diff --git a/src-tauri/resources/windows/README.md b/src-tauri/resources/windows/README.md
new file mode 100644
index 0000000..b60540c
--- /dev/null
+++ b/src-tauri/resources/windows/README.md
@@ -0,0 +1,29 @@
+# Windows bundle resources
+
+Files in this directory ship side-by-side with `kon.exe` to avoid the
+DLL-hell failure modes reported in Whispering #840 / #829 and Buzz
+#1459. They are **not** committed to the repo — populate them from a
+trusted source before running `cargo tauri build --target
+x86_64-pc-windows-msvc`:
+
+| File | Source | Why |
+|---|---|---|
+| `vulkan-1.dll` | [LunarG Vulkan SDK](https://vulkan.lunarg.com/sdk/home) runtime installer, or copied from `C:\Windows\System32\vulkan-1.dll` on a machine with Vulkan-capable GPU drivers | whisper.cpp's Vulkan backend refuses to initialise without it |
+| `libssl-3-x64.dll`, `libcrypto-3-x64.dll` | OpenSSL 3.x Windows build (e.g. shining-light installer) or copied from the user's `%SystemRoot%\system32` | reqwest → rustls transitively pulls these when TLS-backed downloads fail in CI; shipping them removes the "app fails to download model" class of bug |
+
+The runtime falls back gracefully if any of these are missing at launch:
+see `src-tauri/src/commands/models.rs::detect_active_compute_device`
+and `emit_runtime_warnings` — the app will emit a `runtime-warning`
+event with kind `vulkan-loader-missing`, downgrade the reported
+`activeComputeDevice` to CPU, and keep running. The bundle is a
+performance + reliability patch, not a load-bearing dependency.
+
+## Why isn't this a script?
+
+Licensing. We deliberately don't auto-fetch these DLLs from a CI job —
+the LunarG SDK ships under the Apache 2.0 license but redistribution is
+conditional on an acknowledgment, and the OpenSSL 3 bundling terms want
+a source-availability note in the installer. Manual placement keeps the
+redistribution legally clean per-release.
+
+Brief reference: docs/whisper-ecosystem/brief.md item #12.
diff --git a/src-tauri/tauri.windows.conf.json b/src-tauri/tauri.windows.conf.json
new file mode 100644
index 0000000..40b7078
--- /dev/null
+++ b/src-tauri/tauri.windows.conf.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "_comment": "Windows-only bundle overrides. Brief item #12: ship the Vulkan loader + libssl side-by-side so whisper.cpp's Vulkan backend can initialise on a fresh Windows box without the user installing extra runtimes. If the loader is absent at runtime, emit_runtime_warnings() downgrades activeComputeDevice to CPU with a reason — the app still starts and transcribes, just slower.",
+  "bundle": {
+    "resources": [
+      "resources/windows/vulkan-1.dll",
+      "resources/windows/libssl-3-x64.dll",
+      "resources/windows/libcrypto-3-x64.dll"
+    ]
+  }
+}