diff --git a/.gitea/workflows/build-windows.yml b/.gitea/workflows/build-windows.yml
index a0f68acb3..5512e3779 100644
--- a/.gitea/workflows/build-windows.yml
+++ b/.gitea/workflows/build-windows.yml
@@ -82,14 +82,35 @@ jobs:
           awk '/^\[package\]/{f=1} f; /^\[/&&!/^\[package\]/{f=0}' Cargo.toml | head -10
 
       - name: Install flutter_rust_bridge codegen tools
-        shell: bash
+        shell: pwsh
         run: |
-          cargo install cargo-expand --version "${CARGO_EXPAND_VERSION}" --locked || true
-          cargo install flutter_rust_bridge_codegen --version "${FLUTTER_RUST_BRIDGE_VERSION}" --features uuid --locked || true
+          # Pin the install destination with --root so we don't have to guess at
+          # the runner's $USERPROFILE (act_runner runs as LocalSystem on this host,
+          # which makes $USERPROFILE a non-obvious system path).
+          $tools = 'C:\cargo-tools'
+          New-Item -ItemType Directory -Force -Path "$tools\bin" | Out-Null
+
+          cargo install --root $tools cargo-expand --version "$env:CARGO_EXPAND_VERSION" --locked
+          if ($LASTEXITCODE -ne 0) { throw "cargo install cargo-expand failed ($LASTEXITCODE)" }
+
+          cargo install --root $tools flutter_rust_bridge_codegen --version "$env:FLUTTER_RUST_BRIDGE_VERSION" --features uuid --locked
+          if ($LASTEXITCODE -ne 0) { throw "cargo install flutter_rust_bridge_codegen failed ($LASTEXITCODE)" }
+
+          Write-Host "--- $tools\bin ---"
+          Get-ChildItem "$tools\bin" | Format-Table Name, Length, LastWriteTime
+
+          $expected = Join-Path $tools 'bin\flutter_rust_bridge_codegen.exe'
+          if (-not (Test-Path $expected)) { throw "missing: $expected" }
+
+          Add-Content -Path $env:GITHUB_PATH -Value "$tools\bin"
 
       - name: Generate Rust <-> Dart bridge
         shell: bash
         run: |
+          # Belt-and-suspenders: also prepend cargo-tools to PATH here, in case
+          # GITHUB_PATH propagation from the previous step doesn't take effect.
+          export PATH="/c/cargo-tools/bin:$PATH"
+          command -v flutter_rust_bridge_codegen || { echo "tool not on PATH; PATH=$PATH"; exit 1; }
           pushd flutter && flutter pub get && popd
           flutter_rust_bridge_codegen \
             --rust-input ./src/flutter_ffi.rs \
diff --git a/ci/runners/windows/provision.ps1 b/ci/runners/windows/provision.ps1
index a9004c1ee..e41396b82 100644
--- a/ci/runners/windows/provision.ps1
+++ b/ci/runners/windows/provision.ps1
@@ -54,6 +54,7 @@ choco install -y --no-progress `
     git python311 nuget.commandline 7zip cmake ninja `
     nodejs-lts powershell-core dotnet-sdk
 Add-MachinePath 'C:\Program Files\Git\cmd'
+Add-MachinePath 'C:\Program Files\Git\bin'   # bash.exe + posix tools (sed, find, etc.)
 Add-MachinePath 'C:\Python311'
 Add-MachinePath 'C:\Python311\Scripts'
 Add-MachinePath 'C:\Program Files\nodejs'
@@ -87,6 +88,9 @@ if (-not (Get-Command rustup -ErrorAction SilentlyContinue)) {
     & "$env:TEMP\rustup-init.exe" -y --default-toolchain none --profile minimal
     Add-MachinePath "$env:USERPROFILE\.cargo\bin"
 }
+# Also expose LocalSystem's cargo bin: the act_runner service runs as
+# LocalSystem, so any `cargo install` in a workflow lands here.
+Add-MachinePath 'C:\Windows\System32\config\systemprofile\.cargo\bin'
 rustup toolchain install $RUST_VERSION --profile minimal --component rustfmt
 rustup target add --toolchain $RUST_VERSION x86_64-pc-windows-msvc
 rustup toolchain install $RUST_NIGHTLY --profile minimal --component rustfmt