diff --git a/installer/windows/mototrbod.wxs b/installer/windows/mototrbod.wxs
index f25aeab..b5551b0 100644
--- a/installer/windows/mototrbod.wxs
+++ b/installer/windows/mototrbod.wxs
@@ -19,7 +19,8 @@
       -d StageDir=stage ^
       -o dist\mototrbo-$(Version)-x64.msi
 -->
-<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs">
+<Wix xmlns="http://wixtoolset.org/schemas/v4/wxs"
+     xmlns:fw="http://wixtoolset.org/schemas/v4/wxs/firewall">
   <Package Name="MOTOTRBO Service"
            Manufacturer="mototrbo"
            Version="$(var.Version)"
@@ -60,12 +61,41 @@
                         Account="LocalSystem"
                         Vital="yes"
                         Arguments="service run" />
+        <!--
+          The service is NOT started on install: the shipped
+          mototrbod.toml is a template that still needs TLS certs
+          (or rest_plain_http = true) before the daemon can run, so
+          starting it here would hang the installer waiting for a
+          service that is guaranteed to fail. It IS stopped on
+          upgrade/uninstall and removed on uninstall.
+        -->
         <ServiceControl Id="MototrbodServiceControl"
                         Name="mototrbod"
-                        Start="install"
                         Stop="both"
                         Remove="uninstall"
                         Wait="yes" />
+
+        <!--
+          Firewall rules. Scoped to the mototrbod.exe program so
+          Windows removes them automatically on uninstall alongside
+          the binary's component lifecycle.
+        -->
+        <fw:FirewallException Id="MototrboGrpc"
+                              Name="mototrbo gRPC"
+                              Description="mototrbo gRPC listener"
+                              Port="50051"
+                              Protocol="tcp"
+                              Scope="any"
+                              Profile="all"
+                              IgnoreFailure="yes" />
+        <fw:FirewallException Id="MototrboRest"
+                              Name="mototrbo REST"
+                              Description="mototrbo REST listener"
+                              Port="8443"
+                              Protocol="tcp"
+                              Scope="any"
+                              Profile="all"
+                              IgnoreFailure="yes" />
       </Component>
 
       <Component Id="MototrboctlExe" Bitness="always64">