diff --git a/addon-updater.js b/addon-updater.js
index 36de880..12c4bad 100644
--- a/addon-updater.js
+++ b/addon-updater.js
@@ -189,7 +189,16 @@ async function stageOne({ id, currentVer, updateURL, stagedDir, pubkeysHex, log,
     await fsp.mkdir(tmpDir, { recursive: true });
     // Refuses `..` entries by default in modern tar. -P NOT passed = paths
     // stay stripped/relative.
-    execFileSync("tar", ["-x", "-z", "-f", tmpFile, "-C", tmpDir], { stdio: "ignore" });
+    // Two Windows tar quirks we sidestep with one small trick:
+    //   1. Git-Bash tar (MSYS2) sees drive letters as host:file remote syntax
+    //      without --force-local.
+    //   2. Even with --force-local, MSYS2's argument-conversion layer mangles
+    //      backslashes it doesn't understand, so `C:\Users\...\Temp\dir`
+    //      arrives at tar as `C:\\Users...\\dir` and it can't open the path.
+    // Forward-slash paths dodge both — bsdtar (Win10 built-in), GNU tar,
+    // and MSYS2 tar all accept `C:/Users/...` as a plain path.
+    const posix = (p) => p.replace(/\\/g, "/");
+    execFileSync("tar", ["--force-local", "-x", "-z", "-f", posix(tmpFile), "-C", posix(tmpDir)], { stdio: "ignore" });
   } catch (e) {
     log(`updates: extract ${id}@${best.version} failed:`, e.message);
     try { fs.rmSync(tmpFile, { force: true }); } catch {}
diff --git a/scripts/sign-addon-update.mjs b/scripts/sign-addon-update.mjs
index c04c60f..12d2b2a 100644
--- a/scripts/sign-addon-update.mjs
+++ b/scripts/sign-addon-update.mjs
@@ -55,11 +55,16 @@ fs.mkdirSync(outDir, { recursive: true });
 const tarName = `${id}-${version}.tar.gz`;
 const tarPath = path.join(outDir, tarName);
 
-// Tar the addon folder from its parent so archived paths are addon-relative.
-const parent = path.dirname(path.resolve(addonDir));
-const folder = path.basename(path.resolve(addonDir));
+// Tar the CONTENTS of the addon folder (not the folder itself) so entries
+// live at the archive root: `addon.json`, `editor.html`, etc. The client
+// extracts into a fresh dir and expects to find addon.json directly there.
 try {
-  execFileSync("tar", ["-c", "-z", "-f", tarPath, "-C", parent, folder], { stdio: "inherit" });
+  // On Windows, Git-Bash tar (MSYS2) both mistakes drive letters for
+  // host:file remote-archive syntax AND mangles backslashes on its way to
+  // tar's argv. --force-local kills the first, forward-slash paths kill
+  // the second. Win10 built-in bsdtar and GNU tar both accept the flag.
+  const posix = (p) => p.replace(/\\/g, "/");
+  execFileSync("tar", ["--force-local", "-c", "-z", "-f", posix(tarPath), "-C", posix(path.resolve(addonDir)), "."], { stdio: "inherit" });
 } catch (e) { die(`tar failed: ${e.message}`); }
 
 const tarBytes = fs.readFileSync(tarPath);