diff --git a/installer/setup.ps1 b/installer/setup.ps1
index 2838dc1..a619f01 100644
--- a/installer/setup.ps1
+++ b/installer/setup.ps1
@@ -100,6 +100,13 @@ Log "Writing configuration..."
 INDEXARR_DB_URL=postgres://${PgUser}:${PgUser}@127.0.0.1:${PgPort}/${PgDb}
 INDEXARR_DATA_DIR=${DataDir}
 INDEXARR_PORT=${HttpPort}
+# Sync-only by default: the desktop install serves the web UI / Torznab and
+# syncs from peers, but does not crawl the DHT or announce to trackers. The
+# crawler advertises this machine's real public IP and port 6881 to the swarm
+# (and keeps doing so until every peer forgets it), so it is opt-in. To crawl,
+# route the machine through a VPN and set:
+#   INDEXARR_WORKERS=http_server,dht_crawler,resolver,announcer,sync
+INDEXARR_WORKERS=http_server,sync
 "@ | Set-Content "$InstallDir\.env" -Encoding ASCII
 
 Log "Setup complete."
diff --git a/installer/windows.nsi b/installer/windows.nsi
index 4120220..135db15 100644
--- a/installer/windows.nsi
+++ b/installer/windows.nsi
@@ -111,10 +111,14 @@ Section "${APP_NAME}" SecMain
   DetailPrint "Registering Indexarr service..."
   ; Pass the selected port explicitly so upgrades of an existing service do
   ; not retain its previous command line or port.
-  nsExec::ExecToLog 'sc create "${SVC_NAME}" binPath= "\"$INSTDIR\${APP_EXE}\" --service --all --port $HttpPort" start= auto depend= "${PG_SVC_NAME}" DisplayName= "${APP_NAME}"'
+  ; No --all: the worker set comes from INDEXARR_WORKERS in the generated
+  ; .env (sync-only by default). A desktop install must not crawl the DHT or
+  ; announce to trackers from the machine's real public address unless the
+  ; user opts in there.
+  nsExec::ExecToLog 'sc create "${SVC_NAME}" binPath= "\"$INSTDIR\${APP_EXE}\" --service --port $HttpPort" start= auto depend= "${PG_SVC_NAME}" DisplayName= "${APP_NAME}"'
   Pop $0
   ${If} $0 != 0
-    nsExec::ExecToLog 'sc config "${SVC_NAME}" binPath= "\"$INSTDIR\${APP_EXE}\" --service --all --port $HttpPort"'
+    nsExec::ExecToLog 'sc config "${SVC_NAME}" binPath= "\"$INSTDIR\${APP_EXE}\" --service --port $HttpPort"'
     Pop $0
   ${EndIf}
   nsExec::ExecToLog 'sc description "${SVC_NAME}" "Decentralized torrent indexer"'
diff --git a/readme.md b/readme.md
index d89b785..5dd64f9 100644
--- a/readme.md
+++ b/readme.md
@@ -196,6 +196,12 @@ starts; no separate migration command is required.
 - [`Dockerfile`](Dockerfile) builds the Vue SPA and Rust binary in a multi-stage image.
 - [`installer/linux-install.sh`](installer/linux-install.sh) installs a Linux binary, PostgreSQL, and a systemd service.
 - `installer/windows.nsi` and `installer/setup.ps1` package the Windows binary and a bundled PostgreSQL setup.
+  The Windows service runs **sync-only** (`INDEXARR_WORKERS=http_server,sync`, the same
+  mode as `docker-compose.sync.yml`): it serves the UI and Torznab and syncs from peers
+  but does not crawl the DHT or announce to trackers, because those advertise the
+  machine's real public IP on port 6881 to every swarm it touches. To crawl from a
+  Windows install, put the machine behind a VPN and edit `INDEXARR_WORKERS` in the
+  `.env` beside `indexarr.exe`, then restart the `Indexarr` service.
 - CI workflows live under [`.github/workflows/`](.github/workflows/).
 - Version-specific changes are documented in [`RELEASE_NOTES_v0.3.2.md`](RELEASE_NOTES_v0.3.2.md) and the earlier release notes.