diff --git a/README.md b/README.md
index ba217eb..e52674d 100644
--- a/README.md
+++ b/README.md
@@ -25,20 +25,50 @@ Curious how it works under the hood? See the [architecture overview](ARCHITECTUR
 
 ## Getting started
 
+Docker is the only prerequisite — Go and Bun are needed just for
+[development](.github/CONTRIBUTING.md). `make` is a convenience: its targets are thin
+wrappers, so every step below is also given without it.
+
+```bash
+git clone https://github.com/blocknextai/blocknext.git
+cd blocknext
+```
+
+### Linux & macOS
+
 ```bash
 make setup      # creates .env with generated secrets
 make docker-up  # pulls the published images and starts the full stack
 ```
 
-Docker and `make` are all you need — Go and Bun are only required for
-[development](.github/CONTRIBUTING.md).
+Without `make` — on macOS it arrives with the Xcode command line tools, so a fresh
+machine may not have it:
+
+```bash
+./scripts/setup.sh
+docker compose -f docker-compose.prod.yml up -d
+```
+
+### Windows
+
+Docker Desktop installs a WSL 2 backend, and a WSL shell has `make` — open one and
+follow the steps above. To stay in PowerShell, use the PowerShell setup script:
+
+```powershell
+powershell -ExecutionPolicy Bypass -File scripts\setup.ps1
+docker compose -f docker-compose.prod.yml up -d
+```
+
+Both setup scripts do the same thing: copy `.env.example` to `.env` and give each
+`REPLACE_ME_OPENSSL_*` placeholder its own generated secret. An existing `.env` is
+left untouched.
 
 The UI is served on http://localhost:4000. Run `make help` for every target.
 
 One thing to know on a fresh install: `EMAIL_SENDER_PROVIDER` defaults to `log`, so
 every outbound mail is printed instead of sent. Signing up with a password does not
 wait for verification — you land in the app straight away — but magic-link sign-in and
-password reset need the link, and it is in `make docker-logs`. Point the sender at
+password reset need the link, and it is in the container logs. Point the sender at
 SMTP, Resend or SendGrid when you have credentials.
 
 To build and run everything from source instead, see
@@ -55,6 +85,13 @@ make docker-pull
 make docker-up
 ```
 
+Or, without `make`:
+
+```bash
+docker compose -f docker-compose.prod.yml pull
+docker compose -f docker-compose.prod.yml up -d
+```
+
 Migrations run in their own container before the services start, so schema changes
 are applied for you.
 
diff --git a/scripts/setup.ps1 b/scripts/setup.ps1
new file mode 100644
index 0000000..58ad168
--- /dev/null
+++ b/scripts/setup.ps1
@@ -0,0 +1,30 @@
+#Requires -Version 5.1
+
+$ErrorActionPreference = 'Stop'
+
+Set-Location (Split-Path -Parent $PSScriptRoot)
+
+if (Test-Path .env) {
+    Write-Host '.env already exists - leaving it untouched'
+    exit 0
+}
+
+Copy-Item .env.example .env
+
+$text = Get-Content .env -Raw
+$tokens = [regex]::Matches($text, 'REPLACE_ME_OPENSSL_[A-Z_]+') | ForEach-Object { $_.Value } | Sort-Object -Unique
+
+foreach ($token in $tokens) {
+    $bytes = [byte[]]::new(32)
+    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
+    $text = $text -replace $token, ([System.BitConverter]::ToString($bytes) -replace '-', '').ToLower()
+}
+
+Set-Content .env $text -NoNewline
+
+if ($text -match 'REPLACE_ME_OPENSSL') {
+    Write-Host 'warning: unreplaced secret placeholders remain in .env'
+    exit 1
+}
+
+Write-Host ".env created with generated secrets - run 'docker compose -f docker-compose.prod.yml up -d' to start the stack"