diff --git a/README.md b/README.md
index 7cf2638..9a2f111 100644
--- a/README.md
+++ b/README.md
@@ -54,7 +54,7 @@ are regenerated on each release — patches cannot be merged directly.
 Report problems (or send patches) to the author; accepted changes are
 applied to the development tree and appear in a following snapshot.
 
-This snapshot was assembled from development commit `1083db946f05`.
+This snapshot was assembled from development commit `823558bfeab7`.
 
 ## License
 
diff --git a/doc/install/windows_source_install.md b/doc/install/windows_source_install.md
index 9dce94d..80bc638 100644
--- a/doc/install/windows_source_install.md
+++ b/doc/install/windows_source_install.md
@@ -31,9 +31,13 @@ and the build a few minutes. Nothing here needs to be done twice.
 **Smart App Control must be off.** A clean installation of Windows 11
 runs Smart App Control, a security feature that blocks any program
 Microsoft has not seen signed and widespread — and the MSYS2 compiler,
-`make` and the `bash` shell on which this page depends are not signed, so
-with it on the MSYS2 shell does not open and the build cannot start
-("An Application Control policy has blocked this file"). Check it first:
+`make` and the `bash` shell on which this page depends are not signed, nor
+is the Perl that TeX Live's installer brings with it, so with it on the
+MSYS2 installer never finishes, the MSYS2 shell does not open, the build
+cannot start and TeX Live cannot be installed ("An Application Control
+policy has blocked this file"; the notice from Windows Security says the
+program "might not work because we can't confirm who published it").
+Check it first:
 Windows Security ￫ **App & browser control** ￫ **Smart App Control
 settings**. It is in one of three states. *Off* is what you need. *On*
 blocks MSYS2; switch it off. *Evaluation* lets everything run for now,
@@ -421,8 +425,10 @@ it (a new UCRT64 shell does, once the line is in `~/.bashrc`) and run
 `MSYS2_PATH_TYPE` is not set to `inherit`, or the shell was opened before
 you set it. Set it and open a new UCRT64 shell.
 
-**"An Application Control policy has blocked this file", or the MSYS2
-shell does not open.** Smart App Control is on; see *Before you start*.
+**"An Application Control policy has blocked this file", the MSYS2
+installer runs without ever finishing, or the MSYS2 shell does not open.**
+Smart App Control is on; see *Before you start*. Close the installer,
+switch Smart App Control off, and run the installer again.
 It can turn itself on after the installation, in which case the
 installation is intact and only the setting needs changing.