diff --git a/BUILD-AND-DEPLOY.md b/BUILD-AND-DEPLOY.md
index 0bc6e83..eafe674 100644
--- a/BUILD-AND-DEPLOY.md
+++ b/BUILD-AND-DEPLOY.md
@@ -70,6 +70,12 @@ Notes:
   for you. The TV's updater compares versions numerically and only offers a HIGHER version.
 - If `WIN_CSC_LINK` / `CSC_LINK` / `CSC_KEY_PASSWORD` / `CSC_KEYCHAIN` exist in your environment,
   `build-win.cjs` removes them for the build (electron-builder aborts on an EMPTY `WIN_CSC_LINK`).
+- **Keep `build/installerIcon.ico`.** On macOS electron-builder rebuilds the uninstaller in JavaScript
+  and leaves out NSIS's icon patch; if the installer and uninstaller icons differ, the uninstaller fails
+  NSIS's integrity check, and that version can then never be updated or uninstalled. This file makes
+  both use one icon (NSIS's own default, so nothing looks different). `build-win.cjs` refuses to build
+  without it. Versions 1.4.35–1.4.37 shipped without it; `build/installer.nsh` installs over their
+  damaged uninstallers instead of running them.
 - On Windows, if the build fails while extracting `winCodeSign` (symlink / permission errors), run the
   terminal as administrator or turn on Developer Mode, delete
   `%LOCALAPPDATA%\electron-builder\Cache\winCodeSign`, and build again.
diff --git a/build/installer.nsh b/build/installer.nsh
index 98ca94e..1c674c3 100644
--- a/build/installer.nsh
+++ b/build/installer.nsh
@@ -42,4 +42,33 @@
   nsExec::Exec $2
   Pop $0
   Sleep 1000
+  !insertmacro bibleAppSkipDamagedUninstaller SHELL_CONTEXT
+  !insertmacro bibleAppSkipDamagedUninstaller HKCU
+!macroend
+
+; ---------------------------------------------------------------------------------------------------
+; Versions 1.4.35 - 1.4.37 were built on macOS before build/installerIcon.ico existed, and their
+; uninstallers are damaged: they fail NSIS's own integrity check ("Installer integrity check has
+; failed"). electron-builder rebuilds the uninstaller in JavaScript on macOS and leaves out NSIS's
+; icon patch, so whenever the installer and uninstaller icons differ (NSIS's two defaults do), the
+; checksum is wrong. An update runs the PREVIOUS version's uninstaller first, so those versions could
+; never be updated: the damaged uninstaller fails, and the installer reports "Bible App cannot be
+; closed" (it also cannot be uninstalled from Windows Settings).
+;
+; For exactly those versions, the old uninstaller is not run: its UninstallString is cleared, so
+; electron-builder's uninstallOldVersion finds nothing to run, and the new files are copied over the
+; old ones. This installer then writes a fresh, valid uninstaller and registry entry. Every other
+; version still goes through the normal uninstall-then-install path.
+; ---------------------------------------------------------------------------------------------------
+!macro bibleAppSkipDamagedUninstaller ROOT
+  ReadRegStr $3 ${ROOT} "${UNINSTALL_REGISTRY_KEY}" DisplayVersion
+  ${If} $3 == "1.4.35"
+  ${OrIf} $3 == "1.4.36"
+  ${OrIf} $3 == "1.4.37"
+    DetailPrint `Version $3's uninstaller is damaged; installing over it instead.`
+    DeleteRegValue ${ROOT} "${UNINSTALL_REGISTRY_KEY}" UninstallString
+    !ifdef UNINSTALL_REGISTRY_KEY_2
+      DeleteRegValue ${ROOT} "${UNINSTALL_REGISTRY_KEY_2}" UninstallString
+    !endif
+  ${EndIf}
 !macroend
diff --git a/build/installerIcon.ico b/build/installerIcon.ico
new file mode 100644
index 0000000..f8fbd5f
Binary files /dev/null and b/build/installerIcon.ico differ
diff --git a/tools/build-win.cjs b/tools/build-win.cjs
index 54c2a13..b22118d 100644
--- a/tools/build-win.cjs
+++ b/tools/build-win.cjs
@@ -12,8 +12,14 @@
  *  - a clean signing environment. There is no code-signing certificate. electron-builder aborts on
  *    an EMPTY WIN_CSC_LINK ("Env WIN_CSC_LINK is not correct"), so those variables are removed
  *    rather than blanked, and identity auto-discovery is turned off.
+ *  - a working uninstaller. On macOS electron-builder rebuilds the NSIS uninstaller in JavaScript and
+ *    skips NSIS's icon patch, so unless the installer and uninstaller use the SAME icon the uninstaller
+ *    fails NSIS's integrity check — and then that version can never be updated or uninstalled
+ *    (1.4.35-1.4.37 shipped like that). build/installerIcon.ico makes electron-builder use one icon for
+ *    both, so this refuses to build without it.
  */
 const { spawnSync } = require('child_process');
+const fs = require('fs');
 const path = require('path');
 
 const env = { ...process.env, CSC_IDENTITY_AUTO_DISCOVERY: 'false' };
@@ -21,6 +27,13 @@ for (const key of ['CSC_LINK', 'WIN_CSC_LINK', 'CSC_KEY_PASSWORD', 'WIN_CSC_KEY_
   delete env[key];
 }
 
+const ICON = path.join(__dirname, '..', 'build', 'installerIcon.ico');
+if (!fs.existsSync(ICON)) {
+  console.error('build/installerIcon.ico is missing. Without it the uninstaller built on macOS is damaged');
+  console.error('("Installer integrity check has failed") and the version could never be updated. See tools/build-win.cjs.');
+  process.exit(1);
+}
+
 const extra = process.argv.slice(2);
 const args = ['electron-builder', '--win', '--x64', ...extra];