diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5ec8c09..dffa10f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,9 @@ on:
         required: false
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build-macos-semantic-helper:
     strategy:
diff --git a/electron/main.js b/electron/main.js
index 51089fdf..6e1ad15f 100644
--- a/electron/main.js
+++ b/electron/main.js
@@ -156,8 +156,8 @@ function getComputerUsePermissions() {
     };
   }
 
-  let accessibility = 'unknown';
-  let screenRecording = 'unknown';
+  let accessibility;
+  let screenRecording;
   try {
     accessibility = systemPreferences.isTrustedAccessibilityClient(false) ? 'granted' : 'not_granted';
   } catch {
diff --git a/scripts/release/build-server-bundle.js b/scripts/release/build-server-bundle.js
index 962f80a8..b67ef0c3 100644
--- a/scripts/release/build-server-bundle.js
+++ b/scripts/release/build-server-bundle.js
@@ -86,6 +86,7 @@ async function writeServerPackageJson(stageDir) {
   // The bundle stage is not a git checkout with dev dependencies, so lifecycle
   // scripts such as Husky prepare must not run there. Dependency install scripts
   // still run; native modules need them before the Electron ABI rebuild below.
+  delete stagedPackageJson.scripts.postinstall;
   delete stagedPackageJson.scripts.prepare;
   delete stagedPackageJson.scripts.prepublishOnly;
   await fs.writeFile(
diff --git a/server/modules/computer-use/semantics/helpers/windows/Program.cs b/server/modules/computer-use/semantics/helpers/windows/Program.cs
index bf1fd4ab..1594d8c2 100644
--- a/server/modules/computer-use/semantics/helpers/windows/Program.cs
+++ b/server/modules/computer-use/semantics/helpers/windows/Program.cs
@@ -1,6 +1,7 @@
 using System.Diagnostics;
 using System.Drawing;
 using System.Drawing.Imaging;
+using System.IO;
 using System.Runtime.InteropServices;
 using System.Text.Json;
 using System.Windows.Automation;