diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fb29d77..afd01ed 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,8 +15,10 @@ env:
   # from frontend/package-lock.json
   GAMEAP_REF: main
   # Ref of gameap/gameap-proto providing rust/gameap-plugin-sdk; pin to a SHA if
-  # the SDK drifts from Cargo.lock
-  GAMEAP_PROTO_REF: main
+  # the SDK drifts from Cargo.lock. Pinned to the head of the proto-updates
+  # branch: HTTPResponse.file / FileRef, which src/http.rs sets, is not on main
+  # yet. Restore `main` once proto-updates is merged.
+  GAMEAP_PROTO_REF: aba9a6c002358ed56691ff1f5c28d448e5f2cdee
 
 jobs:
   build:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7351e46..7f5180c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,8 +12,10 @@ env:
   # from frontend/package-lock.json
   GAMEAP_REF: main
   # Ref of gameap/gameap-proto providing rust/gameap-plugin-sdk; pin to a SHA if
-  # the SDK drifts from Cargo.lock
-  GAMEAP_PROTO_REF: main
+  # the SDK drifts from Cargo.lock. Pinned to the head of the proto-updates
+  # branch: HTTPResponse.file / FileRef, which src/http.rs sets, is not on main
+  # yet. Restore `main` once proto-updates is merged.
+  GAMEAP_PROTO_REF: aba9a6c002358ed56691ff1f5c28d448e5f2cdee
 
 jobs:
   publish:
diff --git a/Cargo.lock b/Cargo.lock
index 9ccd031..765568d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -45,7 +45,7 @@ checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
 
 [[package]]
 name = "files"
-version = "0.7.0"
+version = "0.8.0"
 dependencies = [
  "gameap-plugin-sdk",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index 71ce6c8..e53be89 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "files"
-version = "0.7.0"
+version = "0.8.0"
 edition = "2024"
 license = "MIT"
 publish = false
diff --git a/README.md b/README.md
index ad85e79..76b80a5 100644
--- a/README.md
+++ b/README.md
@@ -6,23 +6,31 @@ FTP/SFTP daemon on nodes and manages per-server FTP users, access rules,
 virtual path mounts and SSH keys.
 
 Rust rewrite of the original Go plugin (`plugin-gameap-files`). Storage data,
-node-side YAML files and the HTTP API are fully compatible — existing installs
-keep working after the swap.
+node-side YAML files and the HTTP API are fully compatible, so the panel side
+keeps working after the swap. That compatibility does not replace the one-time
+node migration every 0.7.x install still needs — see
+[Upgrading from 0.7.x](#upgrading-from-07x).
 
 *Читайте на других языках: [Русский](README_RU.md)*
 
 ## Features
 
-- One-click gameap-files installation on nodes (chained daemon tasks, live
-  status tracking through daemon-task events with a poll/timeout fallback)
+- One-click gameap-files installation on Linux and Windows nodes (chained
+  daemon tasks, live status tracking through daemon-task events with a
+  poll/timeout fallback) and an **Update** button that re-runs the installer
+  with the stored settings to upgrade an installed node
 - Per-node FTP/SFTP configuration (`config.yaml` is patched in place — keys
-  the plugin does not own are preserved)
+  the plugin does not own are preserved); the service is restarted through
+  the system unit, the user unit of a rootless daemon, or the Windows service
 - FTP/SFTP users per game server: create/update/delete, Argon2id password
   hashing via the panel's crypto host service, one-time generated passwords
 - Path access rules (`read` / `write` / `delete` / `list`), virtual path
   mounts, SSH public keys
 - Users are mirrored to nodes as hot-reloaded YAML drop-ins under
-  `/etc/gameap-files/users.d/`
+  `<work_path>/.plugins/files/users.d/` — the plugin's service directory
+  inside the daemon work path, the one place the daemon lets a panel plugin
+  write to; a relative `home_dir` is resolved against the node work path
+  itself, not against that directory
 - Admin pages: all nodes with install status, all users grouped by
   node → server with filters
 - Server abilities `ftp-users-view` / `ftp-users-manage` for non-admin access
@@ -59,7 +67,35 @@ Panel KV storage (compatible with the Go plugin):
 - `SERVER_DELETED` — removes the server's users from storage and their YAML
   files from the node (node id taken from the event payload)
 - `DAEMON_TASK_COMPLETED` / `DAEMON_TASK_FAILED` — matched against the
-  install/download task ids stored in the node's setup status
+  install/download task ids stored in the node's setup status; a completed
+  installation re-syncs every user of the node once (`synced_after_install`
+  in the stored status) and removes the misplaced
+  `<work_path>/etc/gameap-files/users.d/*.yaml` files older releases wrote
+
+### Node layout
+
+gameap-daemon confines a panel plugin's file operations to the node work
+path, so everything this plugin writes is addressed relative to it:
+
+| Node path (relative to `work_path`) | Contents |
+|---|---|
+| `.plugins/files/config.yaml` | gameap-files configuration, patched by the settings dialog |
+| `.plugins/files/users.d/<user>.yaml` | one drop-in per FTP user |
+| `tools/install-files-linux.sh`, `tools/install-files-windows.ps1` | installers fetched with `get-tool` |
+| `tools/gameap-files/` (Windows) | binary and service of the Windows install |
+
+### Upgrading from 0.7.x
+
+After replacing the plugin, click **Update** once on every node installed by
+an earlier release: storage and API compatibility covers the panel side only,
+the node side still has to be migrated. The installer moves
+`/etc/gameap-files` into `<work_path>/.plugins/files`, the plugin re-syncs the
+node's users from the legacy location and sweeps the files the old release had
+left under `<work_path>/etc/gameap-files`.
+
+Until **Update** is clicked, such a node keeps reading `/etc/gameap-files`,
+**Settings** on it fails with "failed to download config", and users created
+in the panel are not seen by gameap-files.
 
 ## Building
 
diff --git a/README_RU.md b/README_RU.md
index 23d5bf1..17ef912 100644
--- a/README_RU.md
+++ b/README_RU.md
@@ -7,23 +7,32 @@ FTP-пользователями игровых серверов, правила
 SSH-ключами.
 
 Переписан на Rust с исходного Go-плагина (`plugin-gameap-files`). Данные в
-storage, YAML-файлы на нодах и HTTP API полностью совместимы — существующие
-установки продолжают работать после замены.
+storage, YAML-файлы на нодах и HTTP API полностью совместимы, поэтому сторона
+панели продолжает работать после замены. Эта совместимость не отменяет
+разовую миграцию, которая нужна каждой ноде с 0.7.x — см.
+[Обновление с 0.7.x](#обновление-с-07x).
 
 *Read this in other languages: [English](README.md)*
 
 ## Возможности
 
-- Установка gameap-files на ноду в один клик (цепочка daemon-тасков,
-  отслеживание статуса через события с fallback-поллингом и таймаутом)
+- Установка gameap-files на Linux- и Windows-ноды в один клик (цепочка
+  daemon-тасков, отслеживание статуса через события с fallback-поллингом и
+  таймаутом) и кнопка **Обновить**, которая повторно запускает установщик с
+  сохранёнными настройками для обновления установленной ноды
 - Настройка FTP/SFTP per-node (`config.yaml` патчится на месте — чужие ключи
-  сохраняются)
+  сохраняются); сервис перезапускается через системный юнит, user-юнит
+  rootless-демона или службу Windows
 - FTP/SFTP-пользователи по серверам: создание/изменение/удаление, Argon2id-хэши
   через crypto-сервис панели, одноразовый показ сгенерированного пароля
 - Правила доступа по путям (`read` / `write` / `delete` / `list`),
   виртуальные пути, SSH-ключи
 - Синхронизация пользователей на ноды YAML-файлами в
-  `/etc/gameap-files/users.d/` (демон перечитывает их на лету)
+  `<work_path>/.plugins/files/users.d/` — сервисный каталог плагина внутри
+  рабочего каталога демона, единственное место, куда gameap-daemon разрешает
+  писать плагину панели; относительный `home_dir` раскрывается относительно
+  рабочего каталога ноды (`work_path`), а не этого каталога; демон
+  перечитывает файлы на лету
 - Админ-страницы: список нод со статусами установки, все пользователи с
   группировкой нода → сервер и фильтрами
 - Права сервера `ftp-users-view` / `ftp-users-manage` для не-админов
@@ -59,7 +68,35 @@ KV-хранилище панели (совместимо с Go-версией):
 - `SERVER_DELETED` — удаляет пользователей сервера из storage и их YAML с ноды
   (id ноды берётся из payload события)
 - `DAEMON_TASK_COMPLETED` / `DAEMON_TASK_FAILED` — сопоставляются с id
-  install/download-тасков из сохранённого статуса установки
+  install/download-тасков из сохранённого статуса установки; завершённая
+  установка один раз пересинхронизирует всех пользователей ноды
+  (`synced_after_install` в сохранённом статусе) и удаляет ошибочные файлы
+  `<work_path>/etc/gameap-files/users.d/*.yaml`, которые писали старые релизы
+
+### Раскладка на ноде
+
+gameap-daemon ограничивает файловые операции плагина панели рабочим
+каталогом ноды, поэтому все пути плагина относительны к нему:
+
+| Путь на ноде (относительно `work_path`) | Содержимое |
+|---|---|
+| `.plugins/files/config.yaml` | конфигурация gameap-files, патчится из диалога настроек |
+| `.plugins/files/users.d/<user>.yaml` | по одному файлу на FTP-пользователя |
+| `tools/install-files-linux.sh`, `tools/install-files-windows.ps1` | установщики, скачанные через `get-tool` |
+| `tools/gameap-files/` (Windows) | бинарник и служба Windows-установки |
+
+### Обновление с 0.7.x
+
+После замены плагина нажмите **Обновить** один раз на каждой ноде,
+установленной прежним релизом: совместимость storage и API покрывает только
+сторону панели, ноду всё равно нужно мигрировать. Установщик переносит
+`/etc/gameap-files` в `<work_path>/.plugins/files`, плагин пересинхронизирует
+пользователей ноды из старого расположения и удаляет файлы, которые старый
+релиз оставил в `<work_path>/etc/gameap-files`.
+
+Пока **Обновить** не нажато, такая нода продолжает читать `/etc/gameap-files`,
+**Настройки** на ней падают с ошибкой "failed to download config", а
+созданные в панели пользователи не видны gameap-files.
 
 ## Сборка
 
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index a8a6815..369ac2b 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "plugin-files-frontend",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "plugin-files-frontend",
-      "version": "0.6.0",
+      "version": "0.8.0",
       "dependencies": {
         "@gameap/plugin-sdk": "file:../../gameap-api/web/plugin-sdk"
       },
diff --git a/frontend/package.json b/frontend/package.json
index 7a1771d..f92adea 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "plugin-files-frontend",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "GameAP Files Plugin Frontend - FTP/SFTP Users Management",
   "type": "module",
   "main": "./dist/plugin.js",
diff --git a/frontend/src/components/admin/FtpNodeCard.vue b/frontend/src/components/admin/FtpNodeCard.vue
index bad75fd..671c500 100644
--- a/frontend/src/components/admin/FtpNodeCard.vue
+++ b/frontend/src/components/admin/FtpNodeCard.vue
@@ -61,6 +61,16 @@
           <GIcon name="users" />
           <span class="ml-1">{{ trans('view_users') }}</span>
         </GButton>
+        <GButton
+          color="white"
+          size="small"
+          :loading="isOperating"
+          :title="trans('update_installation_hint')"
+          @click="emit('update', node.id)"
+        >
+          <GIcon name="sync" />
+          <span class="ml-1">{{ trans('update_installation') }}</span>
+        </GButton>
         <GButton color="white" size="small" :loading="isOperating" @click="emit('configure', node.id)">
           <GIcon name="settings" />
           <span class="ml-1">{{ trans('settings') }}</span>
@@ -91,6 +101,8 @@ const props = defineProps<{
 
 const emit = defineEmits<{
   setup: [nodeId: number];
+  /** Re-run the installer with the stored configuration (upgrade). */
+  update: [nodeId: number];
   configure: [nodeId: number];
 }>();
 
diff --git a/frontend/src/components/node/NodeStatusCard.vue b/frontend/src/components/node/NodeStatusCard.vue
index 9d99dfc..5a1e3a1 100644
--- a/frontend/src/components/node/NodeStatusCard.vue
+++ b/frontend/src/components/node/NodeStatusCard.vue
@@ -30,9 +30,19 @@
           </span>
         </GButton>
 
