diff --git a/Makefile b/Makefile
index 8661568bfd8e5192e8eaefac0a1f449d1baef0a2..5e92a21a1f17cc666f1067fc99b4e5bf127a491b 100644
--- a/Makefile
+++ b/Makefile
@@ -45,7 +45,8 @@ prepare: generate relink_default
 	cp branding/templates/makefile/Makefile build/${PROVIDER}/Makefile
 	VERSION=${VERSION} PROVIDER_CONFIG=${PROVIDER_CONFIG} branding/scripts/generate-vendor-make.py build/${PROVIDER}/vendor.mk
 	branding/scripts/check-ca-crt.py ${PROVIDER} ${PROVIDER_CONFIG}
-	-@make icon
+	# FIXME trouble in win - better get into repo
+	#-@make icon
 
 prepare_win:
 	mkdir -p build/${PROVIDER}/windows/
diff --git a/branding/assets/riseup/riseupvpn.ico b/branding/assets/riseup/riseupvpn.ico
new file mode 100755
index 0000000000000000000000000000000000000000..c65c9e17938b3dae0ae392d3e853684dd8e0237d
Binary files /dev/null and b/branding/assets/riseup/riseupvpn.ico differ
diff --git a/branding/templates/makefile/Makefile b/branding/templates/makefile/Makefile
index 698b51f62ee304731b0abedfa44735bb04022c97..c8ade84eb9a98ee103f1db2012713293d461a208 100755
--- a/branding/templates/makefile/Makefile
+++ b/branding/templates/makefile/Makefile
@@ -50,28 +50,26 @@ openvpn_cross_win:
 	cp $(STAGING)/openvpn/bin/openvpn.exe $(STAGING)/openvpn
 	cp $(STAGING)/openvpn/bin/*.dll $(STAGING)
 	cp $(STAGING)/openvpn/lib/engines-1_1/*.dll $(STAGING)
-helper_win:
-	go build -ldflags "-s -w" -o $(STAGING)/$(HELPER_BIN).exe $(SYSTRAY)/cmd/bitmask-helper
-systray_win:
-	go get -u $(SYSTRAY)/cmd/bitmask-vpn
-	powershell '$$gopath=go env GOPATH;$$version=git -C $$gopath/src/$(SYSTRAY) describe --tags; go build -ldflags "-H windowsgui -s -w -X main.version=$$version" -o $(STAGING)/$(SYSTRAY_BIN).exe $(SYSTRAY)/cmd/bitmask-vpn'
-build_win: staging\nssm.exe helper_win systray_win
-# since it's tedious, I assume you did bootstrap openvpn_win manually already.
+
+# TODO no need to build systray in windows, but move this powershell hack to main build makefile
+#powershell '$$gopath=go env GOPATH;$$version=git -C $$gopath/src/$(SYSTRAY) describe --tags; go build -ldflags "-H windowsgui -s -w -X main.version=$$version" -o $(STAGING)/$(SYSTRAY_BIN).exe $(SYSTRAY)/cmd/bitmask-vpn'
+
+package_win: staging\nssm.exe helper_win systray_win
+# I assume you did bootstrap openvpn_win manually already.
 	echo "[+] building windows"
-	if not exist dist mkdir dist
-	powershell '$$gopath=go env GOPATH;$$version=git -C $$gopath/src/$(SYSTRAY) describe --tags; $(MAKE) -C win VERSION=$$version'
-	"C:\Program Files (x86)\NSIS\makensis.exe" win/RiseupVPN-installer.nsi
+	"C:\Program Files (x86)\NSIS\makensis.exe" windows/$(APPNAME)-installer.nsi
+
 sign_win:
 	echo "[+] signing windows build"
-	python win/sign.py $(WIN_CERT_PATH) $(WIN_CERT_PASS)
+	python windowns/sign.py $(WIN_CERT_PATH) $(WIN_CERT_PASS)
+
+# TODO move to main build makefile
 build_cross_win: staging/nssm.exe
 	echo "!define VERSION $(VERSION)" > $(STAGING)/version.nsh
 	$(CROSS_FLAGS) $(MAKE) helper_win
-	$(CROSS_FLAGS) go get $(SYSTRAY)/cmd/bitmask-vpn
-	$(CROSS_FLAGS) go build -ldflags "-H windowsgui -s -w -X main.version=$(VERSION)" -o $(STAGING)/$(SYSTRAY_BIN).exe $(SYSTRAY)/cmd/bitmask-vpn
 	mkdir -p dist
 	make -C win VERSION=$(VERSION)
-	makensis win/RiseupVPN-installer.nsi
+	makensis win/$(APPNAME)-installer.nsi
 
