diff --git a/scripts/build-release-windows.ps1 b/scripts/build-release-windows.ps1
index fb6ed64..5ed4052 100644
--- a/scripts/build-release-windows.ps1
+++ b/scripts/build-release-windows.ps1
@@ -18,20 +18,28 @@ $ErrorActionPreference = "Stop"
 $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $RepoRoot  = Split-Path -Parent $ScriptDir
 
-# Load .env if present (existing env vars take precedence)
+# Load .env if present. The values are kept in a script-local table rather
+# than written to the process environment: a .ps1 runs inside the caller's
+# PowerShell process, so anything set there would outlive the script and
+# shadow later edits to .env in the same session.
+$DotEnv  = @{}
 $EnvFile = Join-Path $ScriptDir ".env"
 if (Test-Path $EnvFile) {
     Get-Content $EnvFile | ForEach-Object {
-        if ($_ -match '^\s*#' -or $_ -match '^\s*$') { return }
+        if ($_ -match '^\s*#' -or $_ -notmatch '=') { return }
         $parts = $_ -split '=', 2
-        $key   = $parts[0].Trim()
-        $value = $parts[1].Trim()
-        if (-not [System.Environment]::GetEnvironmentVariable($key)) {
-            [System.Environment]::SetEnvironmentVariable($key, $value, "Process")
-        }
+        $DotEnv[$parts[0].Trim()] = $parts[1].Trim()
     }
 }
 
+# Resolve a setting: an environment variable takes precedence over .env
+function Get-Setting([string]$Name) {
+    $value = [System.Environment]::GetEnvironmentVariable($Name)
+    if ($value) { return $value }
+    if ($DotEnv.ContainsKey($Name)) { return $DotEnv[$Name] }
+    return $null
+}
+
 # Determine version
 if (-not $Version) {
     $cargoToml = Get-Content (Join-Path $RepoRoot "Cargo.toml") -Raw
@@ -46,23 +54,22 @@ if (-not $Version) {
 $Tag    = "v$Version"
 $Target = "x86_64-pc-windows-msvc"
 
-Set-Location $RepoRoot
-
 Write-Host "==> Building mdrs $Version for Windows ($Target)"
 
 rustup target add $Target
-cargo build --release --target $Target
+cargo build --release --target $Target --manifest-path (Join-Path $RepoRoot "Cargo.toml")
 
 $Archive = "mdrs-$Version-$Target.zip"
-Compress-Archive -Force -Path "target\$Target\release\mdrs.exe" -DestinationPath $Archive
+$ArchivePath = Join-Path $RepoRoot $Archive
+Compress-Archive -Force -Path (Join-Path $RepoRoot "target\$Target\release\mdrs.exe") -DestinationPath $ArchivePath
 # Written alongside the archive so `mdrs selfupdate` can check what it fetched.
 $Checksum = "$Archive.sha256"
-$Hash = (Get-FileHash -Algorithm SHA256 -Path $Archive).Hash.ToLower()
-"$Hash  $Archive" | Set-Content -NoNewline -Encoding ascii $Checksum
+$Hash = (Get-FileHash -Algorithm SHA256 -Path $ArchivePath).Hash.ToLower()
+"$Hash  $Archive" | Set-Content -NoNewline -Encoding ascii (Join-Path $RepoRoot $Checksum)
 Write-Host "    Created: $Archive"
 
 # Upload to Gitea if token is provided
-$GiteaToken = [System.Environment]::GetEnvironmentVariable("GITEA_TOKEN")
+$GiteaToken = Get-Setting "GITEA_TOKEN"
 if (-not $GiteaToken) {
     Write-Host ""
     Write-Host "GITEA_TOKEN not set -- skipping upload."
@@ -70,8 +77,8 @@ if (-not $GiteaToken) {
     exit 0
 }
 
-$ServerUrl  = [System.Environment]::GetEnvironmentVariable("GITEA_SERVER_URL")
-$Repository = [System.Environment]::GetEnvironmentVariable("GITEA_REPOSITORY")
+$ServerUrl  = Get-Setting "GITEA_SERVER_URL"
+$Repository = Get-Setting "GITEA_REPOSITORY"
 if (-not $ServerUrl)  { Write-Error "GITEA_SERVER_URL is required for upload"; exit 1 }
 if (-not $Repository) { Write-Error "GITEA_REPOSITORY is required for upload"; exit 1 }