diff --git a/.github/workflows/build-ui.yml b/.github/workflows/build-ui.yml
index 239e4730526..892c54a9eb3 100644
--- a/.github/workflows/build-ui.yml
+++ b/.github/workflows/build-ui.yml
@@ -459,17 +459,22 @@ jobs:
           Copy-Item "libmpv-temp/libmpv-2.dll" "./src/ui/bin/Release/net10.0/publish/"
           Get-ChildItem -Path "./src/ui/bin/Release/net10.0/publish" -Filter "*.pdb" -Recurse -File | Remove-Item -Force
 
-      - name: Install Inno Setup 6.7.3
-        # Pin an exact version: the .iss script requires 6.7.3+, but Chocolatey still ships 6.7.1.
+      - name: Install Inno Setup 7.1.0 x64
+        # Pin the exact x64 release and verify its hash before executing it.
         run: |
-          $url = "https://github.com/jrsoftware/issrc/releases/download/is-6_7_3/innosetup-6.7.3.exe"
+          $url = "https://github.com/jrsoftware/issrc/releases/download/is-7_1_0/innosetup-7.1.0-x64.exe"
+          $expectedSha256 = "0362a383ed217d4c4239b5933866dd96d3eb2102737da92f80f6057a4b40df2f"
           Invoke-WebRequest -Uri $url -OutFile "$env:RUNNER_TEMP\innosetup.exe"
+          $actualSha256 = (Get-FileHash "$env:RUNNER_TEMP\innosetup.exe" -Algorithm SHA256).Hash.ToLowerInvariant()
+          if ($actualSha256 -ne $expectedSha256) {
+            throw "Inno Setup SHA-256 mismatch: expected $expectedSha256, got $actualSha256"
+          }
           Start-Process -FilePath "$env:RUNNER_TEMP\innosetup.exe" `
             -ArgumentList "/VERYSILENT","/SUPPRESSMSGBOXES","/NORESTART","/SP-" -Wait
 
       - name: Build Inno Setup installer
         run: |
-          & "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" "installer\WindowsInno\Subtitle_Edit_Installer.iss"
+          & "C:\Program Files\Inno Setup 7\ISCC.exe" "installer\WindowsInno\Subtitle_Edit_Installer.iss"
           $setup = Get-ChildItem "installer\WindowsInno\SubtitleEdit-*-Setup.exe" | Select-Object -First 1
           Copy-Item $setup.FullName "./SubtitleEdit-Windows-x64-Setup.exe"
           Write-Host "Built Inno Setup installer: $($setup.Name)"