-        <!-- Version badge and settings button -->
+        <!-- Version badge, update and settings buttons -->
         <template v-else-if="status?.status === 'installed'">
           <GStatusBadge status="success" :text="status.version" />
+          <GButton
+            color="white"
+            size="small"
+            :loading="loading"
+            :title="trans('update_installation_hint')"
+            @click="emit('update')"
+          >
+            <GIcon name="sync" />
+            <span class="hidden lg:inline ml-1">{{ trans('update_installation') }}</span>
+          </GButton>
           <GButton
             color="white"
             size="small"
@@ -89,6 +99,8 @@ const props = defineProps<{
 
 const emit = defineEmits<{
   setup: [config?: NodeSetupConfig];
+  /** Re-run the installer with the stored configuration (upgrade). */
+  update: [];
   loadConfig: [];
   updateConfig: [config: NodeSetupConfig];
 }>();
diff --git a/frontend/src/composables/useAdminNodes.ts b/frontend/src/composables/useAdminNodes.ts
index a52daee..904c982 100644
--- a/frontend/src/composables/useAdminNodes.ts
+++ b/frontend/src/composables/useAdminNodes.ts
@@ -1,5 +1,5 @@
 import { ref } from 'vue';
-import { adminApi, nodesApi } from '@/api';
+import { adminApi, nodesApi, showApiError } from '@/api';
 import type { AdminNode, NodeSetupConfig, NodeConfigResponse } from '@/types';
 
 export function useAdminNodes() {
@@ -36,6 +36,7 @@ export function useAdminNodes() {
       await fetchNodes();
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to setup node';
+      showApiError(e, 'Failed to setup node');
       throw e;
     } finally {
       operatingNodeId.value = null;
diff --git a/frontend/src/composables/useNodeStatus.ts b/frontend/src/composables/useNodeStatus.ts
index d0abbf7..2fb7550 100644
--- a/frontend/src/composables/useNodeStatus.ts
+++ b/frontend/src/composables/useNodeStatus.ts
@@ -1,5 +1,5 @@
 import { ref, watch, onUnmounted, type Ref } from 'vue';
-import { nodesApi } from '@/api';
+import { nodesApi, showApiError } from '@/api';
 import type { NodeSetupStatus, NodeSetupConfig, NodeConfigResponse } from '@/types';
 
 export function useNodeStatus(nodeId: Ref<number | null>) {
@@ -58,6 +58,9 @@ export function useNodeStatus(nodeId: Ref<number | null>) {
       }
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to start setup';
+      // The plugin refuses unsupported node OSes with a 400 whose message is
+      // the only explanation the operator gets.
+      showApiError(e, 'Failed to start setup');
     } finally {
       loading.value = false;
     }
diff --git a/frontend/src/pages/AdminPage.vue b/frontend/src/pages/AdminPage.vue
index e78e9bb..12fb1a7 100644
--- a/frontend/src/pages/AdminPage.vue
+++ b/frontend/src/pages/AdminPage.vue
@@ -25,6 +25,7 @@
       :node="node"
       :operating-node-id="operatingNodeId"
       @setup="openSetupModal"
+      @update="onUpdateNode"
       @configure="openConfigModal"
     />
   </div>
@@ -128,6 +129,16 @@ async function onSetupConfirm(config: NodeSetupConfig | undefined) {
   }
 }
 
+// An empty setup body re-runs the installer with the node's stored
+// configuration, which is how an installed node gets upgraded.
+async function onUpdateNode(nodeId: number) {
+  try {
+    await setupNode(nodeId);
+  } catch (e) {
+    console.error('Failed to update node:', e);
+  }
+}
+
 async function openConfigModal(nodeId: number) {
   configNodeId.value = nodeId;
   await fetchNodeConfig(nodeId);
diff --git a/frontend/src/tabs/FtpUsersTab.vue b/frontend/src/tabs/FtpUsersTab.vue
index 7ed04d8..4124203 100644
--- a/frontend/src/tabs/FtpUsersTab.vue
+++ b/frontend/src/tabs/FtpUsersTab.vue
@@ -16,6 +16,7 @@
       :config="nodeConfig"
       :config-loading="configLoading"
       @setup="startNodeSetup"
+      @update="startNodeSetup()"
       @load-config="loadNodeConfig"
       @update-config="updateNodeConfig"
     />
diff --git a/frontend/src/translations/en.ts b/frontend/src/translations/en.ts
index a17257c..fffc42d 100644
--- a/frontend/src/translations/en.ts
+++ b/frontend/src/translations/en.ts
@@ -15,6 +15,8 @@ export const en = {
   status_not_installed: 'gameap-files is not installed',
   install: 'Install',
   retry_setup: 'Retry Installation',
+  update_installation: 'Update',
+  update_installation_hint: 'Reinstall the latest gameap-files release; settings and users are kept',
   installing: 'Installing',
   node_not_ready: 'gameap-files is not installed on this node. Please contact administrator.',
 
diff --git a/frontend/src/translations/ru.ts b/frontend/src/translations/ru.ts
index 7e3cd04..19c95ce 100644
--- a/frontend/src/translations/ru.ts
+++ b/frontend/src/translations/ru.ts
@@ -15,6 +15,8 @@ export const ru = {
   status_not_installed: 'gameap-files не установлен',
   install: 'Установить',
   retry_setup: 'Повторить установку',
+  update_installation: 'Обновить',
+  update_installation_hint: 'Переустановить последнюю версию gameap-files; настройки и пользователи сохраняются',
   installing: 'Установка',
   node_not_ready: 'gameap-files не установлен на этой ноде. Обратитесь к администратору.',
 
diff --git a/openapi/openapi.yaml b/openapi/openapi.yaml
index d8fa7c9..7b7c75f 100644
--- a/openapi/openapi.yaml
+++ b/openapi/openapi.yaml
@@ -2,7 +2,7 @@ openapi: 3.1.0
 info:
   title: GameAP Files Plugin API
   description: API for managing FTP/SFTP users and gameap-files server on GameAP nodes
-  version: 0.7.0
+  version: 0.8.0
   license:
     name: MIT
     url: https://opensource.org/licenses/MIT
@@ -31,13 +31,19 @@ paths:
       tags:
         - Nodes
       summary: Setup gameap-files on node
-      description: Initiates gameap-files installation and configuration on the specified node
+      description: >-
+        Starts the gameap-files installation, or re-runs the installer on an
+        already installed node (upgrade: the binary is updated, an older
+        /etc/gameap-files layout is migrated into <work_path>/.plugins/files,
+        and every FTP user of the node is re-synced afterwards). Omitted fields
+        keep the node's stored configuration (defaults when nothing is stored).
+        Linux and Windows nodes only; any other OS answers 400.
       operationId: setupNode
       parameters:
         - $ref: '#/components/parameters/nodeId'
       requestBody:
         required: false
-        description: Optional FTP/SFTP configuration overrides (defaults apply when omitted)
+        description: Optional FTP/SFTP configuration overrides (the stored configuration applies when omitted)
         content:
           application/json:
             schema:
@@ -924,8 +930,11 @@ components:
           example: mySecurePassword123
         home_dir:
           type: string
-          description: User's home directory (optional, defaults to server directory)
-          example: /srv/gameap/server1
+          description: >-
+            User's home directory. An absolute path is stored as given; a
+            relative one is resolved under the node's work path. Defaults to
+            the game server directory (<work_path>/<server dir>).
+          example: /srv/gameap/servers/server1
         quota_bytes:
           type: integer
           format: int64
@@ -981,7 +990,7 @@ components:
           minLength: 8
         home_dir:
           type: string
-          description: New home directory
+          description: New home directory (absolute, or relative to the node's work path)
         quota_bytes:
           type: integer
           format: int64
diff --git a/src/domain/mod.rs b/src/domain/mod.rs
index bfc3c38..53cabd9 100644
--- a/src/domain/mod.rs
+++ b/src/domain/mod.rs
@@ -9,8 +9,8 @@ pub mod node;
 pub mod user;
 
 pub use node::{
-    FtpConfig, NodeConfig, NodeSetupStatus, SetupStatus, SftpConfig, default_node_config,
-    extract_semver,
+    FtpConfig, NodeConfig, NodeOs, NodeSetupStatus, SetupStatus, SftpConfig,
+    default_node_config, extract_semver,
 };
 pub use user::{AccessRule, FtpUser, VirtualPath, default_access_rules, is_valid_ssh_key,
     validate_username};
diff --git a/src/domain/node.rs b/src/domain/node.rs
index bdd3bcd..a46005c 100644
--- a/src/domain/node.rs
+++ b/src/domain/node.rs
@@ -30,6 +30,32 @@ fn is_zero_i64(v: &i64) -> bool {
     *v == 0
 }
 
+fn is_false(v: &bool) -> bool {
+    !*v
+}
+
+/// Operating system of a node as the panel reports it (`linux`, `windows`,
+/// `macos`, `other`). Installation and service control differ per OS; only
+/// Linux and Windows nodes are supported.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum NodeOs {
+    Linux,
+    Windows,
+    Unsupported,
+}
+
+impl NodeOs {
+    /// Hosts predating the `os` field report an empty string; those nodes
+    /// were all Linux, which is also what the Go plugin assumed.
+    pub fn parse(os: &str) -> Self {
+        match os.trim().to_ascii_lowercase().as_str() {
+            "" | "linux" => Self::Linux,
+            "windows" => Self::Windows,
+            _ => Self::Unsupported,
+        }
+    }
+}
+
 /// Stored under NODE-scoped key `ftp:setup_status`. omitempty semantics match
 /// the Go struct exactly; `last_check` is always emitted (Go had no omitempty
 /// on it), while the HTTP status DTO omits it — keep the two apart.
@@ -51,6 +77,12 @@ pub struct NodeSetupStatus {
     /// type prefix the Go version filtered on). Absent in Go-written docs.
     #[serde(default, skip_serializing_if = "is_zero_u64")]
     pub download_task_id: u64,
+    /// Set once the node's users were re-synced after an install finished, so
+    /// the resync runs exactly once per installation even when both the event
+    /// and the status poll observe the completion. Omitted while false, so
+    /// documents written before the field existed round-trip byte for byte.
+    #[serde(default, skip_serializing_if = "is_false")]
+    pub synced_after_install: bool,
 }
 
 impl NodeSetupStatus {
@@ -63,6 +95,7 @@ impl NodeSetupStatus {
             last_check: 0,
             started_at: 0,
             download_task_id: 0,
+            synced_after_install: false,
         }
     }
 }
@@ -194,7 +227,24 @@ mod tests {
 
         let installed = r#"{"status":"installed","version":"v1.0.0","last_check":1700000000}"#;
         let status: NodeSetupStatus = serde_json::from_str(installed).unwrap();
+        assert!(!status.synced_after_install, "absent in Go-written docs");
         assert_eq!(serde_json::to_string(&status).unwrap(), installed);
+
+        let synced = r#"{"status":"installed","version":"v1.0.0","last_check":1700000000,"synced_after_install":true}"#;
+        let status: NodeSetupStatus = serde_json::from_str(synced).unwrap();
+        assert!(status.synced_after_install);
+        assert_eq!(serde_json::to_string(&status).unwrap(), synced);
+    }
+
+    #[test]
+    fn node_os_parse_table() {
+        assert_eq!(NodeOs::parse("linux"), NodeOs::Linux);
+        assert_eq!(NodeOs::parse(" Linux "), NodeOs::Linux);
+        assert_eq!(NodeOs::parse(""), NodeOs::Linux);
+        assert_eq!(NodeOs::parse("windows"), NodeOs::Windows);
+        assert_eq!(NodeOs::parse("Windows"), NodeOs::Windows);
+        assert_eq!(NodeOs::parse("macos"), NodeOs::Unsupported);
+        assert_eq!(NodeOs::parse("other"), NodeOs::Unsupported);
     }
 
