diff --git a/scripts/build-windows-msi.ps1 b/scripts/build-windows-msi.ps1
index 9ebc716..ca5e34c 100644
--- a/scripts/build-windows-msi.ps1
+++ b/scripts/build-windows-msi.ps1
@@ -44,20 +44,41 @@ if (Test-Path $workDir) {
 }
 New-Item -ItemType Directory -Path $workDir | Out-Null
 
+function ConvertTo-WixVersion([string]$rawVersion) {
+  $parts = $rawVersion.Split('.')
+  while ($parts.Count -lt 4) {
+    $parts += '0'
+  }
+  return ($parts[0..3] -join '.')
+}
+
 $candle = Find-WixTool "candle"
 $light = Find-WixTool "light"
 
-& $candle `
-  -nologo `
-  -out $wixObj `
-  -dVersion=$Version `
-  -dSetupExe=$SetupExe `
-  $wxsPath
+$wixVersion = ConvertTo-WixVersion $Version
+$setupExePath = (Resolve-Path -LiteralPath $SetupExe).Path
 
-& $light `
-  -nologo `
-  -out $OutputMsi `
+# Quote -d defines so PowerShell passes them as single args to candle.exe.
+# Unquoted -dVersion=$Version is parsed incorrectly; paths with spaces also break.
+$candleArgs = @(
+  '-nologo'
+  '-out'
   $wixObj
+  "-dVersion=$wixVersion"
+  "-dSetupExe=$setupExePath"
+  $wxsPath
+)
+
+& $candle @candleArgs
+
+$lightArgs = @(
+  '-nologo'
+  '-out'
+  $OutputMsi
+  $wixObj
+)
+
+& $light @lightArgs
 
 if (-not (Test-Path $OutputMsi)) {
   throw "MSI was not created at $OutputMsi"