diff --git a/.github/workflows/release-tauri.yml b/.github/workflows/release-tauri.yml
index 4f87aaea..55e5ac4c 100644
--- a/.github/workflows/release-tauri.yml
+++ b/.github/workflows/release-tauri.yml
@@ -214,6 +214,14 @@ jobs:
             Write-Host "[ok] built $dll (exported $($t.EnvName))"
           }
 
+          # bundle.resources 引用的是 src-tauri/openless-ime-payload/x64/OpenLessIme.dll
+          # （仓库里 commit 的是 0 字节占位让 mac 本地 build 也能 resolve）。
+          # Windows CI 这里用真 x64 dll 覆盖占位，让 NSIS / MSI 包装的是真 dll。
+          $payloadDir = Join-Path $appRoot 'src-tauri\openless-ime-payload\x64'
+          New-Item -ItemType Directory -Force -Path $payloadDir | Out-Null
+          Copy-Item -Force -Path $env:OPENLESS_IME_DLL_X64 -Destination (Join-Path $payloadDir 'OpenLessIme.dll')
+          Write-Host "[ok] copied real x64 dll into bundle.resources payload path"
+
       # ── Windows tauri build：保持 bash shell，因为 PowerShell 调外部命令
       #    会把 '{"bundle":...}' 的内部双引号吃掉、让 tauri 收到无效 JSON。
       #    用 set +e + GITHUB_ENV 把 exit code 传到下一步给 Repair 判断。
@@ -299,6 +307,7 @@ jobs:
           Write-Host "[ok] MSI rebuilt at $msiPath"
 
       # ── Linux：产 deb / rpm / AppImage ──
+      # bundle.resources 里的 Windows TSF DLL 占位对 Linux 包没意义，用空 map 覆盖跳过。
       - name: Build (Linux)
         if: matrix.platform == 'ubuntu-22.04'
         shell: bash
@@ -308,9 +317,11 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
           if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
-            npm run tauri -- build --bundles deb,rpm,appimage --config '{"bundle":{"createUpdaterArtifacts":true}}'
+            npm run tauri -- build --bundles deb,rpm,appimage \
+              --config '{"bundle":{"resources":{},"createUpdaterArtifacts":true}}'
           else
-            npm run tauri -- build --bundles deb,rpm,appimage
+            npm run tauri -- build --bundles deb,rpm,appimage \
+              --config '{"bundle":{"resources":{}}}'
           fi
 
       - name: Disambiguate macOS updater bundle filename
diff --git a/openless-all/app/scripts/build-mac.sh b/openless-all/app/scripts/build-mac.sh
index 63b7c94e..3a51ea81 100755
--- a/openless-all/app/scripts/build-mac.sh
+++ b/openless-all/app/scripts/build-mac.sh
@@ -25,7 +25,9 @@ else
 fi
 
 echo "▶ tauri build"
-TAURI_BUILD_ARGS=(build)
+# bundle.resources 里有 Windows TSF DLL（仅 NSIS/MSI 需要），mac 端用空 map 覆盖避免
+# 把 0 字节占位 OpenLessIme.dll 打进 .app/Contents/Resources。
+TAURI_BUILD_ARGS=(build --config '{"bundle":{"resources":{}}}')
 if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ] || [ -n "${TAURI_SIGNING_PRIVATE_KEY_PATH:-}" ]; then
   TAURI_BUILD_ARGS+=(--config '{"bundle":{"createUpdaterArtifacts":true}}')
 fi
diff --git a/openless-all/app/src-tauri/installer.nsh b/openless-all/app/src-tauri/installer.nsh
new file mode 100644
index 00000000..e3eaf310
--- /dev/null
+++ b/openless-all/app/src-tauri/installer.nsh
@@ -0,0 +1,29 @@
+; NSIS installer hook：注册 / 反注册 OpenLess TSF 输入法 DLL。
+;
+; 背景：MSI 包通过 wix/openless-ime.wxs 的 CustomAction 跑 regsvr32，可正常注册到
+; HKLM 下的 TSF 注册表四件套；NSIS 包没有等价钩子 → NSIS 安装的用户在
+; "设置 → 权限"页面看到 "Windows 输入法后端：不可用"。
+;
+; 这里的 hook 在 NSIS 安装/卸载流程里调 regsvr32 把 OpenLessIme.dll 注册到 HKLM。
+; bundle.resources 把 DLL 拷到 $INSTDIR\tsf-ime\OpenLessIme.dll
+; (resources map 的 target 必须避开 wxs fragment 已声明的 windows-ime\x64\
+; 路径，否则 MSI 包里同一路径会被两个 component 占用)。
+; tauri.conf.json 的 nsis.installMode = "perMachine" 让 NSIS 以管理员身份运行
+; (写 HKLM 必需)。
+;
+; regsvr32 失败时不阻塞安装：用户仍可以靠 SendInput / 粘贴兜底完成上屏。
+
+!macro NSIS_HOOK_POSTINSTALL
+  DetailPrint "Registering OpenLess TSF IME ..."
+  nsExec::ExecToLog '"$SYSDIR\regsvr32.exe" /s "$INSTDIR\tsf-ime\OpenLessIme.dll"'
+  Pop $0
+  ${If} $0 != 0
+    DetailPrint "OpenLess TSF IME registration failed (exit $0); fallback insertion paths still work."
+  ${EndIf}
+!macroend
+
+!macro NSIS_HOOK_PREUNINSTALL
+  DetailPrint "Unregistering OpenLess TSF IME ..."
+  nsExec::ExecToLog '"$SYSDIR\regsvr32.exe" /s /u "$INSTDIR\tsf-ime\OpenLessIme.dll"'
+  Pop $0
+!macroend
diff --git a/openless-all/app/src-tauri/openless-ime-payload/x64/OpenLessIme.dll b/openless-all/app/src-tauri/openless-ime-payload/x64/OpenLessIme.dll
new file mode 100644
index 00000000..e69de29b
diff --git a/openless-all/app/src-tauri/tauri.conf.json b/openless-all/app/src-tauri/tauri.conf.json
index 438315e7..031f75e5 100644
--- a/openless-all/app/src-tauri/tauri.conf.json
+++ b/openless-all/app/src-tauri/tauri.conf.json
@@ -79,6 +79,9 @@
       "icons/icon.icns",
       "icons/icon.ico"
     ],
+    "resources": {
+      "openless-ime-payload/x64/OpenLessIme.dll": "tsf-ime/OpenLessIme.dll"
+    },
     "macOS": {
       "minimumSystemVersion": "12.0",
       "infoPlist": "Info.plist",
@@ -93,6 +96,10 @@
           "OpenLessImeDllX64Component",
           "OpenLessImeDllX86Component"
         ]
+      },
+      "nsis": {
+        "installMode": "perMachine",
+        "installerHooks": "installer.nsh"
       }
     }
   },