     #[test]
diff --git a/src/handlers/events.rs b/src/handlers/events.rs
index 38a9a33..4ab074d 100644
--- a/src/handlers/events.rs
+++ b/src/handlers/events.rs
@@ -137,9 +137,9 @@ fn handle_task_event<H: HostApi>(host: &mut H, event: &pb::Event, completed: boo
                 }
             }
         };
-        if let Err(err) = store::save_status(host, node_id, &new_status) {
-            host.log_error(&format!("failed to handle task completion: {}", err.message));
-        }
+        // Persists the outcome and, on success, pushes every user of the node
+        // to the (possibly relocated) users directory.
+        node_setup::complete_installation(host, node_id, new_status);
         return true;
     }
 
diff --git a/src/handlers/nodes.rs b/src/handlers/nodes.rs
index 8b21e76..7cd0141 100644
--- a/src/handlers/nodes.rs
+++ b/src/handlers/nodes.rs
@@ -102,7 +102,8 @@ impl<'a> From<&'a NodeConfig> for NodeConfigResponse<'a> {
 pub fn setup<H: HostApi>(host: &mut H, parts: &RequestParts) -> ApiResult {
     let node_id = parse_u64_param(&parts.params, "nodeId")?;
 
-    // An empty body means "all defaults" (Go guarded unmarshal on body length).
+    // An empty body keeps the node's stored configuration (defaults when
+    // nothing is stored yet), which is what the Update button relies on.
     let request: NodeSetupRequest = if parts.body.is_empty() {
         NodeSetupRequest::default()
     } else {
diff --git a/src/handlers/tests.rs b/src/handlers/tests.rs
index 711ed74..00e3983 100644
--- a/src/handlers/tests.rs
+++ b/src/handlers/tests.rs
@@ -11,11 +11,27 @@ use serde_json::{Value, json};
 
 use crate::domain::{FtpUser, SetupStatus};
 use crate::host_api::mock::MockHost;
-use crate::host_api::{HostApi, StorageEntity, TaskStatus};
+use crate::host_api::{CommandOutput, HostApi, StorageEntity, TaskStatus};
 use crate::router;
+use crate::services::node_setup::{LINUX_RESTART_SYSTEM_CMD, LINUX_RESTART_USER_CMD, WINDOWS_RESTART_CMD};
 use crate::services::password::ARGON2_PARAMS;
 use crate::services::store;
 
+const USER_YAML_DIR: &str = ".plugins/files/users.d";
+const NODE_CONFIG_YAML: &str = ".plugins/files/config.yaml";
+
+fn user_yaml(username: &str) -> String {
+    format!("{USER_YAML_DIR}/{username}.yaml")
+}
+
+fn stored_status_raw(host: &MockHost, node_id: u64) -> String {
+    String::from_utf8_lossy(
+        host.storage_raw(store::KEY_NODE_SETUP_STATUS, StorageEntity::node(node_id))
+            .expect("status stored"),
+    )
+    .into_owned()
+}
+
 fn request(method: &str, path: &str, body: &[u8]) -> pb::HttpRequest {
     pb::HttpRequest {
         method: method.into(),
@@ -99,14 +115,87 @@ fn create_user_with_generated_password() {
     assert_eq!(String::from_utf8_lossy(list_raw), r#"["bob"]"#);
 
     let yaml = host
-        .file(1, "/etc/gameap-files/users.d/bob.yaml")
+        .file(1, &user_yaml("bob"))
         .expect("yaml synced to node");
     let synced: FtpUser = serde_yaml_ng::from_slice(yaml).expect("valid yaml");
     assert_eq!(synced, user);
-    assert_eq!(
-        host.uploads,
-        vec![(1, "/etc/gameap-files/users.d/bob.yaml".to_string(), 0o600)]
+    assert_eq!(host.uploads, vec![(1, user_yaml("bob"), 0o600)]);
+}
+
+#[test]
+fn create_user_default_home_dir_is_joined_with_work_path() {
+    let mut host = MockHost::standard().with_windows_node();
+    let (status, body) = create_user(&mut host, 9, json!({"username": "bob"}));
+    assert_eq!(status, 201);
+    assert_eq!(body["home_dir"], r"C:\gameap\servers\cs2");
+    assert_eq!(stored_user(&host, 9, "bob").home_dir, r"C:\gameap\servers\cs2");
+    assert_eq!(host.uploads, vec![(7, user_yaml("bob"), 0o600)]);
+}
+
+#[test]
+fn create_user_relative_home_dir_is_resolved() {
+    let mut host = MockHost::standard();
+    let (status, body) = create_user(
+        &mut host,
+        3,
+        json!({"username": "bob", "home_dir": "servers/custom"}),
     );
+    assert_eq!(status, 201);
+    assert_eq!(body["home_dir"], "/srv/gameap/servers/custom");
+    assert_eq!(stored_user(&host, 3, "bob").home_dir, "/srv/gameap/servers/custom");
+}
+
+#[test]
+fn create_user_absolute_home_dir_untouched() {
+    let mut host = MockHost::standard().with_windows_node();
+    let (status, body) = create_user(
+        &mut host,
+        9,
+        json!({"username": "bob", "home_dir": r"D:\ftp\bob"}),
+    );
+    assert_eq!(status, 201);
+    assert_eq!(body["home_dir"], r"D:\ftp\bob");
+
+    let (_, body) = create_user(&mut host, 3, json!({"username": "alice", "home_dir": "/custom"}));
+    assert_eq!(body["home_dir"], "/custom");
+}
+
+#[test]
+fn update_user_relative_home_dir_is_resolved() {
+    let mut host = MockHost::standard();
+    create_user(&mut host, 3, json!({"username": "bob"}));
+
+    let (status, body) = dispatch(
+        &mut host,
+        &request(
+            "PUT",
+            "/servers/3/ftp-users/bob",
+            json!({"home_dir": "servers/moved"}).to_string().as_bytes(),
+        ),
+    );
+    assert_eq!(status, 200);
+    assert_eq!(body["home_dir"], "/srv/gameap/servers/moved");
+    assert_eq!(stored_user(&host, 3, "bob").home_dir, "/srv/gameap/servers/moved");
+
+    let (_, body) = dispatch(
+        &mut host,
+        &request(
+            "PUT",
+            "/servers/3/ftp-users/bob",
+            json!({"home_dir": "/abs"}).to_string().as_bytes(),
+        ),
+    );
+    assert_eq!(body["home_dir"], "/abs");
+}
+
+#[test]
+fn create_user_fails_when_node_missing() {
+    let mut host = MockHost::standard();
+    host.nodes.remove(&1);
+    let (status, body) = create_user(&mut host, 3, json!({"username": "bob"}));
+    assert_eq!(status, 500);
+    assert_eq!(body["code"], "INTERNAL_ERROR");
+    assert_eq!(body["message"], "node 1 not found");
 }
 
 #[test]
@@ -239,10 +328,7 @@ fn delete_user_cleans_storage_and_node() {
         .storage_raw(store::KEY_SERVER_USER_LIST, StorageEntity::server(3))
         .expect("list key kept");
     assert_eq!(String::from_utf8_lossy(list_raw), "[]");
-    assert_eq!(
-        host.removed,
-        vec![(1, "/etc/gameap-files/users.d/bob.yaml".to_string(), false)]
-    );
+    assert_eq!(host.removed, vec![(1, user_yaml("bob"), false)]);
 
     let (status, _) = dispatch(&mut host, &request("DELETE", "/servers/3/ftp-users/bob", b""));
     assert_eq!(status, 404);
@@ -429,6 +515,95 @@ fn setup_creates_chained_tasks_and_stores_state() {
     assert_eq!(host.created_tasks.len(), 2);
 }
 
+#[test]
+fn setup_with_empty_body_keeps_stored_config() {
+    let mut host = MockHost::standard();
+    host.seed_storage(
+        store::KEY_NODE_CONFIG,
+        StorageEntity::node(1),
+        br#"{"ftp":{"address":"","port":2121,"passive_port_min":30000,"passive_port_max":30100,"public_host":"","tls_enabled":false,"tls_implicit_port":990},"sftp":{"port":2222}}"#,
+    );
+
+    let (status, _) = dispatch(&mut host, &request("POST", "/nodes/1/setup", b""));
+    assert_eq!(status, 200);
+
+    let install_cmd = &host.created_tasks[1].2;
+    assert!(install_cmd.contains("--ftp-listen-address=:2121"), "{install_cmd}");
+
+    let config: Value = serde_json::from_slice(
+        host.storage_raw(store::KEY_NODE_CONFIG, StorageEntity::node(1)).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(config["ftp"]["port"], 2121, "stored config survives an update run");
+
+    let stored: Value = serde_json::from_str(&stored_status_raw(&host, 1)).unwrap();
+    assert!(
+        stored.get("synced_after_install").is_none(),
+        "flag is omitted while false: {stored}"
+    );
+}
+
+#[test]
+fn setup_on_windows_node_chains_powershell_installer() {
+    let mut host = MockHost::standard().with_windows_node();
+    let (status, body) = dispatch(&mut host, &request("POST", "/nodes/7/setup", b""));
+    assert_eq!(status, 200);
+    assert_eq!(body["status"], "installing");
+
+    assert_eq!(host.created_tasks.len(), 2);
+    assert_eq!(
+        host.created_tasks[0].2,
+        "get-tool https://raw.githubusercontent.com/gameap/scripts/master/ftp/gameap-files/install-files-windows.ps1"
+    );
+    assert_eq!(
+        host.created_tasks[1].2,
+        "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass \
+         -File \"{node_tools_path}/install-files-windows.ps1\" \
+         -DataDir \"{node_work_path}\" -InstallDir \"{node_tools_path}/gameap-files\" \
+         -FtpListenAddress :21 -FtpPassivePortMin 30000 -FtpPassivePortMax 30100 \
+         -FtpTlsImplicitPort :990 -SftpListenAddress :2222"
+    );
+    assert_eq!(host.created_tasks[1].3, Some(host.created_tasks[0].0));
+
+    let mut host = MockHost::standard().with_windows_node();
+    let (status, _) = dispatch(
+        &mut host,
+        &request(
+            "POST",
+            "/nodes/7/setup",
+            json!({"ftp": {"address": "0.0.0.0", "port": 2121, "public_host": "ftp.example.com", "tls_enabled": true}})
+                .to_string()
+                .as_bytes(),
+        ),
+    );
+    assert_eq!(status, 200);
+    let install_cmd = &host.created_tasks[1].2;
+    assert!(install_cmd.contains("-FtpListenAddress 0.0.0.0:2121"), "{install_cmd}");
+    assert!(install_cmd.contains("-FtpPublicHost ftp.example.com"), "{install_cmd}");
+    assert!(install_cmd.ends_with(" -FtpTlsEnabled"), "{install_cmd}");
+}
+
+#[test]
+fn setup_rejects_unsupported_node_os() {
+    let mut host = MockHost::standard().with_node_os(1, "macos");
+    let (status, body) = dispatch(&mut host, &request("POST", "/nodes/1/setup", b""));
+    assert_eq!(status, 400);
+    assert_eq!(body["code"], "INVALID_INPUT");
+    assert!(
+        body["message"]
+            .as_str()
+            .unwrap()
+            .starts_with("unsupported node OS \"macos\""),
+        "{body}"
+    );
+    assert!(host.created_tasks.is_empty(), "no task may be created for an unsupported node");
+    assert!(
+        host.storage_raw(store::KEY_NODE_SETUP_STATUS, StorageEntity::node(1))
+            .is_none(),
+        "nothing is recorded for an unsupported node"
+    );
+}
+
 #[test]
 fn setup_with_overrides_and_missing_node() {
     let mut host = MockHost::standard();
@@ -461,10 +636,12 @@ fn status_probes_node_when_nothing_stored() {
     assert_eq!(status, 200);
     assert_eq!(body["status"], "installed");
     assert_eq!(body["version"], "v1.2.3");
+    assert_eq!(host.commands, vec!["gameap-files version 2>/dev/null || echo 'not_installed'"]);
     assert!(
         host.storage_raw(store::KEY_NODE_SETUP_STATUS, StorageEntity::node(1)).is_none(),
         "probe result is not persisted (Go parity)"
     );
+    assert!(host.uploads.is_empty(), "an unsaved probe never triggers a resync");
 
     host.push_result("sh: gameap-files: command not found", 0);
     let (_, body) = dispatch(&mut host, &request("GET", "/nodes/1/status", b""));
@@ -498,6 +675,41 @@ fn status_follows_install_task_lifecycle() {
     assert_eq!(stored.status, SetupStatus::Installed);
 }
 
