diff --git a/native-messaging/README.md b/native-messaging/README.md
index f5262e0..08a17b1 100644
--- a/native-messaging/README.md
+++ b/native-messaging/README.md
@@ -1,9 +1,10 @@
 # Native messaging manifests
 
 `install.sh` (Linux, macOS) and `install.ps1` (Windows) fill in the placeholders and register the
-manifests for the current user. Default ids are the development ones: the unpacked Chrome build is pinned
-to `kogapfibnnpeapfcjkkpgjddbhnjfein` by the manifest key in kestrove-browser, Firefox uses
-`browser@kestrove.app`. Pass `--chrome-id` / `-ChromeId` for a Web Store build.
+manifests for the current user. Chrome allows two ids by default: the Chrome Web Store build
+(`pmhfoafjoogobhfadaicklhkldgnafmk`) and the unpacked development build, pinned to
+`kogapfibnnpeapfcjkkpgjddbhnjfein` by the manifest key in kestrove-browser. Firefox uses `browser@kestrove.app`.
+Pass `--chrome-id a,b` / `-ChromeId a,b` to allow other ids instead.
 
 ```bash
 native-messaging/install.sh                     # every browser with a profile dir, host from target/
diff --git a/native-messaging/install.ps1 b/native-messaging/install.ps1
index 7400edc..774b09f 100644
--- a/native-messaging/install.ps1
+++ b/native-messaging/install.ps1
@@ -2,13 +2,14 @@
 # Linux/macOS: install.sh.
 #
 #   powershell -ExecutionPolicy Bypass -File install.ps1 [-Nmh C:\path\kestrove-nmh.exe]
-#       [-ChromeId ID] [-FirefoxId ID] [-Browsers chrome,chromium,edge,firefox] [-Uninstall]
+#       [-ChromeId ID[,ID…]] [-FirefoxId ID] [-Browsers chrome,chromium,edge,firefox] [-Uninstall]
 #
 # Chrome and Brave share the Google\Chrome key. The manifests go to %LOCALAPPDATA%\Kestrove\NativeMessagingHosts.
 # allowed_origins / allowed_extensions pin the host to our extension ids (docs/04 A8).
 param(
   [string]$Nmh = "",
-  [string]$ChromeId = "kogapfibnnpeapfcjkkpgjddbhnjfein",
+  # The Chrome Web Store build, then the unpacked development build.
+  [string[]]$ChromeId = @("pmhfoafjoogobhfadaicklhkldgnafmk", "kogapfibnnpeapfcjkkpgjddbhnjfein"),
   [string]$FirefoxId = "browser@kestrove.app",
   [string[]]$Browsers = @("chrome", "chromium", "edge", "firefox"),
   [switch]$Uninstall
@@ -17,7 +18,7 @@ $ErrorActionPreference = "Stop"
 $HostName = "app.kestrove.nmh"
 $Here = Split-Path -Parent $MyInvocation.MyCommand.Path
 
-if ($ChromeId -notmatch '^[a-p]{32}$') { throw "-ChromeId must be 32 letters a-p" }
+foreach ($id in $ChromeId) { if ($id -notmatch '^[a-p]{32}$') { throw "-ChromeId must be 32 letters a-p" } }
 if ($FirefoxId -notmatch '^[A-Za-z0-9._@{}-]+$') { throw "bad -FirefoxId" }
 
 $Keys = @{
@@ -48,7 +49,7 @@ New-Item -ItemType Directory -Force -Path $OutDir | Out-Null
 foreach ($flavor in @("chrome", "firefox")) {
   $m = Get-Content -Raw (Join-Path $Here "$HostName.$flavor.json") | ConvertFrom-Json
   $m.path = $Nmh
-  if ($flavor -eq "chrome") { $m.allowed_origins = @("chrome-extension://$ChromeId/") } else { $m.allowed_extensions = @($FirefoxId) }
+  if ($flavor -eq "chrome") { $m.allowed_origins = @($ChromeId | ForEach-Object { "chrome-extension://$_/" }) } else { $m.allowed_extensions = @($FirefoxId) }
   $m | ConvertTo-Json -Depth 4 | Set-Content -Encoding UTF8 (Join-Path $OutDir "$HostName.$flavor.json")
 }
 
