diff --git a/.github/workflows/synkronus-cli.yml b/.github/workflows/synkronus-cli.yml
index 9aa7d062f..58a3d0b15 100644
--- a/.github/workflows/synkronus-cli.yml
+++ b/.github/workflows/synkronus-cli.yml
@@ -1,111 +1,135 @@
-name: Synkronus CLI Build & Release
-
-on:
-  push:
-    branches:
-      - main
-      - dev
-    paths:
-      - 'synkronus-cli/**'
-      - '.github/workflows/synkronus-cli.yml'
-  pull_request:
-    paths:
-      - 'synkronus-cli/**'
-      - '.github/workflows/synkronus-cli.yml'
-  release:
-    types: [published]
-
-jobs:
-  build-cli:
-    name: Build synkronus-cli (CI)
-    if: github.event_name != 'release'
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        include: ${{ fromJSON(
-          github.event_name == 'pull_request'
-          && '[{"goos":"linux","goarch":"amd64"}]'
-          || '[{"goos":"linux","goarch":"amd64"},{"goos":"linux","goarch":"arm64"},{"goos":"windows","goarch":"amd64"},{"goos":"windows","goarch":"arm64"},{"goos":"darwin","goarch":"amd64"},{"goos":"darwin","goarch":"arm64"}]'
-          ) }}
-
-    env:
-      CGO_ENABLED: 0
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-
-      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version: '1.25.x'
-          cache-dependency-path: synkronus-cli/go.sum
-
-      - name: Build synkronus-cli
-        working-directory: synkronus-cli
-        run: |
-          mkdir -p dist
-          FILENAME=synkronus-cli-${{ matrix.goos }}-${{ matrix.goarch }}
-          EXT=""
-          if [ "${{ matrix.goos }}" = "windows" ]; then EXT=".exe"; fi
-
-          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
-            go build -o dist/${FILENAME}${EXT} ./cmd/synkronus
-
-          if [ "${{ matrix.goos }}" = "windows" ]; then
-            (cd dist && zip -r ${FILENAME}.zip ${FILENAME}${EXT})
-          else
-            tar -C dist -czf dist/${FILENAME}.tar.gz ${FILENAME}
-          fi
-          rm dist/${FILENAME}${EXT}
-
-      - name: Upload build artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
-        with:
-          name: synkronus-cli-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: synkronus-cli/dist/synkronus-cli-${{ matrix.goos }}-${{ matrix.goarch }}*
-          archive: false
-
-  release-cli:
-    name: Build & attach release assets
-    if: github.event_name == 'release'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-
-    strategy:
-      matrix:
-        goos: [linux, windows, darwin]
-        goarch: [amd64, arm64]
-
-    env:
-      CGO_ENABLED: 0
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-
-      - name: Set up Go
-        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version: '1.25.x'
-          cache-dependency-path: synkronus-cli/go.sum
-
-      - name: Build synkronus-cli binaries
-        working-directory: synkronus-cli
-        run: |
-          mkdir -p dist
-          EXT=""
-          if [ "${{ matrix.goos }}" = "windows" ]; then EXT=".exe"; fi
-          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
-            go build -o dist/synkronus-cli-${{ matrix.goos }}-${{ matrix.goarch }}${EXT} ./cmd/synkronus
-          ls -R dist
-
-      - name: Upload assets to GitHub Release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
-        with:
-          files: |
-            synkronus-cli/dist/synkronus-cli-*
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+name: Synkronus CLI Build & Release
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+    paths:
+      - 'synkronus-cli/**'
+      - '.github/workflows/synkronus-cli.yml'
+  pull_request:
+    paths:
+      - 'synkronus-cli/**'
+      - '.github/workflows/synkronus-cli.yml'
+  release:
+    types: [published]
+
+jobs:
+  build-cli:
+    name: Build synkronus-cli (CI)
+    if: github.event_name != 'release'
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        include: ${{ fromJSON(
+          github.event_name == 'pull_request'
+          && '[{"goos":"linux","goarch":"amd64"},{"goos":"windows","goarch":"amd64"},{"goos":"windows","goarch":"arm64"}]'
+          || '[{"goos":"linux","goarch":"amd64"},{"goos":"linux","goarch":"arm64"},{"goos":"windows","goarch":"amd64"},{"goos":"windows","goarch":"arm64"},{"goos":"darwin","goarch":"amd64"},{"goos":"darwin","goarch":"arm64"}]'
+          ) }}
+
+    env:
+      CGO_ENABLED: 0
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version: '1.25.x'
+          cache-dependency-path: synkronus-cli/go.sum
+
+      - name: Generate Windows resources
+        if: matrix.goos == 'windows'
+        working-directory: synkronus-cli
+        run: |
+          case "${{ matrix.goarch }}" in
+            amd64) RESOURCE_FLAGS="-64" ;;
+            arm64) RESOURCE_FLAGS="-64 -arm" ;;
+            *) echo "Unsupported Windows architecture" >&2; exit 1 ;;
+          esac
+          go run github.com/josephspurrier/goversioninfo/cmd/goversioninfo@v1.5.0 \
+            ${RESOURCE_FLAGS} -o cmd/synkronus/resource_windows_${{ matrix.goarch }}.syso versioninfo.json
+
+      - name: Build synkronus-cli
+        working-directory: synkronus-cli
+        run: |
+          mkdir -p dist
+          FILENAME=synkronus-cli-${{ matrix.goos }}-${{ matrix.goarch }}
+          EXT=""
+          if [ "${{ matrix.goos }}" = "windows" ]; then EXT=".exe"; fi
+
+          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
+            go build -o dist/${FILENAME}${EXT} ./cmd/synkronus
+
+          if [ "${{ matrix.goos }}" = "windows" ]; then
+            (cd dist && zip -r ${FILENAME}.zip ${FILENAME}${EXT})
+          else
+            tar -C dist -czf dist/${FILENAME}.tar.gz ${FILENAME}
+          fi
+          rm dist/${FILENAME}${EXT}
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: synkronus-cli-${{ matrix.goos }}-${{ matrix.goarch }}
+          path: synkronus-cli/dist/synkronus-cli-${{ matrix.goos }}-${{ matrix.goarch }}*
+          archive: false
+
+  release-cli:
+    name: Build & attach release assets
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    strategy:
+      matrix:
+        goos: [linux, windows, darwin]
+        goarch: [amd64, arm64]
+
+    env:
+      CGO_ENABLED: 0
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version: '1.25.x'
+          cache-dependency-path: synkronus-cli/go.sum
+
+      - name: Generate Windows resources
+        if: matrix.goos == 'windows'
+        working-directory: synkronus-cli
+        run: |
+          case "${{ matrix.goarch }}" in
+            amd64) RESOURCE_FLAGS="-64" ;;
+            arm64) RESOURCE_FLAGS="-64 -arm" ;;
+            *) echo "Unsupported Windows architecture" >&2; exit 1 ;;
+          esac
+          go run github.com/josephspurrier/goversioninfo/cmd/goversioninfo@v1.5.0 \
+            ${RESOURCE_FLAGS} -o cmd/synkronus/resource_windows_${{ matrix.goarch }}.syso versioninfo.json
+
+      - name: Build synkronus-cli binaries
+        working-directory: synkronus-cli
+        run: |
+          mkdir -p dist
+          EXT=""
+          if [ "${{ matrix.goos }}" = "windows" ]; then EXT=".exe"; fi
+          GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} \
+            go build -o dist/synkronus-cli-${{ matrix.goos }}-${{ matrix.goarch }}${EXT} ./cmd/synkronus
+          ls -R dist
+
+      - name: Upload assets to GitHub Release
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
+        with:
+          files: |
+            synkronus-cli/dist/synkronus-cli-*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.gitignore b/.gitignore
index 923b5b760..3b09d511c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -33,3 +33,6 @@ sbom-dist/
 