+#[test]
+fn status_probe_on_windows_uses_absolute_binary_path() {
+    let mut host = MockHost::standard().with_windows_node();
+    host.push_result("gameap-files version v1.2.3", 0);
+    let (_, body) = dispatch(&mut host, &request("GET", "/nodes/7/status", b""));
+    assert_eq!(body["status"], "installed");
+    assert_eq!(
+        host.commands,
+        vec![r"C:\gameap\tools\gameap-files\gameap-files.exe version"]
+    );
+}
+
+#[test]
+fn status_poll_completion_resyncs_once() {
+    let mut host = MockHost::standard();
+    create_user(&mut host, 3, json!({"username": "bob"}));
+    host.uploads.clear();
+    host.removed.clear();
+    dispatch(&mut host, &request("POST", "/nodes/1/setup", b""));
+
+    host.set_task_state(102, TaskStatus::Success, "done");
+    host.push_result("gameap-files version 1.0.0", 0);
+    let (_, body) = dispatch(&mut host, &request("GET", "/nodes/1/status", b""));
+    assert_eq!(body["status"], "installed");
+    assert!(body.get("synced_after_install").is_none(), "DTO does not expose the flag");
+    assert_eq!(host.uploads, vec![(1, user_yaml("bob"), 0o600)]);
+    assert_eq!(host.removed, vec![(1, "etc/gameap-files/users.d/bob.yaml".to_string(), false)]);
+    assert!(store::get_status(&mut host, 1).unwrap().unwrap().synced_after_install);
+
+    // A later poll finds the install recorded and resyncs nothing.
+    let (_, body) = dispatch(&mut host, &request("GET", "/nodes/1/status", b""));
+    assert_eq!(body["status"], "installed");
+    assert_eq!(host.uploads.len(), 1);
+}
+
 #[test]
 fn status_reports_task_failure_and_cancellation() {
     let mut host = MockHost::standard();
@@ -554,7 +766,7 @@ fn status_times_out_stuck_installations() {
     assert_eq!(body["status"], "installing");
 }
 
-const DAEMON_CONFIG: &str = "server:\n  data_dir: /srv/gameap\nftp:\n  enabled: true\n  listen_addr: \":21\"\n  tls:\n    cert_file: /etc/gameap-files/cert.pem\nsecurity:\n  argon2:\n    memory: 65536\n";
+const DAEMON_CONFIG: &str = "server:\n  data_dir: /srv/gameap\nftp:\n  enabled: true\n  listen_addr: \":21\"\n  tls:\n    cert_file: tls/server.crt\nsecurity:\n  argon2:\n    memory: 65536\n";
 
 #[test]
 fn node_config_get_and_update() {
@@ -566,7 +778,7 @@ fn node_config_get_and_update() {
     assert_eq!(body["ftp"]["passive_port_min"], 30000);
     assert_eq!(body["sftp"]["port"], 2222);
 
-    host.upload(1, "/etc/gameap-files/config.yaml", DAEMON_CONFIG.as_bytes(), 0o644)
+    host.upload(1, NODE_CONFIG_YAML, DAEMON_CONFIG.as_bytes(), 0o644)
         .unwrap();
     host.uploads.clear();
 
@@ -593,22 +805,20 @@ fn node_config_get_and_update() {
     assert_eq!(stored["ftp"]["port"], 2121);
 
     // Node config.yaml was patched, preserving foreign keys, and the service restarted.
-    let patched = host.file(1, "/etc/gameap-files/config.yaml").unwrap();
+    assert_eq!(host.uploads, vec![(1, NODE_CONFIG_YAML.to_string(), 0o644)]);
+    let patched = host.file(1, NODE_CONFIG_YAML).unwrap();
     let patched: serde_yaml_ng::Value = serde_yaml_ng::from_slice(patched).unwrap();
     assert_eq!(patched["ftp"]["listen_addr"], serde_yaml_ng::Value::from(":2121"));
     assert_eq!(
         patched["ftp"]["tls"]["cert_file"],
-        serde_yaml_ng::Value::from("/etc/gameap-files/cert.pem")
+        serde_yaml_ng::Value::from("tls/server.crt")
     );
     assert_eq!(
         patched["security"]["argon2"]["memory"],
         serde_yaml_ng::Value::from(65536)
     );
     assert_eq!(patched["server"]["data_dir"], serde_yaml_ng::Value::from("/srv/gameap"));
-    assert!(host
-        .commands
-        .iter()
-        .any(|cmd| cmd == "systemctl restart gameap-files.service"));
+    assert_eq!(host.commands, vec![LINUX_RESTART_SYSTEM_CMD]);
 
     // Empty body on PUT is a 400 (Go behavior differs from setup here).
     let (status, body) = dispatch(&mut host, &request("PUT", "/nodes/1/config", b""));
@@ -619,11 +829,12 @@ fn node_config_get_and_update() {
 #[test]
 fn node_config_update_fails_when_restart_fails() {
     let mut host = MockHost::standard();
-    host.upload(1, "/etc/gameap-files/config.yaml", DAEMON_CONFIG.as_bytes(), 0o644)
+    host.upload(1, NODE_CONFIG_YAML, DAEMON_CONFIG.as_bytes(), 0o644)
         .unwrap();
+    // Matches both the system and the user unit command.
     host.fail_on.push((
-        "systemctl restart".into(),
-        crate::host_api::CommandOutput {
+        "restart gameap-files.service".into(),
+        CommandOutput {
             output: "unit not found".into(),
             exit_code: 1,
             error: None,
@@ -636,10 +847,77 @@ fn node_config_update_fails_when_restart_fails() {
     assert_eq!(status, 500);
     assert_eq!(
         body["message"],
-        "failed to apply config to node: restart failed: unit not found"
+        "failed to apply config to node: restart failed: system unit: unit not found; user unit: unit not found"
+    );
+    assert_eq!(
+        host.commands,
+        vec![LINUX_RESTART_SYSTEM_CMD, LINUX_RESTART_USER_CMD]
+    );
+}
+
+#[test]
+fn node_config_update_falls_back_to_user_unit() {
+    let mut host = MockHost::standard();
+    host.upload(1, NODE_CONFIG_YAML, DAEMON_CONFIG.as_bytes(), 0o644)
+        .unwrap();
+    host.fail_on.push((
+        LINUX_RESTART_SYSTEM_CMD.into(),
+        CommandOutput {
+            output: "Failed to connect to bus".into(),
+            exit_code: 1,
+            error: None,
+        },
+    ));
+    let (status, body) = dispatch(
+        &mut host,
+        &request("PUT", "/nodes/1/config", br#"{"ftp": {"port": 2121}}"#),
+    );
+    assert_eq!(status, 200, "{body}");
+    assert_eq!(
+        host.commands,
+        vec![LINUX_RESTART_SYSTEM_CMD, LINUX_RESTART_USER_CMD]
     );
 }
 
+#[test]
+fn node_config_update_on_windows_restarts_via_powershell() {
+    let mut host = MockHost::standard().with_windows_node();
+    host.upload(7, NODE_CONFIG_YAML, DAEMON_CONFIG.as_bytes(), 0o644)
+        .unwrap();
+    let (status, body) = dispatch(
+        &mut host,
+        &request("PUT", "/nodes/7/config", br#"{"ftp": {"port": 2121}}"#),
+    );
+    assert_eq!(status, 200, "{body}");
+    assert_eq!(host.commands, vec![WINDOWS_RESTART_CMD]);
+    assert_eq!(
+        WINDOWS_RESTART_CMD,
+        "powershell -NoProfile -NonInteractive -Command \"Restart-Service -Name gameap-files -ErrorAction Stop\""
+    );
+
+    let mut host = MockHost::standard().with_windows_node();
+    host.upload(7, NODE_CONFIG_YAML, DAEMON_CONFIG.as_bytes(), 0o644)
+        .unwrap();
+    host.fail_on.push((
+        "Restart-Service".into(),
+        CommandOutput {
+            output: "Cannot find any service with service name 'gameap-files'.".into(),
+            exit_code: 1,
+            error: None,
+        },
+    ));
+    let (status, body) = dispatch(
+        &mut host,
+        &request("PUT", "/nodes/7/config", br#"{"ftp": {"port": 2121}}"#),
+    );
+    assert_eq!(status, 500);
+    assert_eq!(
+        body["message"],
+        "failed to apply config to node: restart failed: Cannot find any service with service name 'gameap-files'."
+    );
+    assert!(host.commands.iter().all(|cmd| !cmd.contains("systemctl")));
+}
+
 // --- admin ---
 
 #[test]
@@ -652,6 +930,7 @@ fn admin_nodes_lists_status_per_node() {
             name: "node-2".into(),
             ips: vec![],
             work_path: "/srv".into(),
+            os: "linux".into(),
         },
     );
     host.seed_storage(
@@ -682,6 +961,7 @@ fn admin_users_groups_and_filters() {
             name: "node-2".into(),
             ips: vec![],
             work_path: "/srv".into(),
+            os: "linux".into(),
         },
     );
     host.servers.insert(
@@ -845,8 +1125,8 @@ fn server_deleted_wipes_storage_and_node_files() {
     assert_eq!(
         removed_paths,
         vec![
-            "/etc/gameap-files/users.d/alice.yaml",
-            "/etc/gameap-files/users.d/bob.yaml"
+            ".plugins/files/users.d/alice.yaml",
+            ".plugins/files/users.d/bob.yaml"
         ]
     );
     assert!(host.removed.iter().all(|(node, ..)| *node == 1), "ds_id from payload");
@@ -895,6 +1175,63 @@ fn task_events_match_stored_task_ids() {
     assert!(!crate::handlers::events::handle(&mut host, &event).handled);
 }
 
+#[test]
+fn install_completion_event_resyncs_users_and_sweeps_legacy_files() {
+    let mut host = MockHost::standard();
+    create_user(&mut host, 3, json!({"username": "bob"}));
+    create_user(&mut host, 3, json!({"username": "alice"}));
+    host.uploads.clear();
+    host.removed.clear();
+    dispatch(&mut host, &request("POST", "/nodes/1/setup", b""));
+
+    host.push_result("gameap-files version v1.0.0", 0);
+    let event = task_event(pb::EventType::DaemonTaskCompleted, 1, 102, "cmdexec");
+    assert!(crate::handlers::events::handle(&mut host, &event).handled);
+
+    let mut uploaded: Vec<(u64, String, u32)> = host.uploads.clone();
+    uploaded.sort();
+    assert_eq!(
+        uploaded,
+        vec![(1, user_yaml("alice"), 0o600), (1, user_yaml("bob"), 0o600)]
+    );
+    let mut removed: Vec<(u64, String, bool)> = host.removed.clone();
+    removed.sort();
+    assert_eq!(
+        removed,
+        vec![
+            (1, "etc/gameap-files/users.d/alice.yaml".to_string(), false),
+            (1, "etc/gameap-files/users.d/bob.yaml".to_string(), false),
+        ]
+    );
+
+    let stored = store::get_status(&mut host, 1).unwrap().unwrap();
+    assert_eq!(stored.status, SetupStatus::Installed);
+    assert!(stored.synced_after_install);
+    assert!(stored_status_raw(&host, 1).contains("\"synced_after_install\":true"));
+
+    // The same completion delivered again is ignored and syncs nothing more.
+    assert!(!crate::handlers::events::handle(&mut host, &event).handled);
+    assert_eq!(host.uploads.len(), 2);
+}
+
+#[test]
+fn failed_install_does_not_resync() {
+    let mut host = MockHost::standard();
+    create_user(&mut host, 3, json!({"username": "bob"}));
+    host.uploads.clear();
+    dispatch(&mut host, &request("POST", "/nodes/1/setup", b""));
+    host.set_task_state(102, TaskStatus::Error, "boom");
+
+    let event = task_event(pb::EventType::DaemonTaskFailed, 1, 102, "cmdexec");
+    assert!(crate::handlers::events::handle(&mut host, &event).handled);
+    assert!(host.uploads.is_empty());
+
+    let stored = store::get_status(&mut host, 1).unwrap().unwrap();
+    assert_eq!(stored.status, SetupStatus::Failed);
+    assert!(!stored.synced_after_install);
+    assert!(!stored_status_raw(&host, 1).contains("synced_after_install"));
+}
+
 #[test]
 fn task_failure_records_output_from_task() {
     let mut host = MockHost::standard();
diff --git a/src/handlers/users.rs b/src/handlers/users.rs
index c25fb90..a874652 100644
--- a/src/handlers/users.rs
+++ b/src/handlers/users.rs
@@ -124,13 +124,17 @@ pub fn create<H: HostApi>(host: &mut H, parts: &RequestParts) -> ApiResult {
     }
 
