diff --git a/src-tauri/windows/hooks.nsh b/src-tauri/windows/hooks.nsh
index 4ef9d6c..5e826d1 100644
--- a/src-tauri/windows/hooks.nsh
+++ b/src-tauri/windows/hooks.nsh
@@ -9,6 +9,19 @@
 !define KV_CHROME_ORIGINS '"chrome-extension://pmhfoafjoogobhfadaicklhkldgnafmk/", "chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"'
 !define KV_FIREFOX_IDS '"browser@kestrove.app"'
 
+; A browser keeps kestrove-nmh.exe running while the extension is connected, which locks the file: an update then
+; can't replace it and an uninstall can't delete it. The installer only closes the app itself, so stop the helper
+; too. It holds no state (it only relays encrypted messages); the browser starts it again when it's next needed.
+!macro KV_STOP_HELPER
+  nsExec::Exec '"$SYSDIR\taskkill.exe" /F /IM kestrove-nmh.exe'
+  Pop $0
+  Sleep 500
+!macroend
+
+!macro NSIS_HOOK_PREINSTALL
+  !insertmacro KV_STOP_HELPER
+!macroend
+
 !macro NSIS_HOOK_POSTINSTALL
   FileOpen $0 "$INSTDIR\${KV_HOST}.chrome.json" w
   FileWrite $0 '{"name": "${KV_HOST}", "description": "Kestrove", "path": "kestrove-nmh.exe", "type": "stdio", "allowed_origins": [${KV_CHROME_ORIGINS}]}'
@@ -25,6 +38,7 @@
 !macroend
 
 !macro NSIS_HOOK_PREUNINSTALL
+  !insertmacro KV_STOP_HELPER
   DeleteRegKey HKCU "Software\Google\Chrome\NativeMessagingHosts\${KV_HOST}"
   DeleteRegKey HKCU "Software\Chromium\NativeMessagingHosts\${KV_HOST}"
   DeleteRegKey HKCU "Software\Microsoft\Edge\NativeMessagingHosts\${KV_HOST}"