diff --git a/cli.go b/cli.go
index b5f850a..5a6d8fb 100644
--- a/cli.go
+++ b/cli.go
@@ -72,12 +72,10 @@ func runSelfUpdate(args []string) {
 	if err != nil {
 		log.Fatalf("[!] Update failed: cannot read config from %s: %v", configPath, err)
 	}
-	cfg := cm.Get()
-	serverURL := strings.TrimRight(cfg.ServerURL, "/")
-	if serverURL == "" {
-		log.Fatalf("[!] Update failed: server_url is empty in %s", configPath)
-	}
+	_ = cm.Get()
 
+	// Binaries are GitHub release artifacts (DESIGN-WINDOWS.md §9); nothing
+	// binary is served from the SSO's /resources anymore.
 	arch := "amd64"
 	if runtime.GOARCH == "arm64" {
 		arch = "arm64"
@@ -87,7 +85,7 @@ func runSelfUpdate(args []string) {
 		ext = ".exe"
 	}
 	artifact := fmt.Sprintf("theta-agent-%s-%s%s", runtime.GOOS, arch, ext)
-	downloadURL := fmt.Sprintf("%s/resources/theta-agent/%s", serverURL, artifact)
+	downloadURL := releaseAssetURL(artifact)
 	log.Printf("[+] Downloading latest Theta Agent binary from %s...", downloadURL)
 
 	client := &http.Client{Timeout: 30 * time.Second}
@@ -162,6 +160,13 @@ func runReinitialize(args []string) {
 	os.Exit(0)
 }
 
+// releaseAssetURL returns the GitHub release download URL for a theta-agent
+// artifact (e.g. "theta-agent-linux-amd64"). Binaries are built by CI and
+// attached to the release; nothing binary lives in the repos (DESIGN-WINDOWS.md §9).
+func releaseAssetURL(artifact string) string {
+	return "https://github.com/theta42/theta-agent/releases/latest/download/" + artifact
+}
+
 func restartAffectedServices(exec Executor) {
 	log.Printf("[+] Restarting theta-agent service...")
 	if runtime.GOOS == "windows" {
diff --git a/installer/windows/installer.iss b/installer/windows/installer.iss
index 06a737a..ff131a7 100644
--- a/installer/windows/installer.iss
+++ b/installer/windows/installer.iss
@@ -91,8 +91,10 @@ Filename: "msiexec.exe"; Parameters: "/i ""{app}\vendor\wireguard-amd64-0.5.3.ms
 Filename: "taskkill.exe"; Parameters: "/f /im wireguard.exe"; Flags: runhidden
 ; Register the agent as a SYSTEM auto-start service.
 Filename: "{app}\{#MyAppExeName}"; Parameters: "install-service"; StatusMsg: "Registering theta-agent service..."; Flags: runhidden waituntilterminated
-; Show the tray right away instead of waiting for the next logon.
-Filename: "{app}\tray\theta-agent-tray-windows-amd64.exe"; Description: "Start Theta Agent tray"; StatusMsg: "Starting Theta Agent tray..."; Flags: nowait postinstall skipifsilent
+; Show the tray right away, in silent and interactive installs alike (a silent
+; install is the common path from the Directory's install command, and the tray
+; should appear immediately there too, not only at the next logon).
+Filename: "{app}\tray\theta-agent-tray-windows-amd64.exe"; Description: "Start Theta Agent tray"; StatusMsg: "Starting Theta Agent tray..."; Flags: nowait postinstall
 
 [Code]
 var
@@ -206,11 +208,15 @@ begin
   CreateAgentConfigPage();
 end;
 
-// Pull the values the operator typed into the wizard so WriteAgentConfig can use
-// them; silent installs keep the command-line params.
+// Pull the values the operator typed into the wizard so WriteAgentConfig can
+// use them. In silent mode the wizard is walked programmatically and
+// CurPageChanged fires too -- reading the (empty) edit boxes there would wipe
+// the /SERVER_URL /JOIN_KEY command-line params and leave agent.yml with an
+// empty server_url. Only take the edit values when the wizard is actually
+// being shown interactively.
 procedure CurPageChanged(CurPageID: Integer);
 begin
-  if CurPageID = AgentConfigPage.ID then begin
+  if (CurPageID = AgentConfigPage.ID) and (not WizardSilent()) then begin
     ServerURL := Trim(ServerURLEdit.Text);
     JoinKey := Trim(JoinKeyEdit.Text);
   end;