 # -----------------------------------------------------------------------------
 # OSX
diff --git a/branding/templates/windows/payload/uninstall b/branding/templates/windows/payload/uninstall
index 7c7df24c3c626344328b08a402843b68005a0ed9..f0a1687ecd8c12b752e725ccf0445d8f2dfff8c6 100755
--- a/branding/templates/windows/payload/uninstall
+++ b/branding/templates/windows/payload/uninstall
@@ -8,6 +8,6 @@ libpkcs11-helper-1.dll
 libcrypto-1_1-x64.dll
 libssl-1_1-x64.dll
 padlock.dll
-bitmask_helper.exe
+bitmask-helper.exe
 bitmask-vpn.exe
 tap-windows.exe
diff --git a/branding/templates/windows/readme.txt b/branding/templates/windows/readme.txt
new file mode 100644
index 0000000000000000000000000000000000000000..a519f1ae32e89980b0ee07265885d53816278c7a
--- /dev/null
+++ b/branding/templates/windows/readme.txt
@@ -0,0 +1 @@
+BitmaskVPN for Windows.
diff --git a/branding/templates/windows/template.nsi b/branding/templates/windows/template.nsi
index f644b892b8174688966924884ce8ec63e4e4278a..00118e1f1de63711483c6eda6f95687bde41c26b 100755
--- a/branding/templates/windows/template.nsi
+++ b/branding/templates/windows/template.nsi
@@ -4,7 +4,7 @@ SetCompressor /SOLID lzma
 !include "MUI2.nsh"
 
 Name "$applicationName"
-Outfile "..\bin\$applicationName-$version.exe"
+Outfile "..\dist\$applicationName-$version.exe"
 ;TODO make the installdir configurable - and set it in the registry.
 InstallDir "C:\Program Files\$applicationName\"
 RequestExecutionLevel admin
@@ -87,7 +87,7 @@ SectionEnd
 
 Section "InstallService"
   ; Easy service management thanks to nssm
-  ExecWait '"$INSTDIR\nssm.exe" install $applicationNameLower-helper "$INSTDIR\bitmask_helper.exe"'
+  ExecWait '"$INSTDIR\nssm.exe" install $applicationNameLower-helper "$INSTDIR\bitmask-helper.exe"'
   ExecWait '"$INSTDIR\nssm.exe" set $applicationNameLower-helper AppDirectory "$INSTDIR"'
   ExecWait '"$INSTDIR\nssm.exe" start $applicationNameLower-helper'
 SectionEnd
diff --git a/cmd/bitmask-vpn/main.go b/cmd/bitmask-vpn/main.go
index afd654745696981aff6861b3dfcd53986125d630..d7f12df5687ac108a38f83a60e8c590f83c9834b 100644
--- a/cmd/bitmask-vpn/main.go
+++ b/cmd/bitmask-vpn/main.go
@@ -15,7 +15,7 @@
 
 package main
 
-//go:generate ../../branding/scripts/vendorize.py ../../branding/templates/bitmaskvpn/config.go ../../branding/config/vendor.conf ../../pkg/config/config.go
+//go:generate python3 ../../branding/scripts/vendorize.py ../../branding/templates/bitmaskvpn/config.go ../../branding/config/vendor.conf ../../pkg/config/config.go
 
 import (
 	"flag"