diff --git a/app/assets/updates/install_windows.ps1 b/app/assets/updates/install_windows.ps1
index 2efd0b1c..a7f14ad7 100644
--- a/app/assets/updates/install_windows.ps1
+++ b/app/assets/updates/install_windows.ps1
@@ -10,7 +10,17 @@ try {
     # Wait for the user's normal shutdown, preserving pending library writes.
     $Parent = Get-Process -Id $ParentId -ErrorAction SilentlyContinue
     if ($Parent -and -not $Parent.WaitForExit(86400000)) { throw 'Update expired while Papyrus was still running.' }
-    if ((Get-FileHash -LiteralPath $Installer -Algorithm SHA256).Hash.ToLowerInvariant() -ne $Checksum) {
+    $Algorithm = [System.Security.Cryptography.SHA256]::Create()
+    $Stream = [System.IO.File]::OpenRead($Installer)
+
+    try {
+        $ActualChecksum = [System.BitConverter]::ToString($Algorithm.ComputeHash($Stream)).Replace('-', '').ToLowerInvariant()
+    } finally {
+        $Stream.Dispose()
+        $Algorithm.Dispose()
+    }
+
+    if ($ActualChecksum -ne $Checksum) {
         throw 'Update checksum changed after download.'
     }
     $Arguments = @('/SP-', '/SILENT', '/NORESTART', '/NOCLOSEAPPLICATIONS', '/SUPPRESSMSGBOXES', "/DIR=`"$InstallDirectory`"", "/LOG=`"$Log`"")
@@ -21,4 +31,5 @@ try {
 } catch {
     $_ | Out-String | Add-Content -LiteralPath $Log
     # Keep the verified installer and diagnostics for a manual retry.
+    exit 1
 }
diff --git a/app/pubspec.lock b/app/pubspec.lock
index 77b5ab26..240886b5 100644
--- a/app/pubspec.lock
+++ b/app/pubspec.lock
@@ -579,8 +579,8 @@ packages:
     dependency: "direct main"
     description:
       path: "."
-      ref: c9f566fde4de3bfd1dce6df1fd6d17bae6aaf114
-      resolved-ref: c9f566fde4de3bfd1dce6df1fd6d17bae6aaf114
+      ref: eafa444a5acf0ea51018a88eb76de3d19f76187a
+      resolved-ref: eafa444a5acf0ea51018a88eb76de3d19f76187a
       url: "https://github.com/PapyrusReader/reader.git"
     source: git
     version: "0.0.1"
diff --git a/app/pubspec.yaml b/app/pubspec.yaml
index 15bf9707..bce049dd 100644
--- a/app/pubspec.yaml
+++ b/app/pubspec.yaml
@@ -1,7 +1,7 @@
 name: papyrus
 description: "Digital library management application."
 publish_to: 'none'
-version: 0.2.0+6
+version: 0.3.0+7
 
 environment:
   sdk: ^3.9.2
@@ -27,7 +27,7 @@ dependencies:
   papyrus_reader:
     git:
       url: https://github.com/PapyrusReader/reader.git
-      ref: c9f566fde4de3bfd1dce6df1fd6d17bae6aaf114
+      ref: eafa444a5acf0ea51018a88eb76de3d19f76187a
   epub_pro: ^5.6.0
   syncfusion_flutter_pdf: ^32.2.3
   dart_mobi: ^1.0.2
diff --git a/tools/check_packaged_reader.ps1 b/tools/check_packaged_reader.ps1
index d4d84313..66e694a4 100644
--- a/tools/check_packaged_reader.ps1
+++ b/tools/check_packaged_reader.ps1
@@ -4,6 +4,8 @@ Set-StrictMode -Version Latest
 . (Join-Path $PSScriptRoot 'windows_test_helpers.ps1')
 Set-Location (Join-Path $PSScriptRoot '../app')
 $Directory = Join-Path ([IO.Path]::GetTempPath()) ('papyrus reader ' + [Guid]::NewGuid().ToString())
+$Reports = Join-Path $PWD 'build/package-smoke-results'
+New-Item -ItemType Directory -Path $Reports -Force | Out-Null
 function Install-TestPackage([string]$Version) {
     $Installer = (Resolve-Path "dist/papyrus-$Version-windows-x64-setup.exe").Path