diff --git a/native-messaging/install.sh b/native-messaging/install.sh
index e7eb2c9..7d059e6 100755
--- a/native-messaging/install.sh
+++ b/native-messaging/install.sh
@@ -2,7 +2,7 @@
 # Registers the Kestrove native-messaging host with the browsers of the current user (Linux, macOS).
 # Windows: install.ps1.
 #
-#   install.sh [--nmh /path/to/kestrove-nmh] [--chrome-id ID] [--firefox-id ID]
+#   install.sh [--nmh /path/to/kestrove-nmh] [--chrome-id ID[,ID…]] [--firefox-id ID]
 #              [--browsers chrome,chromium,edge,brave,firefox] [--user-data-dir DIR] [--uninstall]
 #
 # With neither --browsers nor --user-data-dir it installs for every browser whose profile directory exists.
@@ -14,8 +14,9 @@ set -eu
 HOST=app.kestrove.nmh
 HERE=$(cd "$(dirname "$0")" && pwd)
 NMH=""
-# Development ids: the unpacked Chrome build is pinned by the manifest key in kestrove-browser/scripts/build.mjs.
-CHROME_ID=kogapfibnnpeapfcjkkpgjddbhnjfein
+# Chrome: the Chrome Web Store build, then the unpacked development build (pinned by the manifest key in
+# kestrove-browser/scripts/build.mjs).
+CHROME_IDS="pmhfoafjoogobhfadaicklhkldgnafmk kogapfibnnpeapfcjkkpgjddbhnjfein"
 FIREFOX_ID=browser@kestrove.app
 BROWSERS=""
 USER_DATA_DIR=""
@@ -26,7 +27,7 @@ die() { echo "install.sh: $*" >&2; exit 1; }
 while [ $# -gt 0 ]; do
   case "$1" in
     --nmh) NMH=$2; shift 2 ;;
-    --chrome-id) CHROME_ID=$2; shift 2 ;;
+    --chrome-id) CHROME_IDS=$(echo "$2" | tr ',' ' '); shift 2 ;;
     --firefox-id) FIREFOX_ID=$2; shift 2 ;;
     --browsers) BROWSERS=$(echo "$2" | tr ',' ' '); shift 2 ;;
     --user-data-dir) USER_DATA_DIR=$2; shift 2 ;;
@@ -36,7 +37,9 @@ while [ $# -gt 0 ]; do
   esac
 done
 
-echo "$CHROME_ID" | grep -Eq '^[a-p]{32}$' || die "--chrome-id must be 32 letters a-p"
+for id in $CHROME_IDS; do echo "$id" | grep -Eq '^[a-p]{32}$' || die "--chrome-id must be 32 letters a-p"; done
+# "chrome-extension://a/", "chrome-extension://b/" (the template supplies the outer quotes).
+CHROME_ORIGINS=$(for id in $CHROME_IDS; do printf '%s' "${sep-}chrome-extension://$id/"; sep='", "'; done)
 echo "$FIREFOX_ID" | grep -Eq '^[A-Za-z0-9._@{}-]+$' || die "bad --firefox-id"
 
 if [ "$UNINSTALL" = 0 ]; then
@@ -83,7 +86,7 @@ esac
 done
 
 render() { # template → stdout
-  sed -e "s|__NMH_PATH__|$NMH|" -e "s|__CHROME_EXTENSION_ID__|$CHROME_ID|" -e "s|__FIREFOX_EXTENSION_ID__|$FIREFOX_ID|" "$HERE/$HOST.$1.json"
+  sed -e "s|__NMH_PATH__|$NMH|" -e "s|chrome-extension://__CHROME_EXTENSION_ID__/|$CHROME_ORIGINS|" -e "s|__FIREFOX_EXTENSION_ID__|$FIREFOX_ID|" "$HERE/$HOST.$1.json"
 }
 
 place() { # flavor dir
diff --git a/src-tauri/windows/hooks.nsh b/src-tauri/windows/hooks.nsh
index b0392f3..4ef9d6c 100644
--- a/src-tauri/windows/hooks.nsh
+++ b/src-tauri/windows/hooks.nsh
@@ -3,9 +3,10 @@
 ; native-messaging/install.ps1: a manifest next to kestrove-nmh.exe ("path" relative to the manifest, which
 ; Chrome and Firefox allow on Windows) and one registry key per browser.
 ; Extension ids: keep in sync with kestrove-apple/App/BrowserIntegration.swift (NativeHostRegistration).
+; Chrome: the Chrome Web Store build, then the unpacked development build (pinned by the manifest key).
 
 !define KV_HOST "app.kestrove.nmh"
-!define KV_CHROME_ORIGINS '"chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"'
+!define KV_CHROME_ORIGINS '"chrome-extension://pmhfoafjoogobhfadaicklhkldgnafmk/", "chrome-extension://kogapfibnnpeapfcjkkpgjddbhnjfein/"'
 !define KV_FIREFOX_IDS '"browser@kestrove.app"'
 
 !macro NSIS_HOOK_POSTINSTALL