diff --git a/.github/scripts/ci-plan.mjs b/.github/scripts/ci-plan.mjs
index e8982ad3d9..08a68fe4a6 100644
--- a/.github/scripts/ci-plan.mjs
+++ b/.github/scripts/ci-plan.mjs
@@ -4,6 +4,40 @@ import path from "node:path";
 import { pathToFileURL } from "node:url";
 import { goAgents, integrationCases, rustAgents, rustGroups } from "./ci-config.mjs";
 
+const win7InfrastructureFiles = new Set([
+  ".github/scripts/assert-win7-pe-compat.ps1",
+  ".github/scripts/assert-webview2-win7-loader.ps1",
+  ".github/scripts/assert-win7-installer-content.ps1",
+  ".github/scripts/assert-webview2-win7-runtime.ps1",
+  ".github/scripts/prepare-webview2-win7-loader.ps1",
+  ".github/scripts/prepare-webview2-win7-runtime.ps1",
+  ".github/workflows/ci.yml",
+  ".github/workflows/release.yml",
+  "src-tauri/tauri.webview2-win7-fixed.conf.json",
+  "src-tauri/build.rs",
+]);
+const win7InfrastructurePrefixes = [
+  "src-tauri/windows/nsis/",
+  "vendor/wry/",
+  "vendor/webview2-com-sys/",
+  "vendor/ctor/",
+  "vendor/dirs-sys/",
+  "vendor/pageant/",
+];
+
+function expandAffectedPackages(packages, members, affected) {
+  let expanded;
+  do {
+    expanded = false;
+    for (const pkg of packages) {
+      if (!affected.has(pkg.name) && pkg.dependencies.some((dependency) => members.has(dependency.name) && affected.has(dependency.name))) {
+        affected.add(pkg.name);
+        expanded = true;
+      }
+    }
+  } while (expanded);
+}
+
 export function changedPaths(base, root) {
   if (!base || /^0+$/.test(base)) return null;
   execFileSync("git", ["rev-parse", "--verify", `${base}^{commit}`], { cwd: root, stdio: "pipe" });
@@ -54,17 +88,21 @@ export function planCi({ files, metadata, root, eventName = "pull_request", rust
   const unknownMember = packages.some((pkg) => !knownGroups.has(pkg.name));
   const rust = rustChanged || sharedRust || unknownRust || affected.size > 0 || files.includes("scripts/core-architecture.test.mjs");
   const full = rust && (eventName !== "pull_request" || sharedRust || unknownRust || unknownMember || affected.size === 0);
+  const win7Affected = new Set(affected);
+  expandAffectedPackages(packages, members, win7Affected);
   if (full) for (const pkg of packages) affected.add(pkg.name);
-  let expanded;
-  do {
-    expanded = false;
-    for (const pkg of packages) {
-      if (!affected.has(pkg.name) && pkg.dependencies.some((dependency) => members.has(dependency.name) && affected.has(dependency.name))) {
-        affected.add(pkg.name);
-        expanded = true;
-      }
-    }
-  } while (expanded);
+  expandAffectedPackages(packages, members, affected);
+  const win7InfrastructureChanged = unknownDiff || files.some((file) => win7InfrastructureFiles.has(file)
+    || win7InfrastructurePrefixes.some((prefix) => file.startsWith(prefix)));
+  const win7DependencyChanged = files.includes("Cargo.toml") || files.includes("Cargo.lock")
+    || files.some((file) => /^(?:crates\/[^/]+|src-tauri)\/Cargo\.toml$/.test(file));
+  const windowsWin7Reasons = {
+    infrastructure: win7InfrastructureChanged,
+    dependency_input: win7DependencyChanged,
+    desktop_dependency: win7Affected.has("dbx"),
+    unknown_rust: unknownRust,
+  };
+  const windowsWin7Candidate = Object.values(windowsWin7Reasons).some(Boolean);
   const rustMatrix = !rust ? [] : full ? [{ group: "workspace" }] : Object.entries(rustGroups)
     .filter(([, names]) => names.some((name) => affected.has(name)))
     .map(([group]) => ({ group }));
@@ -97,6 +135,9 @@ export function planCi({ files, metadata, root, eventName = "pull_request", rust
     agent_rust_changed: nativeRustMatrix.length > 0, agent_integration_changed: liveMatrix.length > 0,
