diff --git a/template/Setup-WinBuild2025.ps1 b/template/Setup-WinBuild2025.ps1
index 3be4486..5bdb03e 100644
--- a/template/Setup-WinBuild2025.ps1
+++ b/template/Setup-WinBuild2025.ps1
@@ -1198,33 +1198,36 @@ if (Test-Path $nsisExe) {
 } else {
     # SourceForge redirect chain:
     #   Step 1: sf.net/.../download?use_mirror=autoselect → 200 HTML meta-refresh
-    #   The meta-refresh URL is: https://downloads.sourceforge.net/project/nsis/...?ts=TOKEN
+    #   The meta-refresh URL is: https://downloads.sourceforge.net/project/nsis/...?ts=TOKEN&...
     #   That tokenised URL resolves directly to the binary (no further HTML).
-    # Strategy: fetch the HTML page, extract the meta-refresh URL, download it immediately
-    # (the ts= token is short-lived, so we use it right away).
+    # Strategy: fetch the HTML page via WebClient (faster than IWR — no progress-bar overhead),
+    # HTML-decode the extracted URL (& → &), then download directly.
     $nsisPageUrl   = "https://sourceforge.net/projects/nsis/files/NSIS%20$($NSISVersion.Split('.')[0])/$NSISVersion/nsis-$NSISVersion-setup.exe/download?use_mirror=autoselect"
     $nsisInstaller = 'C:\CI\nsis_installer.exe'
-    $sfUA          = @{ 'User-Agent' = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' }
+    $sfUserAgent   = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)'
 
     Write-Host "Resolving NSIS $NSISVersion download URL from SourceForge..."
+    $wc = New-Object System.Net.WebClient
+    $wc.Headers.Add('User-Agent', $sfUserAgent)
     try {
-        $sfPage = Invoke-WebRequest -Uri $nsisPageUrl -UseBasicParsing -MaximumRedirection 5 `
-                      -Headers $sfUA
+        $sfHtml = $wc.DownloadString($nsisPageUrl)
     } catch { throw "Failed to reach SourceForge download page: $_" }
 
     # Extract tokenised URL from: <meta http-equiv="refresh" content="5; url=https://downloads.sourceforge.net/...?ts=...">
+    # The HTML may encode & as &amp;, so decode before using the URL.
     $nsisCdnUrl = $null
-    if ($sfPage.RawContent -match 'content="\d+;\s*url=(https://downloads\.sourceforge\.net/[^"]+)"') {
-        $nsisCdnUrl = $Matches[1]
+    if ($sfHtml -match 'content="\d+;\s*url=(https://downloads\.sourceforge\.net/[^"]+)"') {
+        $nsisCdnUrl = [System.Net.WebUtility]::HtmlDecode($Matches[1])
     }
     if (-not $nsisCdnUrl) {
         throw "Could not extract tokenised download URL from SourceForge page for NSIS $NSISVersion. " +
               "Page structure may have changed."
     }
     Write-Host "Downloading NSIS $NSISVersion from SourceForge..."
+    $wc.Headers.Add('User-Agent', $sfUserAgent)   # re-set: DownloadString clears headers
     try {
-        Invoke-WebRequest -Uri $nsisCdnUrl -OutFile $nsisInstaller -UseBasicParsing -Headers $sfUA
-    } catch { throw "Failed to download NSIS from '$nsisCdnUrl': $_" }
+        $wc.DownloadFile($nsisCdnUrl, $nsisInstaller)
+    } catch { throw "Failed to download NSIS from SourceForge: $_" }
 
     # Guard: verify the file is a valid PE executable (MZ magic bytes).
     $peBytes = [System.IO.File]::ReadAllBytes($nsisInstaller)