diff --git a/setup/install.ps1 b/setup/install.ps1
index 2489ce3..5deed8c 100644
--- a/setup/install.ps1
+++ b/setup/install.ps1
@@ -38,6 +38,25 @@ $LogDir = Join-Path $env:ProgramData 'Ariadne'
 try { New-Item -ItemType Directory -Force -Path $LogDir | Out-Null } catch {}
 $LogFile = Join-Path $LogDir 'install.log'
 $ErrFile = Join-Path $LogDir 'install-error.log'
+
+# Collision-policy override, hot-reloaded by the daemon and edited from the
+# Ariadne's Thread panel in Theseus. Seed with the -Policy install-time choice
+# ONLY on first install so an upgrade doesn't clobber a user's later flip;
+# grant BUILTIN\Users Modify so Theseus can rewrite it without a UAC prompt.
+$PolicyFile = Join-Path $LogDir 'policy.json'
+if (-not (Test-Path $PolicyFile)) {
+  $seed = if ($Policy -eq 'bns-first') { 'bcnr-first' } else { $Policy }
+  ConvertTo-Json @{ policy = $seed } | Set-Content -Path $PolicyFile -Encoding utf8
+}
+try {
+  $acl = Get-Acl $PolicyFile
+  $rule = New-Object System.Security.AccessControl.FileSystemAccessRule(
+    [System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-545'),   # BUILTIN\Users
+    'Modify','Allow')
+  $acl.SetAccessRule($rule)
+  Set-Acl -Path $PolicyFile -AclObject $acl
+} catch {}
+
 try { Start-Transcript -Path $LogFile -Append -Force -IncludeInvocationHeader | Out-Null } catch {}
 Write-Host ""
 Write-Host ("==== install.ps1 " + (Get-Date -Format 's') + " Mode=$Mode Policy=$Policy Indexer=$Indexer ====")