diff --git a/.gitea/workflows/build.yml b/.gitea/workflows/build.yml
index 4e535c0..facb0a2 100644
--- a/.gitea/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -34,8 +34,8 @@ jobs:
 
       - name: Cross-build Windows distribution
         run: |
-          chmod +x build-dist-windows.sh
-          ./build-dist-windows.sh "v${{ inputs.version }}"
+          chmod +x build/build-dist-windows.sh
+          ./build/build-dist-windows.sh "v${{ inputs.version }}"
 
       - uses: actions/upload-artifact@v3
         with:
@@ -70,8 +70,8 @@ jobs:
 
       - name: Build Linux distribution
         run: |
-          chmod +x build-dist.sh
-          ./build-dist.sh "v${{ inputs.version }}"
+          chmod +x build/build-dist.sh
+          ./build/build-dist.sh "v${{ inputs.version }}"
 
       - uses: actions/upload-artifact@v3
         with:
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index dca4d48..5190177 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -135,8 +135,8 @@ jobs:
 
       - name: Cross-build Windows distribution
         run: |
-          chmod +x build-dist-windows.sh
-          ./build-dist-windows.sh "${{ gitea.ref_name }}"
+          chmod +x build/build-dist-windows.sh
+          ./build/build-dist-windows.sh "${{ gitea.ref_name }}"
 
       - name: Upload build artifacts
         uses: actions/upload-artifact@v3
@@ -207,8 +207,8 @@ jobs:
 
       - name: Build Linux distribution
         run: |
-          chmod +x build-dist.sh
-          ./build-dist.sh "${{ gitea.ref_name }}"
+          chmod +x build/build-dist.sh
+          ./build/build-dist.sh "${{ gitea.ref_name }}"
 
       - name: Upload build artifact
         uses: actions/upload-artifact@v3
diff --git a/.gitignore b/.gitignore
index 24db73b..3599186 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,7 +4,16 @@ __pycache__/
 *$py.class
 *.so
 .Python
-build/
+# Build output artifacts (LedGrab/, *.zip, *.exe, *.tar.gz, cached downloads)
+build/LedGrab/
+build/*.zip
+build/*.exe
+build/*.tar.gz
+build/*.msi
+build/python-embed-*.zip
+build/pip-wheels/
+build/win-wheels/
+build/tk-extract/
 develop-eggs/
 dist/
 downloads/
diff --git a/build-common.sh b/build/build-common.sh
similarity index 100%
rename from build-common.sh
rename to build/build-common.sh
diff --git a/build-dist-windows.sh b/build/build-dist-windows.sh
similarity index 98%
rename from build-dist-windows.sh
rename to build/build-dist-windows.sh
index a48dcfa..a2f64bc 100644
--- a/build-dist-windows.sh
+++ b/build/build-dist-windows.sh
@@ -14,10 +14,11 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-BUILD_DIR="$SCRIPT_DIR/build"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+BUILD_DIR="$SCRIPT_DIR"
 DIST_NAME="LedGrab"
 DIST_DIR="$BUILD_DIR/$DIST_NAME"
-SERVER_DIR="$SCRIPT_DIR/server"
+SERVER_DIR="$REPO_ROOT/server"
 PYTHON_DIR="$DIST_DIR/python"
 APP_DIR="$DIST_DIR/app"
 PYTHON_VERSION="${PYTHON_VERSION:-3.11.9}"
@@ -340,7 +341,7 @@ sed -i 's/$/\r/' "$DIST_DIR/LedGrab.bat"
 
 # Copy hidden launcher VBS
 mkdir -p "$DIST_DIR/scripts"
-cp server/scripts/start-hidden.vbs "$DIST_DIR/scripts/"
+cp "$SERVER_DIR/scripts/start-hidden.vbs" "$DIST_DIR/scripts/"
 
 # ── Create autostart scripts ─────────────────────────────────
 
diff --git a/build-dist.ps1 b/build/build-dist.ps1
similarity index 98%
rename from build-dist.ps1
rename to build/build-dist.ps1
index 15613ad..0f6cb60 100644
--- a/build-dist.ps1
+++ b/build/build-dist.ps1
@@ -34,11 +34,11 @@ param(
 $ErrorActionPreference = 'Stop'
 $ProgressPreference = 'SilentlyContinue'  # faster downloads
 
-$ScriptRoot = $PSScriptRoot
-$BuildDir = Join-Path $ScriptRoot "build"
+$RepoRoot = Split-Path $PSScriptRoot -Parent
+$BuildDir = $PSScriptRoot
 $DistName = "LedGrab"
 $DistDir = Join-Path $BuildDir $DistName
-$ServerDir = Join-Path $ScriptRoot "server"
+$ServerDir = Join-Path $RepoRoot "server"
 $PythonDir = Join-Path $DistDir "python"
 $AppDir = Join-Path $DistDir "app"
 
diff --git a/build-dist.sh b/build/build-dist.sh
similarity index 98%
rename from build-dist.sh
rename to build/build-dist.sh
index 93b1a8d..f2faf5f 100644
--- a/build-dist.sh
+++ b/build/build-dist.sh
@@ -10,10 +10,11 @@
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-BUILD_DIR="$SCRIPT_DIR/build"
+REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+BUILD_DIR="$SCRIPT_DIR"
 DIST_NAME="LedGrab"
 DIST_DIR="$BUILD_DIR/$DIST_NAME"
-SERVER_DIR="$SCRIPT_DIR/server"
+SERVER_DIR="$REPO_ROOT/server"
 VENV_DIR="$DIST_DIR/venv"
 APP_DIR="$DIST_DIR/app"
 
diff --git a/installer.nsi b/build/installer.nsi
similarity index 96%
rename from installer.nsi
rename to build/installer.nsi
index d402076..73df191 100644
--- a/installer.nsi
+++ b/build/installer.nsi
@@ -22,7 +22,7 @@
 !endif
 