 # pnpm store
 .pnpm-store/
+
+# Generated Go Windows resource objects
+*.syso
diff --git a/synkronus-cli/README.md b/synkronus-cli/README.md
index 3b33a62c4..8a90c59a3 100644
--- a/synkronus-cli/README.md
+++ b/synkronus-cli/README.md
@@ -209,7 +209,30 @@ ticket-ready summary.
 Build with: `go build -o bin/synk.exe ./cmd/synkronus`
 Run with: `bin/synk.exe`
 
-Icon: configured in versioninfo.json and built with goversioninfo `goversioninfo -o cmd/synkronus/resource.syso` to create a syso file next to main go file.
+### Windows resources
+
+Normal developer builds do not require a resource object. CI and release builds
+for Windows generate the icon and file properties from `versioninfo.json` and
+`synk.ico` with pinned `goversioninfo v1.5.0` before compiling.
+
+To include these resources locally, run the generator from `synkronus-cli/`
+using the flags for your target architecture:
+
+```sh
+# Windows AMD64
+go run github.com/josephspurrier/goversioninfo/cmd/goversioninfo@v1.5.0 -64 -o cmd/synkronus/resource_windows_amd64.syso versioninfo.json
+
+# Windows ARM64
+go run github.com/josephspurrier/goversioninfo/cmd/goversioninfo@v1.5.0 -64 -arm -o cmd/synkronus/resource_windows_arm64.syso versioninfo.json
+```
+
+Run the generator on the host before setting `GOOS` / `GOARCH` for a cross-build.
+Then build `./cmd/synkronus` for the matching Windows target. The generated objects
+must sit beside `main.go`; their `_windows_amd64` and `_windows_arm64` suffixes
+make Go include only the matching object and exclude both from Linux/macOS builds.
+Do not rename an i386 object to target another architecture. Generated `.syso`
+files are ignored and must not be committed. Regenerate them after changing
+`versioninfo.json` or the icon.
 
 ### Regenerating the OpenAPI client
 
diff --git a/synkronus-cli/cmd/synkronus/resource_windows_amd64.syso b/synkronus-cli/cmd/synkronus/resource_windows_amd64.syso
deleted file mode 100644
index 3d1bd9a0d..000000000
Binary files a/synkronus-cli/cmd/synkronus/resource_windows_amd64.syso and /dev/null differ
diff --git a/synkronus/README.md b/synkronus/README.md
index 05cb9249f..506b1851b 100644
--- a/synkronus/README.md
+++ b/synkronus/README.md
@@ -164,4 +164,6 @@ Run with: `./bin/synkronus.exe` or `go run cmd/synkronus/main.go`
 On Windows PowerShell, you can use `./build.ps1` to build with version metadata from git.
 Without `-ldflags` version injection, `/health` reports the default fallback version (`1.0.0`).
 
-Icon: configured in versioninfo.json and built with goversioninfo `goversioninfo -o cmd/synkronus/resource.syso` to create a syso file next to main go file.
\ No newline at end of file
+Windows resource objects are not tracked or generated by the server build.
+The CLI has a separate architecture-specific resource generation process; see
+[its Windows resource instructions](../synkronus-cli/README.md#windows-resources).