diff --git a/packaging/windows/grant-users-access.nsh b/packaging/windows/grant-users-access.nsh
new file mode 100644
index 0000000..47f64e5
--- /dev/null
+++ b/packaging/windows/grant-users-access.nsh
@@ -0,0 +1,12 @@
+; Grant standard (non-admin) users read/execute on the install tree.
+; Elevated installs into Program Files often create admin-only ACLs, which
+; breaks launcher.exe and bun reading deeplink.js for normal users.
+!macro grantUsersInstallAccess
+  Push $0
+  DetailPrint "Granting standard users read and execute access to $INSTDIR"
+  ExecWait '"$SYSDIR\icacls.exe" "$INSTDIR" /inheritance:e /T /C' $0
+  DetailPrint "Enabled inherited permissions (exit code: $0)"
+  ExecWait '"$SYSDIR\icacls.exe" "$INSTDIR" /grant *S-1-5-32-545:(OI)(CI)RX /T /C' $0
+  DetailPrint "Granted Users read/execute (exit code: $0)"
+  Pop $0
+!macroend
diff --git a/packaging/windows/installer.nsh b/packaging/windows/installer.nsh
index fd8e767..65ee57c 100644
--- a/packaging/windows/installer.nsh
+++ b/packaging/windows/installer.nsh
@@ -75,7 +75,11 @@
   RMDir "$SMPROGRAMS\Farm Control"
 !macroend
 
+!include "grant-users-access.nsh"
+
 !macro customInstall
+  !insertmacro grantUsersInstallAccess
+
   DetailPrint "Register farmcontrol URI Handler"
   DeleteRegKey HKCR "farmcontrol"
   WriteRegStr HKCR "farmcontrol" "" "URL:farmcontrol"
diff --git a/packaging/windows/msi-wrapped.wxs b/packaging/windows/msi-wrapped.wxs
index 1e5a9d5..ff9298b 100644
--- a/packaging/windows/msi-wrapped.wxs
+++ b/packaging/windows/msi-wrapped.wxs
@@ -24,7 +24,6 @@
     <Property Id="ARPPRODUCTICON" Value="InstallerIcon" />
 
     <Property Id="DISABLEADVTSHORTCUTS" Value="1" />
-    <Property Id="MSIINSTALLPERUSER" Value="1" />
 
   <Property Id="PREVIOUS_UNINSTALL_CMD">
     <RegistrySearch
diff --git a/scripts/installer.nsh b/scripts/installer.nsh
index a3217b2..7d58b96 100644
--- a/scripts/installer.nsh
+++ b/scripts/installer.nsh
@@ -1,4 +1,8 @@
+!include "packaging\windows\grant-users-access.nsh"
+
 !macro customInstall
+  !insertmacro grantUsersInstallAccess
+
   DetailPrint "Register farmcontrol URI Handler"
   DeleteRegKey HKCR "farmcontrol"
   WriteRegStr HKCR "farmcontrol" "" "URL:farmcontrol"