     // Go resolved the server before creating (a missing server is a 500) and
-    // used its dir as the default home. One lookup serves both here.
+    // used its dir as the default home. The panel stores that dir relative to
+    // the node work path, so it is joined here: gameap-files chroots to the
+    // literal path, and a relative one used to resolve against its working
+    // directory.
     let server = host
         .get_server(server_id)?
         .ok_or_else(|| crate::http::ApiError::internal(format!("server {server_id} not found")))?;
+    let work_path = sync::node_work_path(host, server.node_id)?;
     let home_dir = match input.home_dir.as_deref() {
-        Some(dir) if !dir.is_empty() => dir.to_string(),
-        _ => server.dir,
+        Some(dir) if !dir.is_empty() => sync::resolve_home_dir(&work_path, dir),
+        _ => sync::join_node_path(&work_path, &server.dir),
     };
 
     let result = users::create(
@@ -176,8 +180,15 @@ pub fn update<H: HostApi>(host: &mut H, parts: &RequestParts) -> ApiResult {
     let input: UpdateUserRequest = parse_json_body(parts.body)?;
 
     // Go resolved the server's node before updating; a missing server is a
-    // 500 even though the id itself went unused.
-    sync::node_id_for_server(host, server_id)?;
+    // 500. The node is also where a relative home_dir is anchored.
+    let node_id = sync::node_id_for_server(host, server_id)?;
+    let home_dir = match input.home_dir {
+        Some(dir) if !dir.is_empty() && !sync::is_absolute_node_path(&dir) => {
+            let work_path = sync::node_work_path(host, node_id)?;
+            Some(sync::resolve_home_dir(&work_path, &dir))
+        }
+        other => other,
+    };
 
     let user = users::update(
         host,
@@ -185,7 +196,7 @@ pub fn update<H: HostApi>(host: &mut H, parts: &RequestParts) -> ApiResult {
         &username,
         users::UpdateUserInput {
             password: input.password,
-            home_dir: input.home_dir,
+            home_dir,
             quota_bytes: input.quota_bytes,
             enabled: input.enabled,
             description: input.description,
diff --git a/src/host_api.rs b/src/host_api.rs
index 2f216b3..f7e9c6d 100644
--- a/src/host_api.rs
+++ b/src/host_api.rs
@@ -72,6 +72,15 @@ pub struct NodeInfo {
     pub name: String,
     pub ips: Vec<String>,
     pub work_path: String,
+    /// `linux`, `windows`, `macos` or `other` as normalized by the panel;
+    /// empty on hosts predating the field.
+    pub os: String,
+}
+
+impl NodeInfo {
+    pub fn os_kind(&self) -> crate::domain::NodeOs {
+        crate::domain::NodeOs::parse(&self.os)
+    }
 }
 
 /// Result of a command executed on a node. `error` is carried but most call
@@ -215,6 +224,7 @@ mod wasm {
             name: n.name,
             ips: n.ips,
             work_path: n.work_path,
+            os: n.os,
         }
     }
 
@@ -304,9 +314,13 @@ mod wasm {
         }
 
         fn download(&mut self, node_id: u64, path: &str) -> HostResult<Vec<u8>> {
+            // offset/length 0 = the whole file, up to the panel's inline limit;
+            // config.yaml is far below it.
             let resp = host::nodefs::download(&nodefs::DownloadRequest {
                 node_id,
                 path: path.to_owned(),
+                offset: 0,
+                length: 0,
             })
             .map_err(call_err)?;
             match resp.error {
@@ -414,10 +428,14 @@ mod wasm {
             key_prefix: &str,
             entity: StorageEntity,
         ) -> HostResult<Vec<(String, Vec<u8>)>> {
+            // No page window: a server's user list is small, and callers
+            // expect the complete set like the Go repository returned.
             let resp = host::storage::list(&storage::StorageListRequest {
                 key_prefix: Some(key_prefix.to_owned()),
                 entity_type: Some(entity.entity_type),
                 entity_id: Some(entity.entity_id),
+                limit: None,
+                offset: None,
             })
             .map_err(call_err)?;
             Ok(resp
@@ -541,7 +559,8 @@ pub mod mock {
     }
 
     impl MockHost {
-        /// Node 1 ("node-1", /srv/gameap) with server 3 ("cs", cstrike).
+        /// Node 1 ("node-1", linux, /srv/gameap) with server 3 ("cs", cstrike).
+        /// The server dir is relative to the work path, as the panel stores it.
         pub fn standard() -> Self {
             let mut host = Self::default();
             host.nodes.insert(
@@ -551,6 +570,7 @@ pub mod mock {
                     name: "node-1".into(),
                     ips: vec!["203.0.113.1".into()],
                     work_path: "/srv/gameap".into(),
+                    os: "linux".into(),
                 },
             );
             host.servers.insert(
@@ -560,13 +580,46 @@ pub mod mock {
                     node_id: 1,
                     name: "cs".into(),
                     game_id: "cstrike".into(),
-                    dir: "/srv/gameap/servers/cs".into(),
+                    dir: "servers/cs".into(),
                     enabled: true,
                 },
             );
             host
         }
 
+        /// Adds node 7 ("win-1", windows, C:\gameap) with server 9 ("cs2").
+        pub fn with_windows_node(mut self) -> Self {
+            self.nodes.insert(
+                7,
+                NodeInfo {
+                    id: 7,
+                    name: "win-1".into(),
+                    ips: vec!["203.0.113.7".into()],
+                    work_path: r"C:\gameap".into(),
+                    os: "windows".into(),
+                },
+            );
+            self.servers.insert(
+                9,
+                ServerInfo {
+                    id: 9,
+                    node_id: 7,
+                    name: "cs2".into(),
+                    game_id: "cs2".into(),
+                    dir: r"servers\cs2".into(),
+                    enabled: true,
+                },
+            );
+            self
+        }
+
+        pub fn with_node_os(mut self, id: u64, os: &str) -> Self {
+            if let Some(node) = self.nodes.get_mut(&id) {
+                node.os = os.into();
+            }
+            self
+        }
+
         pub fn push_result(&mut self, output: &str, exit_code: i32) {
             self.command_results.push_back(CommandOutput {
                 output: output.into(),
diff --git a/src/http.rs b/src/http.rs
index a60a1bb..2604622 100644
--- a/src/http.rs
+++ b/src/http.rs
@@ -85,11 +85,13 @@ pub fn json_response<T: Serialize>(status: i32, value: &T) -> pb::HttpResponse {
             status_code: status,
             headers: json_headers(),
             body,
+            file: None,
         },
         Err(_) => pb::HttpResponse {
             status_code: 500,
             headers: json_headers(),
             body: br#"{"code":"INTERNAL_ERROR","message":"failed to serialize response"}"#.to_vec(),
+            file: None,
         },
     }
 }
diff --git a/src/lib.rs b/src/lib.rs
index c5da307..1e1c27d 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -2,10 +2,13 @@
 //!
 //! The panel's KV storage is the source of truth for FTP users, access rules,
 //! virtual paths and SSH keys; changes are mirrored to nodes as YAML drop-ins
-//! under `/etc/gameap-files/users.d/` (the daemon hot-reloads them). Node
-//! installation runs through chained daemon tasks; per-node FTP/SFTP settings
-//! are patched into `/etc/gameap-files/config.yaml` in place, preserving keys
-//! this plugin does not own.
+//! under `<work_path>/.plugins/files/users.d/` (the daemon hot-reloads them).
+//! Every node path is relative to the daemon work path: gameap-daemon confines
+//! plugin file operations to it, and `.plugins/files` is the service directory
+//! the panel grants this plugin under every path policy. Node installation
+//! runs through chained daemon tasks (Linux and Windows installers); per-node
+//! FTP/SFTP settings are patched into `.plugins/files/config.yaml` in place,
+//! preserving keys this plugin does not own.
 //!
 //! Rust port of the Go plugin `plugin-gameap-files`. Storage JSON, node YAML
 //! and the HTTP API are wire-compatible with data written by the Go version.
diff --git a/src/services/node_setup.rs b/src/services/node_setup.rs
index 03b38fb..8a19626 100644
--- a/src/services/node_setup.rs
+++ b/src/services/node_setup.rs
@@ -4,22 +4,50 @@
 //! the install script with flags built from [`NodeConfig`]). Progress is
 //! tracked in storage; completion arrives either through daemon-task events
 //! (matched by task id — see handlers::events) or through the status-poll
-//! fallback with its 15-minute timeout.
+//! fallback with its 15-minute timeout. Whichever observes the completion
+//! first also re-syncs the node's users ([`complete_installation`]).
+//!
+//! Linux nodes run the bash installer; Windows nodes run the PowerShell one.
+//! Windows command strings are built with [`shell_join_windows`] and address
+//! the script through the daemon's `{node_tools_path}` / `{node_work_path}`
+//! placeholders, which the daemon substitutes before splitting a task command.
 
 use crate::domain::{
-    NodeConfig, NodeSetupStatus, SetupStatus, default_node_config, extract_semver,
+    FtpConfig, NodeConfig, NodeOs, NodeSetupStatus, SetupStatus, SftpConfig,
+    default_node_config, extract_semver,
 };
 use crate::handlers::nodes::NodeSetupRequest;
-use crate::host_api::{HostApi, TaskStatus};
+use crate::host_api::{CommandOutput, HostApi, NodeInfo, TaskStatus};
 use crate::http::ApiError;
-use crate::services::{store, yamlpatch};
-use crate::shell::shell_join;
+use crate::services::{store, sync, yamlpatch};
+use crate::shell::{shell_join, shell_join_windows};
 
 pub const INSTALL_SCRIPT_URL: &str =
     "https://raw.githubusercontent.com/gameap/scripts/master/ftp/gameap-files/install-files-linux.sh";
+pub const WINDOWS_INSTALL_SCRIPT_URL: &str =
+    "https://raw.githubusercontent.com/gameap/scripts/master/ftp/gameap-files/install-files-windows.ps1";
+const WINDOWS_INSTALL_SCRIPT_NAME: &str = "install-files-windows.ps1";
 /// If the install task is still "in progress" after this long, mark it failed.
 pub const INSTALLING_TIMEOUT_SECS: i64 = 900;
-pub const NODE_CONFIG_PATH: &str = "/etc/gameap-files/config.yaml";
+/// Relative to the node work path, like every path handed to the daemon.
+pub const NODE_CONFIG_PATH: &str = ".plugins/files/config.yaml";
+pub const WINDOWS_SERVICE_NAME: &str = "gameap-files";
+/// Byte-identical to the Go plugin's: the daemon passes `2>/dev/null` and
+/// `||` through as literal argv, so the useful signal is the daemon's own
+/// "executable file not found" output / non-zero exit.
+const LINUX_VERSION_PROBE_CMD: &str = "gameap-files version 2>/dev/null || echo 'not_installed'";
+/// The Windows installer is pinned to `<tools>\gameap-files`, a directory that
+/// does not exist when `get-tool` refreshes the daemon PATH, so the probe has
+/// to name the binary outright.
+const WINDOWS_BINARY_REL_PATH: &str = r"tools\gameap-files\gameap-files.exe";
+pub const LINUX_RESTART_SYSTEM_CMD: &str = "systemctl restart gameap-files.service";
+/// A rootless gameap-daemon runs gameap-files as a user unit; `systemctl
+/// --user` needs the user manager's runtime directory, which a daemon started
+/// without a session does not have in its environment.
+pub const LINUX_RESTART_USER_CMD: &str = "sh -c 'XDG_RUNTIME_DIR=\"${XDG_RUNTIME_DIR:-/run/user/$(id -u)}\" systemctl --user restart gameap-files.service'";
+/// `-ErrorAction Stop`: a missing service is otherwise a non-terminating
+/// error and `powershell -Command` exits 0 regardless.
+pub const WINDOWS_RESTART_CMD: &str = "powershell -NoProfile -NonInteractive -Command \"Restart-Service -Name gameap-files -ErrorAction Stop\"";
 
 pub fn setup_node<H: HostApi>(
     host: &mut H,
@@ -32,19 +60,19 @@ pub fn setup_node<H: HostApi>(
         return Ok(status); // Already in progress.
     }
 
