diff --git a/deploy/build.bat b/deploy/build.bat
index f5d2f15..f537586 100644
--- a/deploy/build.bat
+++ b/deploy/build.bat
@@ -3,16 +3,18 @@ chcp 65001 >nul
 REM Build Windows artifacts on the build machine (Meowhome).
 REM Output:
 REM   dist\scoreboard.exe                    server (frontend embedded via go:embed)
-REM   dist\console\ScoreboardConsole\        portable GUI manager (double-click to run)
+REM   dist\ScoreboardConsole\                portable GUI manager (double-click to run)
 REM
 REM We do NOT use electron-builder NSIS: it downloads signing tools from GitHub,
-REM which fails on restricted networks. Instead we assemble a portable app manually.
+REM which fails on restricted networks. The portable app is assembled by extracting
+REM the official electron zip straight into the output directory.
 setlocal
 
 REM Must match console\package.json devDependencies.electron (pinned in console\pnpm-lock.yaml)
 set "ELECTRON_VERSION=38.8.6"
 set "ELECTRON_MIRROR=https://npmmirror.com/mirrors/electron"
-set "CONSOLE_OUT=dist\console\ScoreboardConsole"
+set "CONSOLE_OUT=dist\ScoreboardConsole"
+set "ELECTRON_ZIP=dist\cache\electron-v%ELECTRON_VERSION%-win32-x64.zip"
 
 cd /d "%~dp0.."
 
@@ -31,19 +33,16 @@ if not exist ..\dist mkdir ..\dist
 go build -o ..\dist\scoreboard.exe . || exit /b 1
 cd ..
 
-echo === [4/5] console deps + electron binary ===
+echo === [4/5] console deps ===
 cd console
 call pnpm install --frozen-lockfile || exit /b 1
-call :ensure_electron || exit /b 1
 cd ..
 
 echo === [5/5] assemble portable console ===
-REM Old build may still be running; .pak files from the electron zip are read-only,
-REM so full directory removal is fragile. Overwrite in place instead: the runtime is
-REM installed once, and only our own resources\app is wiped on every build.
+REM Old build may still be running; electron runtime files are read-only,
+REM so the runtime is extracted once and only our own resources\app is rebuilt.
 taskkill /im "Scoreboard Console.exe" /f >nul 2>&1
 taskkill /im scoreboard.exe /f >nul 2>&1
-if not exist "%CONSOLE_OUT%" mkdir "%CONSOLE_OUT%" || exit /b 1
 if not exist "%CONSOLE_OUT%\Scoreboard Console.exe" call :install_runtime || exit /b 1
 if exist "%CONSOLE_OUT%\resources\app" rmdir /s /q "%CONSOLE_OUT%\resources\app"
 mkdir "%CONSOLE_OUT%\resources\app" 2>nul
@@ -63,22 +62,18 @@ dir "%CONSOLE_OUT%"
 endlocal
 exit /b 0
 
-REM ---- ensure electron binary exists (pnpm skips postinstall by default) -------
-:ensure_electron
-if exist node_modules\electron\dist\electron.exe (
-  echo   electron binary ready
-  exit /b 0
-)
-echo   downloading electron %ELECTRON_VERSION% ...
-curl -L --fail --max-time 900 -o electron-dl.zip "%ELECTRON_MIRROR%/%ELECTRON_VERSION%/electron-v%ELECTRON_VERSION%-win32-x64.zip" || exit /b 1
-powershell -NoProfile -Command "Expand-Archive -LiteralPath 'electron-dl.zip' -DestinationPath 'node_modules/electron/dist' -Force" || exit /b 1
-del /q electron-dl.zip
-echo electron.exe> node_modules\electron\path.txt
-echo   electron binary placed
-exit /b 0
-
-REM ---- install electron runtime once -------------------------------------------
+REM ---- install electron runtime from the official zip (cached) ------------------
 :install_runtime
-xcopy /e /i /y /r "console\node_modules\electron\dist" "%CONSOLE_OUT%" >nul || exit /b 1
+if not exist "dist\cache" mkdir "dist\cache" || exit /b 1
+if not exist "%ELECTRON_ZIP%" (
+  echo   downloading electron %ELECTRON_VERSION% ...
+  curl -L --fail --max-time 900 -o "%ELECTRON_ZIP%" "%ELECTRON_MIRROR%/%ELECTRON_VERSION%/electron-v%ELECTRON_VERSION%-win32-x64.zip" || exit /b 1
+)
+echo   extracting electron runtime ...
+powershell -NoProfile -Command "Expand-Archive -LiteralPath '%ELECTRON_ZIP%' -DestinationPath '%CONSOLE_OUT%' -Force" || exit /b 1
 if exist "%CONSOLE_OUT%\electron.exe" ren "%CONSOLE_OUT%\electron.exe" "Scoreboard Console.exe"
+if not exist "%CONSOLE_OUT%\Scoreboard Console.exe" (
+  echo   [ERROR] electron runtime install failed
+  exit /b 1
+)
 exit /b 0