     duckdb_changed: nativeChanges.has("duckdb"),
     duckdb_windows: sharedRust || files.some((file) => file.startsWith("agents/drivers/duckdb/")),
+    windows_win7_candidate: windowsWin7Candidate,
+    windows_win7_affected_packages: [...win7Affected].sort(),
+    windows_win7_reasons: windowsWin7Reasons,
     fast: rust || agents || ciChanged,
   };
 }
@@ -112,5 +153,13 @@ if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.ar
     const outputs = { ...plan, plan };
     appendFileSync(process.env.GITHUB_OUTPUT, Object.entries(outputs).map(([name, value]) => `${name}=${JSON.stringify(value)}\n`).join(""));
   }
-  console.log(JSON.stringify(plan, null, 2));
+  console.log(JSON.stringify({
+    ...plan,
+    win7_routing_comparison: {
+      current: process.env.WIN7_CURRENT === "true",
+      candidate: plan.windows_win7_candidate,
+      affected_packages: plan.windows_win7_affected_packages,
+      reasons: plan.windows_win7_reasons,
+    },
+  }, null, 2));
 }
diff --git a/.github/scripts/ci-plan.test.mjs b/.github/scripts/ci-plan.test.mjs
index e9e69ac780..f686797b0e 100644
--- a/.github/scripts/ci-plan.test.mjs
+++ b/.github/scripts/ci-plan.test.mjs
@@ -79,6 +79,82 @@ test("core and consumer changes do not pull unrelated foundation test groups", (
   assert.deepEqual(groups(plan(["crates/dbx-driver-postgres/src/postgres.rs"])), ["drivers", "application"]);
 });
 
+test("Win7 candidate follows the desktop package dependency graph", () => {
+  assert.equal(plan(["crates/dbx-core/src/query/mod.rs"]).windows_win7_candidate, true);
+  assert.equal(plan(["crates/dbx-drivers/src/lib.rs"]).windows_win7_candidate, true);
+  assert.equal(plan(["crates/dbx-cli/src/main.rs"]).windows_win7_candidate, false);
+});
+
+test("old Win7 Rust paths remain candidates through the dependency graph", () => {
+  for (const file of [
+    "src-tauri/src/commands/update.rs",
+    "crates/dbx-core/src/host/update.rs",
+    "crates/dbx-driver-postgres/src/postgres.rs",
+    "crates/dbx-platform/src/lib.rs",
+  ]) {
+    assert.equal(plan([file]).windows_win7_candidate, true, file);
+  }
+});
+
+test("Win7 infrastructure changes remain candidates outside the Cargo graph", () => {
+  for (const file of [
+    ".github/scripts/assert-win7-pe-compat.ps1",
+    ".github/scripts/assert-webview2-win7-loader.ps1",
+    ".github/scripts/assert-win7-installer-content.ps1",
+    ".github/scripts/assert-webview2-win7-runtime.ps1",
+    ".github/scripts/prepare-webview2-win7-loader.ps1",
+    ".github/scripts/prepare-webview2-win7-runtime.ps1",
+    ".github/workflows/ci.yml",
+    ".github/workflows/release.yml",
+    "src-tauri/tauri.webview2-win7-fixed.conf.json",
+    "src-tauri/build.rs",
+    "src-tauri/windows/nsis/installer.nsi",
+    "vendor/wry/src/lib.rs",
+    "vendor/webview2-com-sys/src/lib.rs",
+    "vendor/ctor/src/lib.rs",
+    "vendor/dirs-sys/src/lib.rs",
+    "vendor/pageant/src/lib.rs",
+  ]) {
+    assert.equal(plan([file]).windows_win7_candidate, true, file);
+  }
+});
+
+test("Win7 dependency inputs fail open", () => {
+  for (const file of ["Cargo.toml", "Cargo.lock", "src-tauri/Cargo.toml", "crates/dbx-cli/Cargo.toml"]) {
+    assert.equal(plan([file]).windows_win7_candidate, true, file);
+  }
+});
+
+test("unknown Rust changes and unknown diffs remain Win7 candidates", () => {
+  assert.equal(plan(["crates/new-engine/src/lib.rs"]).windows_win7_candidate, true);
+  assert.equal(plan(null).windows_win7_candidate, true);
+});
+
+test("unrelated CI inputs do not become Win7 candidates through full Rust coverage", () => {
+  const result = plan([".github/scripts/ci-gate.mjs"]);
