diff --git a/.github/workflows/release-tauri.yml b/.github/workflows/release-tauri.yml
index 4f87aaea..c5f4099d 100644
--- a/.github/workflows/release-tauri.yml
+++ b/.github/workflows/release-tauri.yml
@@ -212,6 +212,16 @@ jobs:
             }
             "$($t.EnvName)=$dll" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
             Write-Host "[ok] built $dll (exported $($t.EnvName))"
+
+            # bundle.resources 引用的是 src-tauri/openless-ime-payload/{x64,x86}/OpenLessIme.dll
+            # （仓库里 commit 的是 0 字节占位让 mac 本地 build 也能 resolve）。
+            # 这里用真 dll 覆盖占位，让 NSIS / MSI 都装上真文件；NSIS hook 的 regsvr32
+            # 同时会把 64 / 32 位 COM 注册到 HKLM\Software\Classes\CLSID 的
+            # KEY_WOW64_64KEY / KEY_WOW64_32KEY 两侧（windows_ime_profile.rs 都会查）。
+            $payloadDir = Join-Path $appRoot "src-tauri\openless-ime-payload\$($t.Folder)"
+            New-Item -ItemType Directory -Force -Path $payloadDir | Out-Null
+            Copy-Item -Force -Path $dll -Destination (Join-Path $payloadDir 'OpenLessIme.dll')
+            Write-Host "[ok] copied real $($t.Folder) dll into bundle.resources payload path"
           }
 
       # ── Windows tauri build：保持 bash shell，因为 PowerShell 调外部命令
@@ -299,6 +309,7 @@ jobs:
           Write-Host "[ok] MSI rebuilt at $msiPath"
 
       # ── Linux：产 deb / rpm / AppImage ──
+      # bundle.resources 里的 Windows TSF DLL 占位对 Linux 包没意义，用空 map 覆盖跳过。
       - name: Build (Linux)
         if: matrix.platform == 'ubuntu-22.04'
         shell: bash
@@ -308,9 +319,11 @@ jobs:
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         run: |
           if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ]; then
-            npm run tauri -- build --bundles deb,rpm,appimage --config '{"bundle":{"createUpdaterArtifacts":true}}'
+            npm run tauri -- build --bundles deb,rpm,appimage \
+              --config '{"bundle":{"resources":{},"createUpdaterArtifacts":true}}'
           else
-            npm run tauri -- build --bundles deb,rpm,appimage
+            npm run tauri -- build --bundles deb,rpm,appimage \
+              --config '{"bundle":{"resources":{}}}'
           fi
 
       - name: Disambiguate macOS updater bundle filename
diff --git a/openless-all/app/scripts/build-mac.sh b/openless-all/app/scripts/build-mac.sh
index 63b7c94e..3a51ea81 100755
--- a/openless-all/app/scripts/build-mac.sh
+++ b/openless-all/app/scripts/build-mac.sh
@@ -25,7 +25,9 @@ else
 fi
 