-    let node = host
-        .get_node(node_id)
-        .map_err(|err| ApiError::internal(format!("failed to get node info: {}", err.into_message())))?
-        .ok_or_else(|| ApiError::internal(format!("node {node_id} not found")))?;
+    let node = get_node(host, node_id)?;
+    let node_config = setup_config(host, node_id, request)?;
+    // Refused before any task exists, so an unsupported node never ends up
+    // "installing".
+    let install_cmd = prepare_install_command(&node, &node_config)?;
 
-    let download_cmd = format!("get-tool {INSTALL_SCRIPT_URL}");
+    let download_cmd = format!("get-tool {}", install_script_url(node.os_kind()));
     let download_task_id = host
         .create_daemon_task(node_id, &download_cmd, None)
         .map_err(|err| {
             ApiError::internal(format!("failed to create download task: {}", err.into_message()))
         })?;
 
-    let install_cmd = prepare_install_command(&node.work_path, request);
     let install_task_id = host
         .create_daemon_task(node_id, &install_cmd, Some(download_task_id))
         .map_err(|err| {
@@ -65,24 +93,58 @@ pub fn setup_node<H: HostApi>(
     if let Err(err) = store::save_status(host, node_id, &new_status) {
         host.log_error(&format!("failed to save status: {}", err.message));
     }
-    let node_config = merged_node_config(request);
     if let Err(err) = store::save_config(host, node_id, &node_config) {
         host.log_error(&format!("failed to save config: {}", err.message));
     }
 
     host.log_info(&format!(
-        "started gameap-files installation: node_id={node_id} download_task_id={download_task_id} install_task_id={install_task_id}"
+        "started gameap-files installation: node_id={node_id} os={} download_task_id={download_task_id} install_task_id={install_task_id}",
+        node.os
     ));
 
     Ok(new_status)
 }
 
-/// Defaults overlaid with whatever the setup request provided
-/// (Go `setupConfigToNodeConfig`).
-pub fn merged_node_config(request: &NodeSetupRequest) -> NodeConfig {
-    let mut config = default_node_config();
+fn get_node<H: HostApi>(host: &mut H, node_id: u64) -> Result<NodeInfo, ApiError> {
+    host.get_node(node_id)
+        .map_err(|err| ApiError::internal(format!("failed to get node info: {}", err.into_message())))?
+        .ok_or_else(|| ApiError::internal(format!("node {node_id} not found")))
+}
+
+/// The node's stored configuration (defaults when nothing is stored) overlaid
+/// with whatever the setup request provided. Re-running setup on an installed
+/// node — the Update button sends no body — therefore keeps its ports; the Go
+/// `setupConfigToNodeConfig` started from the defaults every time.
+pub fn setup_config<H: HostApi>(
+    host: &mut H,
+    node_id: u64,
+    request: &NodeSetupRequest,
+) -> Result<NodeConfig, ApiError> {
+    let mut config = get_config(host, node_id)?;
+    complete_config(&mut config);
     apply_patch(&mut config, request);
-    config
+    Ok(config)
+}
+
+/// Fills sections a stored document lacks from the defaults, so a command
+/// built from it never sees a zero port.
+fn complete_config(config: &mut NodeConfig) {
+    let defaults = default_node_config();
+    if config.ftp.is_none() {
+        config.ftp = defaults.ftp;
+    }
+    if config.sftp.is_none() {
+        config.sftp = defaults.sftp;
+    }
+}
+
+fn effective_sections(config: &NodeConfig) -> (FtpConfig, SftpConfig) {
+    let mut config = config.clone();
+    complete_config(&mut config);
+    (
+        config.ftp.unwrap_or_default(),
+        config.sftp.unwrap_or_default(),
+    )
 }
 
 /// Go `mergeConfigUpdates`: overlay every provided field, creating sections
@@ -119,15 +181,31 @@ pub fn apply_patch(config: &mut NodeConfig, request: &NodeSetupRequest) {
     }
 }
 
-/// Builds the install-script invocation. The daemon splits the string with
-/// go-shellquote and execs directly, so tokens are joined via shell_join —
-/// for ordinary values this yields the same argv as the Go `%q` formatting.
-fn prepare_install_command(work_path: &str, request: &NodeSetupRequest) -> String {
-    let defaults = default_node_config();
-    let mut config = defaults;
-    apply_patch(&mut config, request);
-    let ftp = config.ftp.unwrap_or_default();
-    let sftp = config.sftp.unwrap_or_default();
+fn install_script_url(os: NodeOs) -> &'static str {
+    match os {
+        NodeOs::Windows => WINDOWS_INSTALL_SCRIPT_URL,
+        NodeOs::Linux | NodeOs::Unsupported => INSTALL_SCRIPT_URL,
+    }
+}
+
+/// Builds the install-script invocation for the node's OS. Only Linux and
+/// Windows nodes have an installer; anything else is a 400 for the caller.
+pub fn prepare_install_command(node: &NodeInfo, config: &NodeConfig) -> Result<String, ApiError> {
+    match node.os_kind() {
+        NodeOs::Linux => Ok(linux_install_command(&node.work_path, config)),
+        NodeOs::Windows => Ok(windows_install_command(config)),
+        NodeOs::Unsupported => Err(ApiError::bad_request(format!(
+            "unsupported node OS \"{}\": gameap-files can be installed on linux and windows nodes only",
+            node.os
+        ))),
+    }
+}
+
+/// The daemon splits the string with go-shellquote and execs directly, so
+/// tokens are joined via shell_join — for ordinary values this yields the
+/// same argv as the Go `%q` formatting.
+fn linux_install_command(work_path: &str, config: &NodeConfig) -> String {
+    let (ftp, sftp) = effective_sections(config);
 
     let data_dir = format!("--data-dir={work_path}");
     let listen = format!("--ftp-listen-address={}:{}", ftp.address, ftp.port);
@@ -151,6 +229,58 @@ fn prepare_install_command(work_path: &str, request: &NodeSetupRequest) -> Strin
     ])
 }
 
+/// The script path must match where `get-tool` put the file, which is the
+/// daemon's own tools directory — hence the placeholder rather than the work
+/// path the panel knows. `-InstallDir` is pinned below that same directory so
+/// the version probe can name the binary; `-DataDir` is the daemon work path,
+/// which makes `<DataDir>\.plugins\files` exactly where this plugin's uploads
+/// land. `-File` stays last among the PowerShell options: everything after it
+/// belongs to the script.
+fn windows_install_command(config: &NodeConfig) -> String {
+    let (ftp, sftp) = effective_sections(config);
+
+    let script = format!("{{node_tools_path}}/{WINDOWS_INSTALL_SCRIPT_NAME}");
+    let install_dir = format!("{{node_tools_path}}/{WINDOWS_SERVICE_NAME}");
+    let listen = format!("{}:{}", ftp.address, ftp.port);
+    let passive_min = ftp.passive_port_min.to_string();
+    let passive_max = ftp.passive_port_max.to_string();
+    let tls_port = format!(":{}", ftp.tls_implicit_port);
+    let sftp_listen = format!(":{}", sftp.port);
+
+    let mut args: Vec<&str> = vec![
+        "powershell",
+        "-NoProfile",
+        "-NonInteractive",
+        "-ExecutionPolicy",
+        "Bypass",
+        "-File",
+        &script,
+        "-DataDir",
+        "{node_work_path}",
+        "-InstallDir",
+        &install_dir,
+        "-FtpListenAddress",
+        &listen,
+        "-FtpPassivePortMin",
+        &passive_min,
+        "-FtpPassivePortMax",
+        &passive_max,
+        "-FtpTlsImplicitPort",
+        &tls_port,
+        "-SftpListenAddress",
+        &sftp_listen,
+    ];
+    if !ftp.public_host.is_empty() {
+        args.push("-FtpPublicHost");
+        args.push(&ftp.public_host);
+    }
+    if ftp.tls_enabled {
+        args.push("-FtpTlsEnabled");
+    }
+
+    shell_join_windows(&args)
+}
+
 pub fn get_status<H: HostApi>(
     host: &mut H,
     node_id: u64,
@@ -166,8 +296,7 @@ pub fn get_status<H: HostApi>(
         match check_daemon_task(host, node_id, status.task_id) {
             Err(err) => host.log_warn(&format!("failed to check task status: {}", err.message)),
             Ok(Some(new_status)) => {
-                store::save_status(host, node_id, &new_status).ok();
-                return Ok(Some(new_status));
+                return Ok(Some(complete_installation(host, node_id, new_status)));
             }
             Ok(None) => {}
         }
@@ -200,17 +329,44 @@ pub fn get_status<H: HostApi>(
     Ok(Some(status))
 }
 
-/// Probes `gameap-files version` on the node. The command string is
-/// byte-identical to the Go plugin's: the daemon passes `2>/dev/null` and
-/// `||` through as literal argv, so the useful signal is the daemon's own
-/// "executable file not found" output / non-zero exit — which is exactly what
-/// the fallback string checks match.
+/// Persists the outcome of an installation. A successful one also pushes
+/// every user of the node to the users directory and sweeps the misplaced
+/// files of earlier releases — once: the flag guards against the event and
+/// the status poll both observing the same completion, or two panel
+/// instances sharing one storage.
+pub fn complete_installation<H: HostApi>(
+    host: &mut H,
+    node_id: u64,
+    mut status: NodeSetupStatus,
+) -> NodeSetupStatus {
+    if status.status == SetupStatus::Installed && !status.synced_after_install {
+        // Recorded before the resync so its outcome survives a resync that
+        // runs out of budget.
+        if let Err(err) = store::save_status(host, node_id, &status) {
+            host.log_error(&format!("failed to save status: {}", err.message));
+        }
+        let report = sync::resync_node_users(host, node_id);
+        host.log_info(&format!(
+            "post-install resync: node_id={node_id} synced={} failed={} legacy_removed={}",
+            report.synced, report.failed, report.legacy_removed
+        ));
+        status.synced_after_install = true;
+    }
+    if let Err(err) = store::save_status(host, node_id, &status) {
+        host.log_error(&format!("failed to save status: {}", err.message));
+    }
+    status
+}
+
+/// Probes `gameap-files version` on the node.
 pub fn check_installation<H: HostApi>(
     host: &mut H,
     node_id: u64,
 ) -> Result<NodeSetupStatus, ApiError> {
+    let node = host.get_node(node_id).ok().flatten();
+    let probe = version_probe_command(node.as_ref());
     let resp = host
-        .execute_command(node_id, "gameap-files version 2>/dev/null || echo 'not_installed'")
+        .execute_command(node_id, &probe)
         .map_err(ApiError::from)?;
     let now = host.now_unix();
 
@@ -255,6 +411,16 @@ pub fn check_installation<H: HostApi>(
     }
 }
 
+fn version_probe_command(node: Option<&NodeInfo>) -> String {
+    match node {
+        Some(node) if node.os_kind() == NodeOs::Windows => {
+            let binary = sync::join_node_path(&node.work_path, WINDOWS_BINARY_REL_PATH);
+            shell_join_windows(&[&binary, "version"])
+        }
+        _ => LINUX_VERSION_PROBE_CMD.to_string(),
+    }
+}
+
 /// Polls the tracked install task. `None` = still in progress / not found.
 pub fn check_daemon_task<H: HostApi>(
     host: &mut H,
@@ -307,6 +473,8 @@ fn apply_config_to_node<H: HostApi>(
     node_id: u64,
     config: &NodeConfig,
 ) -> Result<(), ApiError> {
+    let node = get_node(host, node_id)?;
+
     let original = host
         .download(node_id, NODE_CONFIG_PATH)
         .map_err(|err| ApiError::internal(format!("failed to download config: {}", err.into_message())))?;
@@ -316,27 +484,97 @@ fn apply_config_to_node<H: HostApi>(
     host.upload(node_id, NODE_CONFIG_PATH, &patched, 0o644)
         .map_err(|err| ApiError::internal(format!("failed to upload config: {}", err.into_message())))?;
 