+  assert.equal(result.rust_full, true);
+  assert.equal(result.windows_win7_candidate, false);
+});
+
+test("Win7 affected packages stay independent from full Rust coverage", () => {
+  const result = plan([".github/scripts/ci-gate.mjs"]);
+  assert.ok(result.affected_packages.includes("dbx"));
+  assert.deepEqual(result.windows_win7_affected_packages, []);
+});
+
+test("Win7 candidate reports each routing reason", () => {
+  assert.equal(plan([".github/scripts/assert-win7-pe-compat.ps1"]).windows_win7_reasons.infrastructure, true);
+  assert.equal(plan(["Cargo.lock"]).windows_win7_reasons.dependency_input, true);
+  assert.equal(plan(["crates/dbx-core/src/lib.rs"]).windows_win7_reasons.desktop_dependency, true);
+  assert.equal(plan(["crates/new-engine/src/lib.rs"]).windows_win7_reasons.unknown_rust, true);
+  assert.deepEqual(plan(["crates/dbx-cli/src/main.rs"]).windows_win7_reasons, {
+    infrastructure: false,
+    dependency_input: false,
+    desktop_dependency: false,
+    unknown_rust: false,
+  });
+});
+
 test("code generation and test-only dependencies participate in impact analysis", () => {
   assert.deepEqual(groups(plan(["plugins/connection-types/postgres.yaml"])), ["foundation", "drivers", "application"]);
   assert.deepEqual(groups(plan(["plugins/dialects/postgres.yaml"])), ["foundation", "drivers", "application"]);
diff --git a/.github/scripts/ci-workflow.test.mjs b/.github/scripts/ci-workflow.test.mjs
index e19a95215f..9f86ba6c10 100644
--- a/.github/scripts/ci-workflow.test.mjs
+++ b/.github/scripts/ci-workflow.test.mjs
@@ -178,9 +178,11 @@ test("the planner uses the exact event base and preserves a single workflow canc
   assert.ok(changes.includes("node .github/scripts/ci-plan.mjs"));
   assert.doesNotMatch(changes, /fetch-depth:\s*0/);
   assert.doesNotMatch(changes, /dtolnay\/rust-toolchain/);
-  for (const flag of ["rust", "rust_full", "rust_matrix", "agents", "agent_go", "agent_rust", "agent_integration", "plan"]) {
+  for (const flag of ["rust", "rust_full", "rust_matrix", "agents", "agent_go", "agent_rust", "agent_integration",
+    "windows_win7_candidate", "windows_win7_affected_packages", "windows_win7_reasons", "plan"]) {
     assert.ok(changes.includes(`steps.plan.outputs.${flag}`));
   }
+  assert.ok(changes.includes("WIN7_CURRENT: ${{ steps.filter.outputs.windows_win7_bundle }}"));
   assert.ok(workflow.includes("group: ${{ github.workflow }}-${{ github.ref }}"));
   assert.ok(workflow.includes("cancel-in-progress: true"));
 });
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 69a27de27e..59300aceeb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1036,6 +1036,9 @@ jobs:
       duckdb_windows: ${{ steps.filter.outputs.duckdb_windows == 'true' || steps.plan.outputs.duckdb_windows == 'true' }}
       nix: ${{ steps.filter.outputs.nix }}
       windows_win7_bundle: ${{ steps.filter.outputs.windows_win7_bundle }}
+      windows_win7_candidate: ${{ steps.plan.outputs.windows_win7_candidate }}
+      windows_win7_affected_packages: ${{ steps.plan.outputs.windows_win7_affected_packages }}
+      windows_win7_reasons: ${{ steps.plan.outputs.windows_win7_reasons }}
       github_scripts: ${{ steps.filter.outputs.github_scripts }}
       fast: ${{ steps.plan.outputs.fast }}
       rust_matrix: ${{ steps.plan.outputs.rust_matrix }}
@@ -1192,6 +1195,7 @@ jobs:
           BASE_SHA: ${{ steps.change-base.outputs.sha }}
           RUST_CHANGED: ${{ steps.filter.outputs.rust }}
           AGENTS_CHANGED: ${{ steps.filter.outputs.agents }}
+          WIN7_CURRENT: ${{ steps.filter.outputs.windows_win7_bundle }}
         run: node .github/scripts/ci-plan.mjs
 
   agents: