diff --git a/ci/runners/windows/provision.ps1 b/ci/runners/windows/provision.ps1
index 28c632375..f856ea793 100644
--- a/ci/runners/windows/provision.ps1
+++ b/ci/runners/windows/provision.ps1
@@ -172,6 +172,22 @@ if (-not (Get-Service -Name 'gitea-act-runner' -ErrorAction SilentlyContinue)) {
 Start-Service gitea-act-runner
 Pop-Location
 
+# --- 8. CI prerequisites that aren't tools, but are environmental switches ---
+
+# git's "dubious ownership" check (>= 2.35.2) refuses to operate on a repo whose
+# .git directory is owned by a different user than the one running git.
+# C:\tools\flutter is provisioned by this script (running as admin) but the
+# runner service runs as a non-admin user. Trust everything system-wide.
+git config --system --add safe.directory '*' 2>$null
+
+# Flutter on Windows needs SeCreateSymbolicLinkPrivilege to build plugins.
+# Enabling Developer Mode grants this to all non-admin users without per-user
+# secedit gymnastics.
+$devKey = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModelUnlock'
+if (-not (Test-Path $devKey)) { New-Item -Path $devKey -Force | Out-Null }
+New-ItemProperty -Path $devKey -Name 'AllowDevelopmentWithoutDevLicense' `
+    -PropertyType DWORD -Value 1 -Force | Out-Null
+
 Write-Host ''
 Write-Host '==> Done. Reboot recommended so PATH/env changes take effect for the runner service.'
 Write-Host '    After reboot, verify the runner shows up green in Gitea > Site Admin > Actions > Runners.'