diff --git a/make-chrome-zip.ps1 b/make-chrome-zip.ps1
new file mode 100644
index 0000000..c7ac5fe
--- /dev/null
+++ b/make-chrome-zip.ps1
@@ -0,0 +1,47 @@
+Add-Type -AssemblyName System.IO.Compression
+Add-Type -AssemblyName System.IO.Compression.FileSystem
+
+$src  = 'A:\Progetti\00 PassKey\PK4\extensions\chrome'
+
+# Read the version from the manifest so the package name always matches the extension.
+$version = (Get-Content (Join-Path $src 'manifest.json') -Raw | ConvertFrom-Json).version
+$dest = "A:\Progetti\00 PassKey\PK4\passkey-chrome-$version.zip"
+
+if (Test-Path $dest) { Remove-Item $dest -Force }
+
+$stream = [System.IO.File]::Open($dest, [System.IO.FileMode]::Create)
+$zip    = [System.IO.Compression.ZipArchive]::new($stream, [System.IO.Compression.ZipArchiveMode]::Create)
+
+Get-ChildItem -Path $src -Recurse -File | ForEach-Object {
+    $relative = $_.FullName.Substring($src.Length + 1).Replace('\', '/')
+
+    if ($relative -eq 'manifest.json') {
+        # Strip the "key" field — Chrome Web Store rejects manifests that contain it
+        $json = Get-Content $_.FullName -Raw | ConvertFrom-Json
+        $json.PSObject.Properties.Remove('key')
+        $content = ($json | ConvertTo-Json -Depth 10)
+        $bytes   = [System.Text.Encoding]::UTF8.GetBytes($content)
+        $entry   = $zip.CreateEntry($relative)
+        $writer  = $entry.Open()
+        $writer.Write($bytes, 0, $bytes.Length)
+        $writer.Dispose()
+        Write-Host "  Added: $relative  (key field stripped)"
+    } else {
+        [System.IO.Compression.ZipFileExtensions]::CreateEntryFromFile($zip, $_.FullName, $relative) | Out-Null
+        Write-Host "  Added: $relative"
+    }
+}
+
+$zip.Dispose()
+$stream.Dispose()
+
+# Verify
+$zip2    = [System.IO.Compression.ZipFile]::OpenRead($dest)
+$entries = $zip2.Entries | ForEach-Object { $_.FullName } | Sort-Object
+$zip2.Dispose()
+
+Write-Host ""
+Write-Host "ZIP contents:" -ForegroundColor Cyan
+$entries | ForEach-Object { Write-Host "  $_" }
+Write-Host ""
+Write-Host ("Done! Size: " + [math]::Round((Get-Item $dest).Length / 1KB, 1) + " KB") -ForegroundColor Green
diff --git a/make-xpi.ps1 b/make-xpi.ps1
new file mode 100644
index 0000000..3ed0932
--- /dev/null
+++ b/make-xpi.ps1
@@ -0,0 +1,33 @@
+Add-Type -AssemblyName System.IO.Compression
+Add-Type -AssemblyName System.IO.Compression.FileSystem
+
+$src  = 'A:\Progetti\00 PassKey\PK4\extensions\firefox'
+
+# Read the version from the manifest so the package name always matches the extension.
+$version = (Get-Content (Join-Path $src 'manifest.json') -Raw | ConvertFrom-Json).version
+$dest = "A:\Progetti\00 PassKey\PK4\passkey-firefox-$version.xpi"
+
+if (Test-Path $dest) { Remove-Item $dest -Force }
+
+$stream = [System.IO.File]::Open($dest, [System.IO.FileMode]::Create)
+$zip    = [System.IO.Compression.ZipArchive]::new($stream, [System.IO.Compression.ZipArchiveMode]::Create)
+
+Get-ChildItem -Path $src -Recurse -File | ForEach-Object {
+    $relative = $_.FullName.Substring($src.Length + 1).Replace('\', '/')
+    [System.IO.Compression.ZipFileExtensions]::CreateEntryFromFile($zip, $_.FullName, $relative) | Out-Null
+    Write-Host "  Added: $relative"
+}
+
+$zip.Dispose()
+$stream.Dispose()
+
+# Verify
+$zip2    = [System.IO.Compression.ZipFile]::OpenRead($dest)
+$entries = $zip2.Entries | ForEach-Object { $_.FullName } | Sort-Object
+$zip2.Dispose()
+
+Write-Host ""
+Write-Host "XPI contents:" -ForegroundColor Cyan
+$entries | ForEach-Object { Write-Host "  $_" }
+Write-Host ""
+Write-Host ("Done! Size: " + [math]::Round((Get-Item $dest).Length / 1KB, 1) + " KB") -ForegroundColor Green
diff --git a/scripts/build-installer.ps1 b/scripts/build-installer.ps1
index f2b4073..192028d 100644
--- a/scripts/build-installer.ps1
+++ b/scripts/build-installer.ps1
@@ -95,6 +95,20 @@ $firefoxManifest = @{
 $chromeManifest  | Out-File -Encoding utf8 -FilePath (Join-Path $publishPath "com.passkey.host.json")
 $firefoxManifest | Out-File -Encoding utf8 -FilePath (Join-Path $publishPath "com.passkey.host.firefox.json")
 
+# 3.5 Ensure the Windows App Runtime redistributable is present.
+# Installer\PassKey.iss bundles WindowsAppRuntimeInstall-x64.exe as a [Files] Source,
+# but that binary is git-ignored (too large to commit). On a fresh CI runner it is
+# missing, so download it here before invoking Inno Setup. Download-Runtime.ps1 holds
+# the authoritative aka.ms URL pinned to the WindowsAppSDK package version.
+$runtimeExe = Join-Path $RepoRoot "Installer\WindowsAppRuntimeInstall-x64.exe"
+if (-not (Test-Path $runtimeExe)) {
+    Write-Host "Windows App Runtime redistributable missing — downloading..." -ForegroundColor Green
+    & (Join-Path $RepoRoot "Installer\Download-Runtime.ps1")
+    if (-not (Test-Path $runtimeExe)) { throw "Failed to obtain WindowsAppRuntimeInstall-x64.exe" }
+} else {
+    Write-Host "Windows App Runtime redistributable already present." -ForegroundColor Green
+}
+
 # 4. Compile Inno Setup installer
 if (Test-Path $InnoSetupPath) {
     Write-Host "Compiling Inno Setup installer..." -ForegroundColor Green