-    let restart = host
-        .execute_command(node_id, "systemctl restart gameap-files.service")
-        .map_err(|err| {
-            ApiError::internal(format!("failed to restart service: {}", err.into_message()))
-        })?;
-    if restart.exit_code != 0 {
-        return Err(ApiError::internal(format!("restart failed: {}", restart.output)));
-    }
+    restart_service(host, &node)?;
 
     host.log_info(&format!("applied config to node: node_id={node_id}"));
     Ok(())
 }
 
+/// Windows restarts the service; Linux tries the system unit first and falls
+/// back to the user unit of a rootless daemon.
+fn restart_service<H: HostApi>(host: &mut H, node: &NodeInfo) -> Result<(), ApiError> {
+    if node.os_kind() == NodeOs::Windows {
+        let restart = run_restart(host, node.id, WINDOWS_RESTART_CMD)?;
+        if restart.exit_code != 0 {
+            return Err(ApiError::internal(format!(
+                "restart failed: {}",
+                restart.output.trim()
+            )));
+        }
+        return Ok(());
+    }
+
+    let system = run_restart(host, node.id, LINUX_RESTART_SYSTEM_CMD)?;
+    if system.exit_code == 0 {
+        return Ok(());
+    }
+    host.log_warn(&format!(
+        "system unit restart failed on node {} (exit {}), trying the user unit: {}",
+        node.id,
+        system.exit_code,
+        system.output.trim()
+    ));
+
+    let user = run_restart(host, node.id, LINUX_RESTART_USER_CMD)?;
+    if user.exit_code == 0 {
+        return Ok(());
+    }
+    Err(ApiError::internal(format!(
+        "restart failed: system unit: {}; user unit: {}",
+        system.output.trim(),
+        user.output.trim()
+    )))
+}
+
+fn run_restart<H: HostApi>(
+    host: &mut H,
+    node_id: u64,
+    command: &str,
+) -> Result<CommandOutput, ApiError> {
+    host.execute_command(node_id, command).map_err(|err| {
+        ApiError::internal(format!("failed to restart service: {}", err.into_message()))
+    })
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::handlers::nodes::{FtpConfigPatch, SftpConfigPatch};
 
+    fn node(os: &str, work_path: &str) -> NodeInfo {
+        NodeInfo {
+            id: 1,
+            name: "n".into(),
+            ips: vec![],
+            work_path: work_path.into(),
+            os: os.into(),
+        }
+    }
+
+    fn overrides() -> NodeConfig {
+        let mut config = default_node_config();
+        apply_patch(
+            &mut config,
+            &NodeSetupRequest {
+                ftp: Some(FtpConfigPatch {
+                    address: Some("0.0.0.0".into()),
+                    port: Some(2121),
+                    passive_port_min: Some(40000),
+                    passive_port_max: Some(40100),
+                    public_host: Some("ftp.example.com".into()),
+                    tls_enabled: Some(true),
+                    tls_implicit_port: Some(991),
+                }),
+                sftp: Some(SftpConfigPatch { port: Some(2223) }),
+            },
+        );
+        config
+    }
+
     #[test]
     fn install_command_with_defaults() {
-        let cmd = prepare_install_command("/srv/gameap", &NodeSetupRequest::default());
+        let cmd =
+            prepare_install_command(&node("linux", "/srv/gameap"), &default_node_config()).unwrap();
         assert_eq!(
             cmd,
             "install-files-linux.sh --data-dir=/srv/gameap --ftp-listen-address=:21 \
@@ -347,19 +585,7 @@ mod tests {
 
     #[test]
     fn install_command_with_overrides() {
-        let request = NodeSetupRequest {
-            ftp: Some(FtpConfigPatch {
-                address: Some("0.0.0.0".into()),
-                port: Some(2121),
-                passive_port_min: Some(40000),
-                passive_port_max: Some(40100),
-                public_host: Some("ftp.example.com".into()),
-                tls_enabled: Some(true),
-                tls_implicit_port: Some(991),
-            }),
-            sftp: Some(SftpConfigPatch { port: Some(2223) }),
-        };
-        let cmd = prepare_install_command("/srv/game ap", &request);
+        let cmd = prepare_install_command(&node("linux", "/srv/game ap"), &overrides()).unwrap();
         assert!(cmd.contains("'--data-dir=/srv/game ap'"));
         assert!(cmd.contains("--ftp-listen-address=0.0.0.0:2121"));
         assert!(cmd.contains("--ftp-passive-port-min=40000"));
@@ -368,4 +594,72 @@ mod tests {
         assert!(cmd.contains("--ftp-tls-implicit-port=:991"));
         assert!(cmd.contains("--sftp-listen-address=:2223"));
     }
+
+    #[test]
+    fn install_command_fills_missing_sections_from_defaults() {
+        let config = NodeConfig {
+            ftp: None,
+            sftp: None,
+        };
+        let cmd = prepare_install_command(&node("", "/srv/gameap"), &config).unwrap();
+        assert!(cmd.contains("--ftp-listen-address=:21"), "{cmd}");
+        assert!(cmd.contains("--sftp-listen-address=:2222"), "{cmd}");
+    }
+
+    #[test]
+    fn windows_install_command_with_defaults() {
+        let cmd =
+            prepare_install_command(&node("windows", r"C:\gameap"), &default_node_config()).unwrap();
+        assert_eq!(
+            cmd,
+            "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass \
+             -File \"{node_tools_path}/install-files-windows.ps1\" \
+             -DataDir \"{node_work_path}\" -InstallDir \"{node_tools_path}/gameap-files\" \
+             -FtpListenAddress :21 -FtpPassivePortMin 30000 -FtpPassivePortMax 30100 \
+             -FtpTlsImplicitPort :990 -SftpListenAddress :2222"
+        );
+    }
+
+    #[test]
+    fn windows_install_command_with_overrides() {
+        let cmd = prepare_install_command(&node("windows", r"C:\gameap"), &overrides()).unwrap();
+        assert!(cmd.contains("-FtpListenAddress 0.0.0.0:2121"), "{cmd}");
+        assert!(cmd.contains("-FtpPassivePortMin 40000"), "{cmd}");
+        assert!(cmd.contains("-FtpPassivePortMax 40100"), "{cmd}");
+        assert!(cmd.contains("-FtpTlsImplicitPort :991"), "{cmd}");
+        assert!(cmd.contains("-SftpListenAddress :2223"), "{cmd}");
+        assert!(cmd.contains("-FtpPublicHost ftp.example.com"), "{cmd}");
+        assert!(cmd.ends_with(" -FtpTlsEnabled"), "{cmd}");
+    }
+
+    #[test]
+    fn unsupported_os_is_rejected() {
+        let err = prepare_install_command(&node("macos", "/Users/gameap"), &default_node_config())
+            .unwrap_err();
+        assert_eq!(err.status, 400);
+        assert!(err.message.starts_with("unsupported node OS \"macos\""), "{}", err.message);
+    }
+
+    #[test]
+    fn install_script_url_per_os() {
+        assert_eq!(install_script_url(NodeOs::Linux), INSTALL_SCRIPT_URL);
+        assert_eq!(install_script_url(NodeOs::Windows), WINDOWS_INSTALL_SCRIPT_URL);
+    }
+
+    #[test]
+    fn version_probe_per_os() {
+        assert_eq!(version_probe_command(None), LINUX_VERSION_PROBE_CMD);
+        assert_eq!(
+            version_probe_command(Some(&node("linux", "/srv/gameap"))),
+            LINUX_VERSION_PROBE_CMD
+        );
+        assert_eq!(
+            version_probe_command(Some(&node("windows", r"C:\gameap"))),
+            r"C:\gameap\tools\gameap-files\gameap-files.exe version"
+        );
+        assert_eq!(
+            version_probe_command(Some(&node("windows", r"C:\Program Files\gameap"))),
+            r#""C:\Program Files\gameap\tools\gameap-files\gameap-files.exe" version"#
+        );
+    }
 }
diff --git a/src/services/sync.rs b/src/services/sync.rs
index 90c7ce5..794b2d8 100644
--- a/src/services/sync.rs
+++ b/src/services/sync.rs
@@ -1,19 +1,33 @@
 //! Mirrors storage state to nodes: one YAML drop-in per user under
-//! `/etc/gameap-files/users.d/` (the daemon hot-reloads the directory).
+//! `<work_path>/.plugins/files/users.d/` (the daemon hot-reloads the
+//! directory). Node paths are relative to the daemon work path on purpose:
+//! gameap-daemon confines plugin file operations to that path, and
+//! `.plugins/files` is the service directory the panel grants this plugin
+//! under every path policy, on Linux and Windows nodes alike.
 //! All sync failures are the caller's to downgrade — handlers log a warning
 //! and keep the HTTP request successful, exactly like the Go plugin.
 
 use crate::domain::FtpUser;
-use crate::host_api::HostApi;
+use crate::host_api::{HostApi, HostApiError};
 use crate::http::ApiError;
+use crate::services::store;
 
-pub const USERS_CONFIG_DIR: &str = "/etc/gameap-files/users.d";
+pub const USERS_CONFIG_DIR: &str = ".plugins/files/users.d";
+/// Where uploads of releases before 0.8 landed: they named the absolute
+/// `/etc/gameap-files/users.d`, which the daemon resolved under its work path
+/// as `<work_path>/etc/gameap-files/users.d`. Never read by gameap-files;
+/// swept after an installation finishes.
+pub const LEGACY_MISPLACED_USERS_DIR: &str = "etc/gameap-files/users.d";
 const USER_CONFIG_PERM: u32 = 0o600;
 
 pub fn user_config_path(username: &str) -> String {
     format!("{USERS_CONFIG_DIR}/{username}.yaml")
 }
 
+pub fn legacy_misplaced_user_config_path(username: &str) -> String {
+    format!("{LEGACY_MISPLACED_USERS_DIR}/{username}.yaml")
+}
+
 /// Node id of a server, with the Go plugin's "server %d not found" message
 /// (surfaces as a 500, which the create/update handlers rely on).
 pub fn node_id_for_server<H: HostApi>(host: &mut H, server_id: u64) -> Result<u64, ApiError> {
@@ -23,11 +37,51 @@ pub fn node_id_for_server<H: HostApi>(host: &mut H, server_id: u64) -> Result<u6
     Ok(server.node_id)
 }
 
-pub fn server_dir<H: HostApi>(host: &mut H, server_id: u64) -> Result<String, ApiError> {
-    let server = host
-        .get_server(server_id)?
-        .ok_or_else(|| ApiError::internal(format!("server {server_id} not found")))?;
-    Ok(server.dir)
+/// Work path of a node (the daemon's data directory), a 500 when the node is
+/// gone.
+pub fn node_work_path<H: HostApi>(host: &mut H, node_id: u64) -> Result<String, ApiError> {
+    let node = host
+        .get_node(node_id)?
+        .ok_or_else(|| ApiError::internal(format!("node {node_id} not found")))?;
+    Ok(node.work_path)
+}
+
+/// Absolute on either OS: `/…`, `\…`, `X:\…`, `X:/…`.
+pub fn is_absolute_node_path(path: &str) -> bool {
+    let bytes = path.as_bytes();
+    if matches!(bytes.first(), Some(b'/' | b'\\')) {
+        return true;
+    }
+    bytes.len() >= 3
+        && bytes[0].is_ascii_alphabetic()
+        && bytes[1] == b':'
+        && matches!(bytes[2], b'/' | b'\\')
+}
+
+/// Joins a work-path-relative entry onto the work path with the separator the
+/// work path itself uses, so a Windows node gets a Windows path. An absolute
+/// `rel` is returned as is.
+pub fn join_node_path(work_path: &str, rel: &str) -> String {
+    if is_absolute_node_path(rel) {
+        return rel.to_string();
+    }
+    let separator = if work_path.contains('\\') { '\\' } else { '/' };
+    let base = work_path.trim_end_matches(['/', '\\']);
+    let rel = rel.trim_start_matches(['/', '\\']);
+    if rel.is_empty() {
+        return if base.is_empty() {
+            work_path.to_string()
+        } else {
+            base.to_string()
+        };
+    }
+    format!("{base}{separator}{rel}")
+}
+
+/// A home directory as the client asked for it: absolute paths are kept,
+/// relative ones are anchored under the node work path.
+pub fn resolve_home_dir(work_path: &str, requested: &str) -> String {
+    join_node_path(work_path, requested)
 }
 
