diff --git a/.github/workflows/windows-testing-build.yml b/.github/workflows/windows-testing-build.yml
new file mode 100644
index 000000000..95bd1e326
--- /dev/null
+++ b/.github/workflows/windows-testing-build.yml
@@ -0,0 +1,68 @@
+name: Windows testing build
+
+# Manual/tag Windows testing build. Click "Run workflow" in the Actions tab (or push
+# a 0.0.0-testing-* tag) and it builds the unsigned Windows desktop app via the
+# Squirrel maker, cuts a prerelease tagged 0.0.0-testing-<short-sha>, and attaches
+# the Setup.exe (+ .nupkg / RELEASES).
+#
+# Unsigned: Windows SmartScreen will warn on first run ("More info" -> "Run anyway").
+# Code signing is a follow-up.
+#
+# The daemon is compiled natively on the windows runner by build-daemon.mjs during
+# premake (host == target), so the bundled ao.exe is a real Windows binary.
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "0.0.0-testing-*"
+
+jobs:
+  build:
+    runs-on: windows-latest
+    permissions:
+      contents: write
+    defaults:
+      run:
+        working-directory: frontend
+    env:
+      # Pure-Go sqlite (modernc) needs no cgo.
+      CGO_ENABLED: 0
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: backend/go.mod
+          cache-dependency-path: backend/go.sum
+      - run: npm ci
+      - name: Build Windows installer (unsigned)
+        # `npm run make` keeps the premake daemon build; --targets restricts to the
+        # Squirrel maker (Setup.exe + .nupkg + RELEASES).
+        run: npm run make -- --targets @electron-forge/maker-squirrel
+      - name: Publish to a 0.0.0-testing-<sha> prerelease
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # Tag push: use the pushed tag. Manual run: mint 0.0.0-testing-<sha>.
+          if [ "${GITHUB_REF_TYPE}" = "tag" ]; then
+            TAG="${GITHUB_REF_NAME}"
+          else
+            TAG="0.0.0-testing-${GITHUB_SHA::7}"
+          fi
+          # Creates the tag at this commit if it does not exist; idempotent on re-run.
+          # Shared with the Linux job on a tag push: distinct asset names, --clobber.
+          gh release create "$TAG" --prerelease --target "$GITHUB_SHA" --title "$TAG" \
+            --notes "Unsigned testing build. Not signed; for testing only." \
+            || true
+          # NUL-delimited to survive spaces in the app name ("Agent Orchestrator-...").
+          find out/make -type f -print0 | while IFS= read -r -d '' f; do
+            echo "uploading: $f"
+            gh release upload "$TAG" "$f" --clobber
+          done