diff --git a/Packaging/Installer/CursorLang.wixproj b/Packaging/Installer/CursorLang.wixproj
index 3877049..fe65bf7 100644
--- a/Packaging/Installer/CursorLang.wixproj
+++ b/Packaging/Installer/CursorLang.wixproj
@@ -16,12 +16,25 @@
         <OutputType>Package</OutputType>
 
         <!--
-            MSI validation still assumes an installation for the whole machine.
-            Installing into the user's own profile trips three of its rules: a
-            component whose key path is a file (ICE38), a folder it wants listed
-            for removal (ICE64), and a warning that the files will not follow other
-            users of the machine (ICE91). All three describe exactly what was
-            intended here, so they are turned off rather than worked around.
+            The ICE checks run inside the Windows Installer service, and a build
+            agent has no access to it: every single check comes back as WIX0217,
+            "The Windows Installer Service could not be accessed", and the build
+            fails on close to a hundred of them. Since the release is built by the
+            agent, validation cannot be part of it.
+
+            It stays switchable rather than deleted: -p:SuppressValidation=false
+            turns it back on where the service does answer, which is any ordinary
+            desktop machine.
+        -->
+        <SuppressValidation Condition="'$(SuppressValidation)' == ''">true</SuppressValidation>
+
+        <!--
+            What validation says when it does run. MSI still assumes an
+            installation for the whole machine, and installing into the user's own
+            profile trips three of its rules: a component whose key path is a file
+            (ICE38), a folder it wants listed for removal (ICE64), and a warning
+            that the files will not follow other users of the machine (ICE91). All
+            three describe exactly what was intended here.
         -->
         <SuppressIces>ICE38;ICE64;ICE91</SuppressIces>
 
diff --git a/README.RU.md b/README.RU.md
index ddf543c..33765e5 100644
--- a/README.RU.md
+++ b/README.RU.md
@@ -333,10 +333,21 @@ pwsh -File Packaging\build-installer.ps1 -Version 1.0.1
 снимет: SmartScreen смотрит на репутацию, а у нового сертификата её нет, пока
 приложение не наберёт установок.
 
-Про проект WiX стоит знать две вещи, прежде чем его править. Он закреплён на WiX
-5, а не на нынешней 7: начиная с шестой версии инструмент требует принимать
-лицензию Open Source Maintenance Fee — бесплатную при доходе меньше $10 000 в
-год, но принимать её должен человек, а не сборочный скрипт. И он отключает три
-проверки ICE: MSI по-прежнему исходит из установки на всю машину, а установка в
-профиль пользователя нарушает правила, которые описывают ровно то, что здесь и
-задумано.
+Про проект WiX стоит знать две вещи, прежде чем его править.
+
+Он закреплён на WiX 5, а не на нынешней 7: начиная с шестой версии инструмент
+требует принимать лицензию Open Source Maintenance Fee — бесплатную при доходе
+меньше $10 000 в год, но принимать её должен человек, а не сборочный скрипт.
+
+И он собирается без проверки MSI. Проверки ICE выполняются службой установщика
+Windows, до которой сборочному агенту не дотянуться: каждая возвращается
+ошибкой `WIX0217`, и сборка умирает на без малого сотне таких. На обычной
+машине служба отвечает, и проверка включается одним ключом:
+
+```powershell
+dotnet build Packaging\Installer\CursorLang.wixproj -p:SuppressValidation=false
+```
+
+Три правила остаются подавленными и тогда. MSI исходит из установки на всю
+машину, а установка в профиль пользователя нарушает правила, которые описывают
+ровно то, что здесь и задумано.
diff --git a/README.md b/README.md
index 9a34915..9ad357d 100644
--- a/README.md
+++ b/README.md
@@ -327,10 +327,21 @@ user has to insist. Buying a certificate would not silence it at once either:
 SmartScreen goes by reputation, and a fresh certificate has none until enough
 people have installed the application.
 
-Two things about the WiX project are worth knowing before touching it. It pins
-WiX 5 rather than the current 7: from version 6 the toolset asks every build to
-accept the Open Source Maintenance Fee licence — free below $10,000 of yearly
-revenue, but a decision for a person rather than for a build script. And it turns
-off three ICE validation rules: MSI still assumes an installation for the whole
-machine, and installing into the user's own profile trips rules that describe
-exactly what was intended here.
+Two things about the WiX project are worth knowing before touching it.
+
+It pins WiX 5 rather than the current 7: from version 6 the toolset asks every
+build to accept the Open Source Maintenance Fee licence — free below $10,000 of
+yearly revenue, but a decision for a person rather than for a build script.
+
+And it builds without MSI validation. The ICE checks run inside the Windows
+Installer service, which a build agent cannot reach: every check comes back as
+`WIX0217` and the build dies on close to a hundred of them. On an ordinary
+desktop machine the service does answer, and validation is one switch away:
+
+```powershell
+dotnet build Packaging\Installer\CursorLang.wixproj -p:SuppressValidation=false
+```
+
+Three of its rules stay suppressed even then. MSI assumes an installation for the
+whole machine, and installing into the user's own profile trips rules that
+describe exactly what was intended here.