diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9b4c246..fd7143b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,16 @@ hash is the source commit the binaries were built from and is what the app
 shows in its title bar, About dialog and in the version string it reports to
 DMR masters.
 
+## 0.1.0-83e21492 — 2026-09-16
+
+* The MD380 software vocoder now reads `md380fw.img` / `md380ram.img` from
+  `share/darthvader/vocoder_fw` instead of the firmware being built into the
+  binary — it is Tytera's firmware and not ours to redistribute. DV3000 sticks
+  and remote AMBEservers are unaffected.
+* Ships as `.msi` and plain `.zip`. The NSIS `.exe` was dropped: unsigned
+  self-extractors are flagged by generic heuristics (the whole Bitdefender
+  engine family, Microsoft's ML) while the same payload as `.msi` is not.
+
 ## 0.1.0-59f93ce0 — 2026-09-16
 
 App icon and version metadata (publisher SA7AUX) in both `darthvader.exe` and
diff --git a/README.md b/README.md
index 6e00c58..3e95509 100644
--- a/README.md
+++ b/README.md
@@ -16,20 +16,25 @@ Download from the [latest release](../../releases/latest):
 
 | File | For |
 |---|---|
-| `darthvader-<version>-win64.exe` | Normal install (NSIS), Start menu + desktop shortcut |
-| `darthvader-<version>-win64.msi` | MSI, for unattended/managed deployment |
+| `darthvader-<version>-win64.msi` | Normal install — Start menu + desktop shortcut, uninstall entry |
+| `darthvader-<version>-win64.zip` | No installer: unpack anywhere and run `bin\darthvader.exe` |
 
-Windows 10/11 64-bit. The packages are **not code-signed**, so SmartScreen shows
-a warning — choose *More info* → *Run anyway*. Everything is bundled (Qt, codecs,
-LADSPA plugins); nothing else needs installing.
+Windows 10/11 64-bit. Everything is bundled (Qt, codecs, LADSPA plugins);
+nothing else needs installing.
 
 Silent install:
 
 ```cmd
-darthvader-<version>-win64.exe /S
 msiexec /i darthvader-<version>-win64.msi /qn
 ```
 
+### Antivirus warnings
+
+The packages are **not code-signed**, so SmartScreen warns on first run
+(*More info* → *Run anyway*), and a few engines flag them on reputation alone
+— Microsoft Defender on a real machine does not. Verify the SHA-256 against
+`SHA256SUMS` in the release; that is what the checksums are there for.
+
 DV3000 / ThumbDV / DVstick sticks appear as COM ports through the FTDI VCP
 driver and are detected automatically. If audio stutters, lower the port's
 *Latency Timer* to 1–2 ms in Device Manager → Port Settings → Advanced.