diff --git a/e2e/regression/companion-handshake.spec.ts b/e2e/regression/companion-handshake.spec.ts
index 735c15c..3810702 100644
--- a/e2e/regression/companion-handshake.spec.ts
+++ b/e2e/regression/companion-handshake.spec.ts
@@ -21,8 +21,7 @@ const TEST_USER_ID = "00000000-0000-0000-0000-000000000001";
 
 const PROMPT_COPY =
   "For the best experience, download and install the companion app.";
-const DOWNLOAD_URL =
-  "https://github.com/shiprite-dev/minutia-desktop/releases/latest";
+const DOWNLOAD_URL = "/download";
 
 function serviceHeaders(prefer = "return=representation") {
   const key = process.env.SUPABASE_SERVICE_ROLE_KEY;
diff --git a/scripts/authz/nodes.mjs b/scripts/authz/nodes.mjs
index 8fd6531..ed8981b 100644
--- a/scripts/authz/nodes.mjs
+++ b/scripts/authz/nodes.mjs
@@ -11,6 +11,7 @@ export const manifest = [
   { id: "screen:/", kind: "screen", url: "/" },
   { id: "screen:/login", kind: "screen", url: "/login" },
   { id: "screen:/signup", kind: "screen", url: "/signup" },
+  { id: "screen:/download", kind: "screen", url: "/download" },
   { id: "screen:/reset-password", kind: "screen", url: "/reset-password" },
   { id: "screen:/accept-invite", kind: "screen", url: "/accept-invite" },
   { id: "screen:/setup", kind: "screen", url: "/setup" },
diff --git a/scripts/authz/policy.json b/scripts/authz/policy.json
index 7ee0669..47fb66c 100644
--- a/scripts/authz/policy.json
+++ b/scripts/authz/policy.json
@@ -24,6 +24,11 @@
       "note": "public signup disabled on self-host default (ENABLE_PUBLIC_SIGNUP!=true) -> redirect /login for everyone, before auth",
       "expect": { "loggedOut": "redirect:/login", "member": "redirect:/login", "orgAdmin": "redirect:/login", "globalAdmin": "redirect:/login", "crossTenant": "redirect:/login", "proMember": "redirect:/login" }
     },
+    "screen:/download": {
+      "kind": "screen",
+      "note": "public companion download page; in middleware publicPaths, no authed redirect",
+      "expect": { "loggedOut": "pass", "member": "pass", "orgAdmin": "pass", "globalAdmin": "pass", "crossTenant": "pass", "proMember": "pass" }
+    },
     "screen:/reset-password": {
       "kind": "screen",
       "expect": { "loggedOut": "pass", "member": "pass", "orgAdmin": "pass", "globalAdmin": "pass", "crossTenant": "pass", "proMember": "pass" }