     $Process = Start-Process $Installer -ArgumentList @('/VERYSILENT', '/SUPPRESSMSGBOXES', '/NORESTART', "/DIR=`"$Directory`"") -Wait -PassThru
@@ -15,18 +17,35 @@ function Install-TestUpdate([string]$Version) {
     $Installer = Join-Path $Download 'setup.exe'
     Copy-Item "dist/papyrus-$Version-windows-x64-setup.exe" $Installer
     $Checksum = (Get-FileHash -LiteralPath $Installer -Algorithm SHA256).Hash.ToLowerInvariant()
+    $Helper = (Resolve-Path 'assets/updates/install_windows.ps1').Path
+    $RejectedLog = Join-Path $Download 'update.log'
+    & powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File $Helper `
+        -ParentId ([int]::MaxValue) -Installer $Installer -Checksum ('0' * 64) -InstallDirectory $Directory
+
+    if ($LASTEXITCODE -ne 1 -or -not (Test-Path $Installer) -or
+        -not (Select-String -LiteralPath $RejectedLog -SimpleMatch 'Update checksum changed after download.')) {
+        throw 'Updater did not reject an invalid checksum before installation'
+    }
+
+    Copy-Item $RejectedLog (Join-Path $Reports 'windows-updater-rejected.log')
+    Remove-Item $RejectedLog
     $Report = Join-Path $PWD 'build/package-smoke-results/windows-updater.json'
     Remove-Item -LiteralPath $Report -ErrorAction SilentlyContinue
     $env:PAPYRUS_PERSISTENCE_PHASE = 'verify'
     $env:PAPYRUS_SMOKE_REPORT = $Report
     $Parent = Start-Process powershell.exe -ArgumentList @('-NoProfile', '-Command', 'Start-Sleep -Seconds 3') -PassThru
-    $Helper = (Resolve-Path 'assets/updates/install_windows.ps1').Path
     $Arguments = @('-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', "`"$Helper`"", '-ParentId', $Parent.Id,
         '-Installer', "`"$Installer`"", '-Checksum', $Checksum, '-InstallDirectory', "`"$Directory`"")
-    $Updater = Start-Process powershell.exe -ArgumentList $Arguments -PassThru
+    $Updater = Start-Process powershell.exe -ArgumentList $Arguments -PassThru -NoNewWindow `
+        -RedirectStandardOutput (Join-Path $Reports 'windows-updater-stdout.log') `
+        -RedirectStandardError (Join-Path $Reports 'windows-updater-stderr.log')
     Start-Sleep -Milliseconds 500
     if ($Updater.HasExited) { throw 'Updater did not wait for normal app exit' }
     if (-not $Updater.WaitForExit(120000)) { throw 'Updater timed out' }
+    if ($Updater.ExitCode -ne 0) {
+        Get-Content -LiteralPath (Join-Path $Download 'update.log') -ErrorAction SilentlyContinue | Write-Host
+        throw "Updater failed with exit code $($Updater.ExitCode)"
+    }
     $Deadline = [DateTime]::UtcNow.AddSeconds(300)
     while (-not (Test-Path $Report) -and [DateTime]::UtcNow -lt $Deadline) { Start-Sleep -Seconds 1 }
     if (-not (Test-Path $Report)) { throw "Updater did not relaunch the reader. See $Download/update.log" }
@@ -72,5 +91,7 @@ try {
     Remove-Item Env:PAPYRUS_SMOKE_REPORT -ErrorAction SilentlyContinue
     Remove-Item Env:PAPYRUS_PERSISTENCE_PHASE -ErrorAction SilentlyContinue
     Remove-Item Env:PAPYRUS_PERSISTENCE_SESSION -ErrorAction SilentlyContinue
+    $UpdateLog = Join-Path $Directory 'update download/update.log'
+    if (Test-Path $UpdateLog) { Copy-Item $UpdateLog (Join-Path $Reports 'windows-updater-install.log') }
     Remove-TestDirectory $Directory
 }