diff --git a/CMakeCPackOptions.cmake.in b/CMakeCPackOptions.cmake.in
index 3a12b63d0..6b498be48 100644
--- a/CMakeCPackOptions.cmake.in
+++ b/CMakeCPackOptions.cmake.in
@@ -212,11 +212,18 @@ skip_kvasd:
     )
 
   set (CPACK_NSIS_EXTRA_INSTALL_COMMANDS "
-    ; install the kvasd executable
+    ; install the kvasd executable and ensure it can be executed
     \${If} $INSTALL_KVASD = \${BST_CHECKED}
         \${AndIf} \${FileExists} $KVASD_EXECUTABLE
       DetailPrint 'Installing: $INSTDIR\\@WSJT_BIN_DESTINATION@\\kvasd@CMAKE_EXECUTABLE_SUFFIX@'
       Rename $KVASD_EXECUTABLE '$INSTDIR\\@WSJT_BIN_DESTINATION@\\kvasd@CMAKE_EXECUTABLE_SUFFIX@'
+      AccessControl::ClearOnFile '$INSTDIR\\@WSJT_BIN_DESTINATION@\\kvasd@CMAKE_EXECUTABLE_SUFFIX@' '(BU)' 'GenericRead + GenericExecute'
+      Pop $R0
+      \${If} $R0 != ok
+        Pop $R0
+        MessageBox MB_OK 'Failed to set KVASD file permissions.\\n$R0'
+        Abort
+      \${EndIf}
     \${EndIf}"
     )
 
diff --git a/contrib/NSIS/AccessControl.zip b/contrib/NSIS/AccessControl.zip
new file mode 100644
index 000000000..94fa8929c
Binary files /dev/null and b/contrib/NSIS/AccessControl.zip differ
diff --git a/contrib/NSIS/Plugins-i386-ansi/AccessControl.dll b/contrib/NSIS/Plugins-i386-ansi/AccessControl.dll
new file mode 100644
index 000000000..0de0324fc
Binary files /dev/null and b/contrib/NSIS/Plugins-i386-ansi/AccessControl.dll differ
diff --git a/contrib/NSIS/Plugins-i386-unicode/AccessControl.dll b/contrib/NSIS/Plugins-i386-unicode/AccessControl.dll
new file mode 100644
index 000000000..cc27f63f4
Binary files /dev/null and b/contrib/NSIS/Plugins-i386-unicode/AccessControl.dll differ