 echo "▶ tauri build"
-TAURI_BUILD_ARGS=(build)
+# bundle.resources 里有 Windows TSF DLL（仅 NSIS/MSI 需要），mac 端用空 map 覆盖避免
+# 把 0 字节占位 OpenLessIme.dll 打进 .app/Contents/Resources。
+TAURI_BUILD_ARGS=(build --config '{"bundle":{"resources":{}}}')
 if [ -n "${TAURI_SIGNING_PRIVATE_KEY:-}" ] || [ -n "${TAURI_SIGNING_PRIVATE_KEY_PATH:-}" ]; then
   TAURI_BUILD_ARGS+=(--config '{"bundle":{"createUpdaterArtifacts":true}}')
 fi
diff --git a/openless-all/app/src-tauri/installer.nsh b/openless-all/app/src-tauri/installer.nsh
new file mode 100644
index 00000000..e6675c39
--- /dev/null
+++ b/openless-all/app/src-tauri/installer.nsh
@@ -0,0 +1,52 @@
+; NSIS installer hook：注册 / 反注册 OpenLess TSF 输入法 DLL。
+;
+; 背景：MSI 包通过 wix/openless-ime.wxs 的 CustomAction 跑 regsvr32，可正常注册到
+; HKLM 下的 TSF 注册表四件套；NSIS 包没有等价钩子 → NSIS 安装的用户在
+; "设置 → 权限"页面看到 "Windows 输入法后端：不可用"。
+;
+; 这里的 hook 在 NSIS 安装/卸载流程里调 regsvr32 把 OpenLessIme.dll 注册到 HKLM。
+; bundle.resources 把 x64 / x86 DLL 拷到 $INSTDIR\tsf-ime\{x64,x86}\OpenLessIme.dll
+; (resources map 的 target 必须避开 wxs fragment 已声明的 windows-ime\x64\
+; 路径，否则 MSI 包里同一路径会被两个 component 占用)。
+; tauri.conf.json 的 nsis.installMode = "perMachine" 让 NSIS 以管理员身份运行
+; (写 HKLM 必需)。
+;
+; 必须同时注册 x64 + x86 两份 dll：windows_ime_profile.rs 的
+; inspect_windows_ime_registration() 会用 KEY_WOW64_64KEY 和 KEY_WOW64_32KEY 两次
+; 检查 HKLM CLSID InprocServer32，少了任何一边都会被判 RegistrationBroken。
+;
+; ⚠️ NSIS installer 自身是 32-bit 进程，会触发 WOW64 文件系统重定向：
+;   - 32-bit 进程里的 $SYSDIR / $WINDIR\System32 都被重定向到 $WINDIR\SysWOW64，
+;     运行的是 32-bit regsvr32 → 注册结果落在 HKLM\Software\Wow6432Node（即
+;     KEY_WOW64_32KEY 视图），Rust 端 KEY_WOW64_64KEY 查不到 → 仍判"不可用"。
+;   - 32-bit 进程访问真正的 64-bit System32 必须走 $WINDIR\Sysnative 这个 alias。
+; 因此：
+;   - x64 dll → $WINDIR\Sysnative\regsvr32.exe → 写 KEY_WOW64_64KEY 视图
+;   - x86 dll → $WINDIR\SysWOW64\regsvr32.exe  → 写 KEY_WOW64_32KEY 视图
+;
+; regsvr32 失败时不阻塞安装：用户仍可以靠 SendInput / 粘贴兜底完成上屏。
+
+!macro NSIS_HOOK_POSTINSTALL
+  DetailPrint "Registering OpenLess TSF IME (x64) ..."
+  nsExec::ExecToLog '"$WINDIR\Sysnative\regsvr32.exe" /s "$INSTDIR\tsf-ime\x64\OpenLessIme.dll"'
+  Pop $0
+  ${If} $0 != 0
+    DetailPrint "OpenLess TSF IME x64 registration failed (exit $0); fallback insertion paths still work."
+  ${EndIf}
+
+  DetailPrint "Registering OpenLess TSF IME (x86) ..."
+  nsExec::ExecToLog '"$WINDIR\SysWOW64\regsvr32.exe" /s "$INSTDIR\tsf-ime\x86\OpenLessIme.dll"'
+  Pop $0
+  ${If} $0 != 0
+    DetailPrint "OpenLess TSF IME x86 registration failed (exit $0); fallback insertion paths still work."
+  ${EndIf}
+!macroend
+
+!macro NSIS_HOOK_PREUNINSTALL
+  DetailPrint "Unregistering OpenLess TSF IME (x86) ..."
+  nsExec::ExecToLog '"$WINDIR\SysWOW64\regsvr32.exe" /s /u "$INSTDIR\tsf-ime\x86\OpenLessIme.dll"'
+  Pop $0
+  DetailPrint "Unregistering OpenLess TSF IME (x64) ..."
+  nsExec::ExecToLog '"$WINDIR\Sysnative\regsvr32.exe" /s /u "$INSTDIR\tsf-ime\x64\OpenLessIme.dll"'
+  Pop $0
+!macroend
diff --git a/openless-all/app/src-tauri/openless-ime-payload/x64/OpenLessIme.dll b/openless-all/app/src-tauri/openless-ime-payload/x64/OpenLessIme.dll
new file mode 100644
index 00000000..e69de29b
diff --git a/openless-all/app/src-tauri/openless-ime-payload/x86/OpenLessIme.dll b/openless-all/app/src-tauri/openless-ime-payload/x86/OpenLessIme.dll
new file mode 100644
index 00000000..e69de29b
diff --git a/openless-all/app/src-tauri/tauri.conf.json b/openless-all/app/src-tauri/tauri.conf.json
index 438315e7..f61d699c 100644
--- a/openless-all/app/src-tauri/tauri.conf.json
+++ b/openless-all/app/src-tauri/tauri.conf.json
@@ -79,6 +79,10 @@
       "icons/icon.icns",
       "icons/icon.ico"
     ],
+    "resources": {
+      "openless-ime-payload/x64/OpenLessIme.dll": "tsf-ime/x64/OpenLessIme.dll",
+      "openless-ime-payload/x86/OpenLessIme.dll": "tsf-ime/x86/OpenLessIme.dll"
+    },
     "macOS": {
       "minimumSystemVersion": "12.0",
       "infoPlist": "Info.plist",
@@ -93,6 +97,10 @@
           "OpenLessImeDllX64Component",
           "OpenLessImeDllX86Component"
         ]
+      },
+      "nsis": {
+        "installMode": "perMachine",
+        "installerHooks": "installer.nsh"
       }
     }
   },