 pub fn sync_user_to_node<H: HostApi>(
@@ -75,7 +129,6 @@ pub fn delete_user_from_node<H: HostApi>(
 }
 
 fn remove_user_config<H: HostApi>(host: &mut H, node_id: u64, username: &str) {
-    use crate::host_api::HostApiError;
     match host.remove(node_id, &user_config_path(username), false) {
         Ok(()) => {}
         Err(HostApiError::Op(message)) => {
@@ -105,3 +158,175 @@ pub fn delete_all_users_from_node<H: HostApi>(
         remove_user_config(host, node_id, username);
     }
 }
+
+#[derive(Debug, Default, PartialEq, Eq)]
+pub struct ResyncReport {
+    pub synced: usize,
+    pub failed: usize,
+    pub legacy_removed: usize,
+}
+
+/// Pushes every user of every server on the node to the users directory and
+/// sweeps the misplaced files earlier releases left behind. Run once after an
+/// installation finishes: an upgrade moves the users directory, and a node
+/// installed by an older release has its users where nothing reads them.
+/// Never fails — a user that cannot be synced is warned about and counted.
+pub fn resync_node_users<H: HostApi>(host: &mut H, node_id: u64) -> ResyncReport {
+    let mut report = ResyncReport::default();
+
+    let servers = match host.find_servers(&[], &[node_id]) {
+        Ok(servers) => servers,
+        Err(err) => {
+            host.log_warn(&format!(
+                "resync: failed to list servers of node {node_id}: {}",
+                err.message()
+            ));
+            return report;
+        }
+    };
+
+    for server in servers {
+        let users = match store::list_users_by_server(host, server.id) {
+            Ok(users) => users,
+            Err(err) => {
+                host.log_warn(&format!(
+                    "resync: failed to list users of server {}: {}",
+                    server.id, err.message
+                ));
+                continue;
+            }
+        };
+        for user in users {
+            match upload_user_config(host, node_id, &user) {
+                Ok(()) => report.synced += 1,
+                Err(err) => {
+                    report.failed += 1;
+                    host.log_warn(&format!("resync: {}", err.message));
+                }
+            }
+            // The daemon refuses to remove what is not there, which is the
+            // normal case; only an actual removal counts.
+            if host
+                .remove(node_id, &legacy_misplaced_user_config_path(&user.username), false)
+                .is_ok()
+            {
+                report.legacy_removed += 1;
+            }
+        }
+    }
+
+    report
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::domain::default_access_rules;
+    use crate::host_api::mock::MockHost;
+
+    #[test]
+    fn user_config_paths_are_work_path_relative() {
+        assert_eq!(user_config_path("bob"), ".plugins/files/users.d/bob.yaml");
+        assert_eq!(
+            legacy_misplaced_user_config_path("bob"),
+            "etc/gameap-files/users.d/bob.yaml"
+        );
+    }
+
+    #[test]
+    fn join_node_path_table() {
+        let cases: &[(&str, &str, &str)] = &[
+            ("/srv/gameap", "servers/cs", "/srv/gameap/servers/cs"),
+            ("/srv/gameap/", "servers/cs", "/srv/gameap/servers/cs"),
+            (r"C:\gameap", r"servers\cs2", r"C:\gameap\servers\cs2"),
+            (r"C:\gameap\", "servers/cs2", r"C:\gameap\servers/cs2"),
+            ("C:/gameap", "servers/cs", "C:/gameap/servers/cs"),
+            ("/srv/gameap", "/x", "/x"),
+            ("/srv/gameap", r"D:\x", r"D:\x"),
+            (r"C:\gameap", "D:/x", "D:/x"),
+            ("/srv/gameap", "", "/srv/gameap"),
+            ("/srv/gameap/", "", "/srv/gameap"),
+            ("/", "servers/cs", "/servers/cs"),
+        ];
+        for (work_path, rel, want) in cases {
+            assert_eq!(join_node_path(work_path, rel), *want, "{work_path} + {rel}");
+        }
+    }
+
+    #[test]
+    fn absolute_node_paths() {
+        assert!(is_absolute_node_path("/srv"));
+        assert!(is_absolute_node_path(r"\srv"));
+        assert!(is_absolute_node_path(r"C:\gameap"));
+        assert!(is_absolute_node_path("c:/gameap"));
+        assert!(!is_absolute_node_path("servers/cs"));
+        assert!(!is_absolute_node_path("C:gameap"));
+        assert!(!is_absolute_node_path(""));
+    }
+
+    #[test]
+    fn resolve_home_dir_keeps_absolute_and_anchors_relative() {
+        assert_eq!(resolve_home_dir("/srv/gameap", "/custom"), "/custom");
+        assert_eq!(resolve_home_dir("/srv/gameap", "servers/a"), "/srv/gameap/servers/a");
+        assert_eq!(resolve_home_dir(r"C:\gameap", "servers/a"), r"C:\gameap\servers/a");
+    }
+
+    fn user(name: &str) -> FtpUser {
+        FtpUser {
+            username: name.into(),
+            password_hash: "h".into(),
+            ssh_public_keys: vec![],
+            home_dir: "/srv/gameap/servers/cs".into(),
+            quota_bytes: 0,
+            access_rules: default_access_rules(),
+            virtual_paths: vec![],
+            enabled: true,
+            description: String::new(),
+        }
+    }
+
+    #[test]
+    fn resync_uploads_every_user_and_sweeps_legacy_files() {
+        let mut host = MockHost::standard();
+        store::save_user(&mut host, 3, &user("bob")).unwrap();
+        store::save_user(&mut host, 3, &user("alice")).unwrap();
+
+        let report = resync_node_users(&mut host, 1);
+        assert_eq!(
+            report,
+            ResyncReport {
+                synced: 2,
+                failed: 0,
+                legacy_removed: 2
+            }
+        );
+
+        let mut uploaded: Vec<(u64, String, u32)> = host.uploads.clone();
+        uploaded.sort();
+        assert_eq!(
+            uploaded,
+            vec![
+                (1, ".plugins/files/users.d/alice.yaml".to_string(), 0o600),
+                (1, ".plugins/files/users.d/bob.yaml".to_string(), 0o600),
+            ]
+        );
+        let mut removed: Vec<(u64, String, bool)> = host.removed.clone();
+        removed.sort();
+        assert_eq!(
+            removed,
+            vec![
+                (1, "etc/gameap-files/users.d/alice.yaml".to_string(), false),
+                (1, "etc/gameap-files/users.d/bob.yaml".to_string(), false),
+            ]
+        );
+    }
+
+    #[test]
+    fn resync_of_a_node_without_servers_is_a_noop() {
+        let mut host = MockHost::standard();
+        let report = resync_node_users(&mut host, 42);
+        assert_eq!(report, ResyncReport::default());
+        assert!(host.uploads.is_empty());
+        assert!(host.removed.is_empty());
+    }
+}
diff --git a/src/services/yamlpatch.rs b/src/services/yamlpatch.rs
index 8e4e0ae..41447cd 100644
--- a/src/services/yamlpatch.rs
+++ b/src/services/yamlpatch.rs
@@ -84,11 +84,11 @@ ftp:
   tls:
     enabled: false
     implicit_port: ":990"
-    cert_file: /etc/gameap-files/cert.pem
+    cert_file: tls/server.crt
 sftp:
   enabled: true
   listen_addr: ":2222"
-  host_key_file: /etc/gameap-files/ssh_host_ed25519_key
+  host_key_file: ssh/host_ed25519_key
 security:
   argon2:
     memory: 65536
@@ -132,7 +132,7 @@ logging:
         assert_eq!(value["ftp"]["idle_timeout"], Value::from(300));
         assert_eq!(
             value["ftp"]["tls"]["cert_file"],
-            Value::from("/etc/gameap-files/cert.pem")
+            Value::from("tls/server.crt")
         );
         assert_eq!(value["sftp"]["enabled"], Value::from(true));
         assert_eq!(value["security"]["argon2"]["memory"], Value::from(65536));
diff --git a/src/shell.rs b/src/shell.rs
index 86c8ba7..2401603 100644
--- a/src/shell.rs
+++ b/src/shell.rs
@@ -6,6 +6,12 @@
 //! spaces or specials survives `Split` as exactly one argument. The Go plugin
 //! used `%q` (double quotes) for install-script arguments; single-quoting
 //! yields the identical argv after `Split` and handles non-ASCII correctly.
+//!
+//! Windows nodes need [`shell_join_windows`]: before splitting, the daemon
+//! doubles every backslash (its `pkg/shellquote`), so a bare or double-quoted
+//! `C:\gameap` comes back unchanged while a single-quoted one keeps the doubled
+//! backslashes. Double quotes are therefore the only quoting that round-trips
+//! a Windows path, and a backslash counts as a plain character there.
 
 /// Joins arguments into a single command string, single-quoting any token that
 /// is empty or contains characters outside a conservative safe set. Compatible
@@ -14,15 +20,28 @@ pub fn shell_join(args: &[&str]) -> String {
     args.iter().map(|a| quote(a)).collect::<Vec<_>>().join(" ")
 }
 
+/// [`shell_join`] for commands a Windows daemon splits (see the module docs).
+pub fn shell_join_windows(args: &[&str]) -> String {
+    args.iter()
+        .map(|a| quote_windows(a))
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+fn is_safe_byte(b: u8) -> bool {
+    b.is_ascii_alphanumeric()
+        || matches!(
+            b,
+            b'_' | b'@' | b'%' | b'+' | b'=' | b':' | b',' | b'.' | b'/' | b'-'
+        )
+}
+
 fn is_safe(s: &str) -> bool {
-    !s.is_empty()
-        && s.bytes().all(|b| {
-            b.is_ascii_alphanumeric()
-                || matches!(
-                    b,
-                    b'_' | b'@' | b'%' | b'+' | b'=' | b':' | b',' | b'.' | b'/' | b'-'
-                )
-        })
+    !s.is_empty() && s.bytes().all(is_safe_byte)
+}
+
+fn is_safe_windows(s: &str) -> bool {
+    !s.is_empty() && s.bytes().all(|b| is_safe_byte(b) || b == b'\\')
 }
 
 fn quote(s: &str) -> String {
@@ -43,6 +62,27 @@ fn quote(s: &str) -> String {
     out
 }
 
+fn quote_windows(s: &str) -> String {
+    if is_safe_windows(s) {
+        return s.to_string();
+    }
+    // Double-quote wrap. A backslash escape cannot express an embedded double
+    // quote here (the daemon would double the backslash first), so the quoted
+    // run is closed, the quote spliced in as a single-quoted token, and the
+    // run reopened — adjacent quoted runs form one word.
+    let mut out = String::with_capacity(s.len() + 2);
+    out.push('"');
+    for ch in s.chars() {
+        if ch == '"' {
+            out.push_str("\"'\"'\"");
+        } else {
+            out.push(ch);
+        }
+    }
+    out.push('"');
+    out
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -76,4 +116,39 @@ mod tests {
     fn empty_token_is_quoted() {
         assert_eq!(quote(""), "''");
     }
+
+    #[test]
+    fn windows_bare_backslash_path_passes_through() {
+        assert_eq!(
+            shell_join_windows(&[r"C:\gameap\tools\gameap-files\gameap-files.exe", "version"]),
+            r"C:\gameap\tools\gameap-files\gameap-files.exe version"
+        );
+    }
+
+    #[test]
+    fn windows_spaces_use_double_quotes() {
+        assert_eq!(
+            shell_join_windows(&["-DataDir", r"C:\Program Files\gameap"]),
+            r#"-DataDir "C:\Program Files\gameap""#
+        );
+    }
+
+    #[test]
+    fn windows_placeholder_token_is_double_quoted() {
+        assert_eq!(quote_windows("{node_work_path}"), r#""{node_work_path}""#);
+        assert_eq!(
+            quote_windows("{node_tools_path}/install-files-windows.ps1"),
+            r#""{node_tools_path}/install-files-windows.ps1""#
+        );
+    }
+
+    #[test]
+    fn windows_embedded_double_quote() {
+        assert_eq!(quote_windows(r#"a"b"#), r#""a"'"'"b""#);
+    }
+
+    #[test]
+    fn windows_empty_token() {
+        assert_eq!(quote_windows(""), r#""""#);
+    }
 }