diff --git a/README.md b/README.md
index 985b801..b722962 100644
--- a/README.md
+++ b/README.md
@@ -59,6 +59,23 @@ npm run helper:windows-x86
 npm run helper:macos-arm64
 ```
 
+Ubuntu-to-Windows `Setup.exe` build:
+
+```bash
+cd desktop-client
+cargo install --locked cargo-xwin
+rustup target add i686-pc-windows-msvc
+npm install
+npm run helper:windows-x86
+npm run tauri:build:windows-x86:linux
+```
+
+The resulting NSIS installer is written to:
+
+- `desktop-client/src-tauri/target/i686-pc-windows-msvc/release/bundle/nsis/`
+
+This Linux cross-build path is intended for NSIS `Setup.exe` output. Native MSI packaging and final Windows code signing should still be done on Windows.
+
 Gateway utility scripts:
 
 ```bash
diff --git a/desktop-client/package.json b/desktop-client/package.json
index 88076a3..5c3ec80 100644
--- a/desktop-client/package.json
+++ b/desktop-client/package.json
@@ -9,7 +9,8 @@
     "tauri:dev": "tauri dev",
     "tauri:build": "tauri build",
     "helper:windows-x86": "bash ./scripts/build-tunnel-helper.sh i686-pc-windows-msvc",
-    "helper:macos-arm64": "bash ./scripts/build-tunnel-helper.sh aarch64-apple-darwin"
+    "helper:macos-arm64": "bash ./scripts/build-tunnel-helper.sh aarch64-apple-darwin",
+    "tauri:build:windows-x86:linux": "tauri build --runner cargo-xwin --target i686-pc-windows-msvc --config src-tauri/tauri.windows.conf.json"
   },
   "dependencies": {
     "@tauri-apps/api": "^2.3.0",
diff --git a/desktop-client/scripts/build-tunnel-helper.sh b/desktop-client/scripts/build-tunnel-helper.sh
index 1cd0258..aaf9ed4 100644
--- a/desktop-client/scripts/build-tunnel-helper.sh
+++ b/desktop-client/scripts/build-tunnel-helper.sh
@@ -4,6 +4,7 @@ set -eu
 ROOT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 HELPER_DIR="${ROOT_DIR}/tunnel-helper"
 BUNDLED_DIR="${ROOT_DIR}/src-tauri/bundled"
+HOST_OS="$(uname -s)"
 
 TARGET="${1:-}"
 if [ -z "${TARGET}" ]; then
@@ -26,7 +27,53 @@ case "${TARGET}" in
     ;;
 esac
 
+if [ "${TARGET}" = "i686-pc-windows-msvc" ]; then
+  case "${HOST_OS}" in
+    MINGW64_NT*|MSYS_NT*|CYGWIN_NT*)
+      ;;
+    Linux)
+      if ! command -v cargo-xwin >/dev/null 2>&1; then
+        echo "Linux cross-builds for Windows require cargo-xwin."
+        echo "Install it with:"
+        echo "  cargo install --locked cargo-xwin"
+        exit 1
+      fi
+      ;;
+    *)
+      echo "Windows x86 helper builds are supported on Windows or on Linux with cargo-xwin."
+      echo "Current host: ${HOST_OS}"
+      echo "Install the target with:"
+      echo "  rustup target add i686-pc-windows-msvc"
+      exit 1
+      ;;
+  esac
+fi
+
+if [ "${TARGET}" = "aarch64-apple-darwin" ] && [ "${HOST_OS}" != "Darwin" ]; then
+  echo "macOS ARM helper builds must run on macOS."
+  echo "Current host: ${HOST_OS}"
+  echo "Use a Mac, then install the target with:"
+  echo "  rustup target add aarch64-apple-darwin"
+  exit 1
+fi
+
+if ! command -v rustup >/dev/null 2>&1; then
+  echo "rustup is required to verify/install Rust targets."
+  exit 1
+fi
+
+if ! rustup target list --installed | grep -qx "${TARGET}"; then
+  echo "Rust target ${TARGET} is not installed."
+  echo "Install it with:"
+  echo "  rustup target add ${TARGET}"
+  exit 1
+fi
+
 mkdir -p "${OUTPUT_DIR}"
-cargo build --manifest-path "${HELPER_DIR}/Cargo.toml" --release --target "${TARGET}"
+if [ "${HOST_OS}" = "Linux" ] && [ "${TARGET}" = "i686-pc-windows-msvc" ]; then
+  cargo xwin build --manifest-path "${HELPER_DIR}/Cargo.toml" --release --target "${TARGET}"
+else
+  cargo build --manifest-path "${HELPER_DIR}/Cargo.toml" --release --target "${TARGET}"
+fi
 cp "${HELPER_DIR}/target/${TARGET}/release/${OUTPUT_NAME}" "${OUTPUT_DIR}/${OUTPUT_NAME}"
 echo "Bundled ${OUTPUT_NAME} into ${OUTPUT_DIR}"
diff --git a/desktop-client/src-tauri/tauri.windows.conf.json b/desktop-client/src-tauri/tauri.windows.conf.json
new file mode 100644
index 0000000..957ae3a
--- /dev/null
+++ b/desktop-client/src-tauri/tauri.windows.conf.json
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://schema.tauri.app/config/2",
+  "bundle": {
+    "targets": ["nsis"]
+  }
+}
diff --git a/docs/client-platforms.md b/docs/client-platforms.md
index e1df0e6..0d83a96 100644
--- a/docs/client-platforms.md
+++ b/docs/client-platforms.md
@@ -13,6 +13,8 @@ Repository status:
 
 - the NexaVPN tunnel helper CLI is now included in `desktop-client/tunnel-helper/`
 - the Windows x86 build can be bundled into `src-tauri/bundled/windows-x86/`
+- Ubuntu server builds can cross-compile the Windows x86 helper and Tauri app with `cargo-xwin`
+- the Linux-based Windows packaging path targets NSIS `Setup.exe`; MSI packaging still requires a Windows environment
 
 ## macOS ARM
 
@@ -33,4 +35,4 @@ Repository status:
 - Client private keys are generated and stored locally.
 - Admin debug profile downloads intentionally contain a private-key placeholder.
 - Desktop secure-secret storage is not yet production-grade keychain integration.
-- The repository now includes the helper source and bundling paths, but platform builds and signing still need to be performed in the right target environments.
+- The repository now includes the helper source and bundling paths, but final signing still needs to be performed in the right target environments.