diff --git a/deploy/windows/web.config b/deploy/windows/web.config
index 4821797..b5b0704 100644
--- a/deploy/windows/web.config
+++ b/deploy/windows/web.config
@@ -76,4 +76,39 @@
     -->
 
   </system.webServer>
+
+  <!--
+    Installer downloads: serve /installers/* as IIS static files instead of
+    forwarding them to Flask. The handler above is path="*", so without this a
+    request for /installers/Foo.exe goes to waitress, which has no such route
+    (SPA fallback), and large binaries would stream through a Python thread.
+
+    This <location> clears the httpPlatformHandler for that one subpath and puts
+    the static file handler back, so IIS serves the bytes directly (kernel-mode,
+    range/resume, no Python thread held).
+
+    Requires a physical folder at APP_ROOT\installers (the site's physical path
+    is APP_ROOT). Drop the installer binaries there, e.g. robocopy them from the
+    classic wwwroot\installers. The stored installpath 'installers/Foo.exe' then
+    resolves to <mount>/installers/Foo.exe (e.g. /shopdb/installers/Foo.exe).
+
+    .exe/.msi are given an explicit MIME map; if the parent site has a Request
+    Filtering rule that denies executable extensions, also allow them there.
+  -->
+  <location path="installers">
+    <system.webServer>
+      <handlers>
+        <clear />
+        <add name="StaticFile" path="*" verb="*"
+             modules="StaticFileModule" resourceType="File"
+             requireAccess="Read" />
+      </handlers>
+      <staticContent>
+        <remove fileExtension=".exe" />
+        <mimeMap fileExtension=".exe" mimeType="application/octet-stream" />
+        <remove fileExtension=".msi" />
+        <mimeMap fileExtension=".msi" mimeType="application/octet-stream" />
+      </staticContent>
+    </system.webServer>
+  </location>
 </configuration>
diff --git a/frontend/src/utils/basePath.js b/frontend/src/utils/basePath.js
index b77cbbb..a9db043 100644
--- a/frontend/src/utils/basePath.js
+++ b/frontend/src/utils/basePath.js
@@ -12,6 +12,24 @@ export function withBase(path) {
   return BASE_URL + String(path).replace(/^\//, '')
 }
 
+// Resolve a stored file/link path for use in an <a href>. Full URLs (http,
+// https, file:, mailto:, ...) and UNC / protocol-relative paths (\\server,
+// //host) open as-is. A path relative to the app (e.g. 'installers/x.exe' or
+// './installers/x.exe') is mounted under the base so it does NOT resolve
+// against the current route - '/shopdb/applications/6' + 'installers/x.exe'
+// wrongly became '/shopdb/applications/installers/x.exe'.
+export function fileHref(path) {
+  if (!path) return null
+  const trimmed = String(path).trim()
+  if (!trimmed) return null
+  if (/^[a-z][a-z0-9+.-]*:/i.test(trimmed)
+      || trimmed.startsWith('\\\\')
+      || trimmed.startsWith('//')) {
+    return trimmed
+  }
+  return withBase('/' + trimmed.replace(/^(\.?\/)+/, ''))
+}
+
 // Inverse of withBase: turn a browser pathname (which includes the mount
 // base, e.g. '/ops/computers') into a router path ('/computers'). Router
 // navigation already applies the base; feeding it an un-stripped pathname
diff --git a/plugins/applications/frontend/views/ApplicationDetail.vue b/plugins/applications/frontend/views/ApplicationDetail.vue
index aa5da35..833df5c 100644
--- a/plugins/applications/frontend/views/ApplicationDetail.vue
+++ b/plugins/applications/frontend/views/ApplicationDetail.vue
@@ -31,13 +31,13 @@
             <span v-if="app.ishidden" class="badge badge-lg badge-dark">Hidden</span>
           </div>
           <div class="hero-links" v-if="app.applicationlink || app.installpath || app.documentationpath">
-            <a v-if="app.applicationlink" :href="app.applicationlink" target="_blank" class="hero-link">
+            <a v-if="app.applicationlink" :href="fileHref(app.applicationlink)" target="_blank" class="hero-link">
               <span class="link-icon">&#x1F517;</span> Launch Application
             </a>
-            <a v-if="app.installpath" :href="app.installpath" target="_blank" class="hero-link">
+            <a v-if="app.installpath" :href="fileHref(app.installpath)" target="_blank" class="hero-link">
               <span class="link-icon">&#x2B07;</span> Download Files
             </a>
-            <a v-if="app.documentationpath" :href="app.documentationpath" target="_blank" class="hero-link">
+            <a v-if="app.documentationpath" :href="fileHref(app.documentationpath)" target="_blank" class="hero-link">
               <span class="link-icon">&#x1F4C4;</span> Documentation
             </a>
           </div>
@@ -167,6 +167,7 @@ import { useRoute } from 'vue-router'
 import { applicationsApi } from '@/api'
 import { getContactEmailDomain } from '@/utils/siteSettings'
 import { sanitizeNotesHtml } from '@/utils/sanitizeHtml'
+import { fileHref } from '@/utils/basePath'
 
 const route = useRoute()
 
diff --git a/plugins/applications/frontend/views/ApplicationsList.vue b/plugins/applications/frontend/views/ApplicationsList.vue
index 3a7c6ec..5116c12 100644
--- a/plugins/applications/frontend/views/ApplicationsList.vue
+++ b/plugins/applications/frontend/views/ApplicationsList.vue
@@ -41,15 +41,15 @@
             <tbody>
               <tr v-for="app in applications" :key="app.appid" class="clickable-row" @click="$router.push(`/applications/${app.appid}`)">
                 <td class="icon-cell">
-                  <a v-if="app.installpath" :href="app.installpath" target="_blank" title="Download Installation Files" class="icon-download">
+                  <a v-if="app.installpath" :href="fileHref(app.installpath)" target="_blank" title="Download Installation Files" class="icon-download">
                     &#x2B07;
                   </a>
-                  <a v-else-if="app.applicationlink" :href="app.applicationlink" target="_blank" title="Application Link" class="icon-link">
+                  <a v-else-if="app.applicationlink" :href="fileHref(app.applicationlink)" target="_blank" title="Application Link" class="icon-link">
                     &#x1F517;
                   </a>
                 </td>
                 <td class="icon-cell">
-                  <a v-if="app.documentationpath" :href="app.documentationpath" target="_blank" title="View Documentation" class="icon-docs">
+                  <a v-if="app.documentationpath" :href="fileHref(app.documentationpath)" target="_blank" title="View Documentation" class="icon-docs">
                     &#x1F4C4;
                   </a>
                 </td>
@@ -102,6 +102,7 @@ import { ref, onMounted } from 'vue'
 import { applicationsApi } from '@/api'
 import PaginationBar from '@/components/PaginationBar.vue'
 import { useListQuery } from '@/composables/listQuery'
+import { fileHref } from '@/utils/basePath'
 
 const applications = ref([])
 const loading = ref(true)