diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 9a2240c273b..c52483458c5 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -1350,7 +1350,8 @@ jobs:
 
   package_windows:
     name: package (windows)
-    needs: [code_paths, preflight]
+    # Internal build only: the package doesn't need static analysis.
+    needs: [code_paths]
     if: needs.code_paths.outputs.package_windows == 'true'
     runs-on: windows-2022
     timeout-minutes: 30
@@ -1555,6 +1556,15 @@ jobs:
       - name: Smoke packaged CLI
         run: node config/scripts/smoke-packaged-cli.mjs --app-dir=dist/win-unpacked
 
+      # Internal build only (never merge): keeps the packaged app for a real-host install.
+      - name: Upload unpacked Windows app
+        uses: actions/upload-artifact@v7
+        with:
+          name: orca-win-unpacked
+          path: dist/win-unpacked
+          retention-days: 5
+          if-no-files-found: error
+
   e2e:
     name: e2e
     needs: [code_paths, preflight]
diff --git a/src/shared/wsl-host-internal-gate.ts b/src/shared/wsl-host-internal-gate.ts
index 20f0edb422f..3dd68587063 100644
--- a/src/shared/wsl-host-internal-gate.ts
+++ b/src/shared/wsl-host-internal-gate.ts
@@ -8,5 +8,6 @@ export const WSL_HOSTS_INTERNAL_GATE_ENV = 'ORCA_INTERNAL_WSL_HOSTS'
 export function isWslHostsInternalGateOpen(
   env: Readonly<Record<string, string | undefined>>
 ): boolean {
-  return env[WSL_HOSTS_INTERNAL_GATE_ENV] === '1'
+  // Internal build only (never merge): gate defaults open; '0' still closes it.
+  return env[WSL_HOSTS_INTERNAL_GATE_ENV] !== '0'
 }