diff --git a/packaging/.shellcheckrc b/packaging/.shellcheckrc
new file mode 100644
index 00000000..36c19d06
--- /dev/null
+++ b/packaging/.shellcheckrc
@@ -0,0 +1,3 @@
+# shellcheck config for the packaging scripts (CI: .github/workflows/packaging-lint.yml).
+source-path=SCRIPTDIR
+external-sources=true
diff --git a/packaging/macos/package.sh b/packaging/macos/package.sh
index abd8e03b..d19d9805 100755
--- a/packaging/macos/package.sh
+++ b/packaging/macos/package.sh
@@ -97,7 +97,8 @@ plutil -lint "$MNT/SolveCraft.app/Contents/Info.plist"
 case "$ARCH" in universal) WANT=(arm64 x86_64) ;; aarch64) WANT=(arm64) ;; *) WANT=(x86_64) ;; esac
 lipo "$MNT/SolveCraft.app/Contents/MacOS/SolveCraft" -verify_arch "${WANT[@]}"
 test -s "$MNT/SolveCraft.app/Contents/Resources/Licenses/THIRD-PARTY-LICENSES.txt"
-codesign --verify --strict --deep "$MNT/SolveCraft.app"
+# Not --strict: the mounted HFS volume adds Finder info, which strict verification rejects.
+codesign --verify --deep --verbose=2 "$MNT/SolveCraft.app"
 "$MNT/SolveCraft.app/Contents/MacOS/SolveCraft" --version
 hdiutil detach "$MNT"
 
diff --git a/packaging/windows/solvecraft.wxs b/packaging/windows/solvecraft.wxs
index 1f406ee9..27ec3846 100644
--- a/packaging/windows/solvecraft.wxs
+++ b/packaging/windows/solvecraft.wxs
@@ -110,7 +110,8 @@
       <Component Id="SolvecraftCli">
         <File Id="SolvecraftCliExe" Source="$(var.BinDir)\solvecraft-cli.exe" KeyPath="yes" />
       </Component>
-      <Component Id="SolvecraftLicences">
+      <!-- Several unversioned files: an explicit GUID (WIX0367). -->
+      <Component Id="SolvecraftLicences" Guid="CDEDEE8D-4BE9-4872-A2EA-EE623A6C7E91">
         <File Id="LicenseMit" Source="$(var.BinDir)\LICENSE-MIT" KeyPath="yes" />
         <File Id="LicenseApache" Source="$(var.BinDir)\LICENSE-APACHE" />
         <File Id="Notice" Source="$(var.BinDir)\NOTICE" />