 Name "${APPNAME} v${VERSION}"
-OutFile "build\${APPNAME}-v${VERSION}-win-x64-setup.exe"
+OutFile "${APPNAME}-v${VERSION}-win-x64-setup.exe"
 InstallDir "$LOCALAPPDATA\${APPNAME}"
 InstallDirRegKey HKCU "Software\${APPNAME}" "InstallDir"
 RequestExecutionLevel user
@@ -30,8 +30,8 @@ SetCompressor /SOLID lzma
 
 ; ── Modern UI Configuration ─────────────────────────────────
 
-!define MUI_ICON "server\src\ledgrab\static\icons\icon.ico"
-!define MUI_UNICON "server\src\ledgrab\static\icons\icon.ico"
+!define MUI_ICON "..\server\src\ledgrab\static\icons\icon.ico"
+!define MUI_UNICON "..\server\src\ledgrab\static\icons\icon.ico"
 !define MUI_ABORTWARNING
 
 ; ── Pages ───────────────────────────────────────────────────
@@ -100,10 +100,10 @@ Section "!${APPNAME} (required)" SecCore
   Delete "$INSTDIR\LedGrab.bat"
 
   ; Copy the entire portable build
-  File /r "build\LedGrab\python"
-  File /r "build\LedGrab\app"
-  File /r "build\LedGrab\scripts"
-  File "build\LedGrab\LedGrab.bat"
+  File /r "LedGrab\python"
+  File /r "LedGrab\app"
+  File /r "LedGrab\scripts"
+  File "LedGrab\LedGrab.bat"
 
   ; Create data and logs directories
   CreateDirectory "$INSTDIR\data"
diff --git a/contexts/ci-cd.md b/contexts/ci-cd.md
index eeac147..e2aaed6 100644
--- a/contexts/ci-cd.md
+++ b/contexts/ci-cd.md
@@ -17,7 +17,7 @@ Four parallel jobs triggered by pushing a `v*` tag:
 Creates the Gitea release with a description table listing all artifacts. **The description must stay in sync with actual build outputs** — if you add/remove/rename an artifact, update the body template here.
 
 ### 2. `build-windows` (cross-built from Linux)
-- Runs `build-dist-windows.sh` on Ubuntu with NSIS + msitools
+- Runs `build/build-dist-windows.sh` on Ubuntu with NSIS + msitools
 - Downloads Windows embedded Python 3.11 + pip wheels cross-platform
 - Bundles tkinter from Python MSI via msiextract
 - Builds frontend (`npm run build`)
@@ -25,7 +25,7 @@ Creates the Gitea release with a description table listing all artifacts. **The
 - Produces: **`LedGrab-{tag}-win-x64.zip`** (portable) and **`LedGrab-{tag}-setup.exe`** (NSIS installer)
 
 ### 3. `build-linux`
-- Runs `build-dist.sh` on Ubuntu
+- Runs `build/build-dist.sh` on Ubuntu
 - Creates a venv, installs deps, builds frontend
 - Produces: **`LedGrab-{tag}-linux-x64.tar.gz`**
 
@@ -38,8 +38,8 @@ Creates the Gitea release with a description table listing all artifacts. **The
 
 | Script | Platform | Output |
 |--------|----------|--------|
-| `build-dist-windows.sh` | Linux → Windows cross-build | ZIP + NSIS installer |
-| `build-dist.sh` | Linux native | tarball |
+| `build/build-dist-windows.sh` | Linux → Windows cross-build | ZIP + NSIS installer |
+| `build/build-dist.sh` | Linux native | tarball |
 | `server/Dockerfile` | Docker | Container image |
 
 ## Release Versioning
@@ -71,7 +71,7 @@ Build scripts use a fallback chain: CLI argument → exact git tag → CI env va
 - **Launch after install**: Use `MUI_FINISHPAGE_RUN_FUNCTION` (not `MUI_FINISHPAGE_RUN_PARAMETERS` — NSIS `Exec` chokes on quoting). Still requires `MUI_FINISHPAGE_RUN ""` defined for checkbox visibility
 - **Detect running instance**: `.onInit` checks file lock on `python.exe`, offers to kill process before install
 - **Uninstall preserves user data**: Remove `python/`, `app/`, `logs/` but NOT `data/`
-- **CI build**: `sudo apt-get install -y nsis msitools zip` then `makensis -DVERSION="${VERSION}" installer.nsi`
+- **CI build**: `sudo apt-get install -y nsis msitools zip` then `makensis -DVERSION="${VERSION}" build/installer.nsi`
 
 ## Hidden Launcher (VBS)
 
@@ -135,12 +135,12 @@ The `create-release` job has fallback logic — if the release already exists fo
 
 ```bash
 npm ci && npm run build                                              # frontend
-bash build-dist-windows.sh v1.0.0                                   # Windows dist
-"/c/Program Files (x86)/NSIS/makensis.exe" -DVERSION="1.0.0" installer.nsi  # installer
+bash build/build-dist-windows.sh v1.0.0                              # Windows dist
+"/c/Program Files (x86)/NSIS/makensis.exe" -DVERSION="1.0.0" build/installer.nsi  # installer
 ```
 
 ### Iterating on installer only
-If only `installer.nsi` changed (not app code), skip the full rebuild — just re-run `makensis`. If app code changed, re-run `build-dist-windows.sh` first since `dist/` is a snapshot.
+If only `installer.nsi` changed (not app code), skip the full rebuild — just re-run `makensis`. If app code changed, re-run `build/build-dist-windows.sh` first since `dist/` is a snapshot.
 
 ### Common issues