USERPROFILE%\.hermes\hermes-agent` and `../hermes-agent` candidates. Closes the installer-user-path friction the maintainer flagged in #2783 — users who install hermes-agent via the official Windows installer (which places it under `%LOCALAPPDATA%\hermes\hermes-agent`) or an MSI to `Program Files` no longer need to set `HERMES_WEBUI_AGENT_DIR` explicitly. The not-found error message also restructured to enumerate every searched path, so when discovery fails the user sees exactly where to look. Same `Test-Path (Join-Path $c 'hermes_cli')` validation applies uniformly to all candidates.
+- **`start.ps1`: hermes-agent auto-discovery now also checks Windows installer paths** — the launcher's discovery list now includes `%LOCALAPPDATA%\hermes\hermes-agent` (official Windows installer location), `%PROGRAMFILES%\hermes\hermes-agent`, and `%PROGRAMFILES(X86)%\hermes\hermes-agent` (MSI install locations) alongside the existing `%USERPROFILE%\.hermes\hermes-agent` and `../hermes-agent` candidates. The not-found error message now enumerates every searched path so failures point users at the exact list checked. Each candidate is validated as a directory (`Test-Path … -PathType Container`); system-wide roots are added conditionally to skip the (rare) 32-bit Windows case where `%PROGRAMFILES(X86)%` is null. Closes the installer-user-path friction the maintainer flagged in #2783 — users with installer-deployed hermes-agent no longer need to set `HERMES_WEBUI_AGENT_DIR` explicitly.
 - **`start.ps1`: native Windows launcher** — PowerShell equivalent of `start.sh` that bypasses `bootstrap.py`'s `ensure_supported_platform()` refusal and invokes `server.py` directly on native Windows. Mirrors `start.sh`'s discovery (load optional `.env` with the same readonly-var filter for `UID`/`GID`/`EUID`/`EGID`/`PPID`, find Python via `HERMES_WEBUI_PYTHON` env → `python3` → `python` → `py`, locate the hermes-agent dir at `%USERPROFILE%\.hermes\hermes-agent` or `../hermes-agent`, prefer the agent's `venv\Scripts\python.exe` if present, set `HERMES_WEBUI_HOST` / `HERMES_WEBUI_PORT` / `HERMES_WEBUI_STATE_DIR` / `HERMES_HOME` defaults). Closes the launcher half of #1952; complements the README community-guide link below. Assumes Python + agent venv are already set up — for first-time setup, use WSL2 once to create the venv, then `start.ps1` works natively.
 
 ### Documentation
diff --git a/start.ps1 b/start.ps1
index 6631e81d..619c37f2 100644
--- a/start.ps1
+++ b/start.ps1
@@ -91,20 +91,24 @@ if (-not $Python) {
 # that's about to crash on missing imports. Smoke-test feedback on
 # PR #2783: nesquena/hermes-webui requested this guard.
 $AgentDir = $env:HERMES_WEBUI_AGENT_DIR
-if ($AgentDir -and -not (Test-Path (Join-Path $AgentDir 'hermes_cli'))) {
+if ($AgentDir -and -not (Test-Path (Join-Path $AgentDir 'hermes_cli') -PathType Container)) {
     Write-Error "HERMES_WEBUI_AGENT_DIR is set to '$AgentDir' but no hermes_cli/ folder exists there. Unset the variable to fall back to auto-discovery, or fix the path."
     exit 1
 }
 if (-not $AgentDir) {
-    $candidates = @(
-        (Join-Path $env:USERPROFILE '.hermes\hermes-agent'),
-        (Join-Path $env:LOCALAPPDATA 'hermes\hermes-agent'),
-        (Join-Path ${env:ProgramFiles} 'hermes\hermes-agent'),
-        (Join-Path ${env:ProgramFiles(x86)} 'hermes\hermes-agent'),
-        (Join-Path (Split-Path -Parent $RepoRoot) 'hermes-agent')
-    )
+    # Build candidate list incrementally — ${env:ProgramFiles(x86)} is null on
+    # 32-bit Windows and in some constrained environments, and Join-Path throws
+    # on a null Path. Skip any system-wide root that isn't set so the launcher
+    # stays robust across Windows variants. USERPROFILE is always set so it
+    # stays unguarded; the dev-checkout sibling is path-derived, not env-based.
+    $candidates = @()
+    $candidates += (Join-Path $env:USERPROFILE '.hermes\hermes-agent')
+    foreach ($root in @($env:LOCALAPPDATA, ${env:ProgramFiles}, ${env:ProgramFiles(x86)})) {
+        if ($root) { $candidates += (Join-Path $root 'hermes\hermes-agent') }
+    }
+    $candidates += (Join-Path (Split-Path -Parent $RepoRoot) 'hermes-agent')
     foreach ($c in $candidates) {
-        if (Test-Path (Join-Path $c 'hermes_cli')) { $AgentDir = $c; break }
+        if (Test-Path (Join-Path $c 'hermes_cli') -PathType Container) { $AgentDir = $c; break }
     }
 }
 if (-not $AgentDir) {