diff --git a/packaging/windows/peerspeak.iss b/packaging/windows/peerspeak.iss
index b0afc68..357d8cf 100644
--- a/packaging/windows/peerspeak.iss
+++ b/packaging/windows/peerspeak.iss
@@ -56,6 +56,10 @@ Name: "{autodesktop}\{#MyAppName}"; Filename: "{app}\{#MyAppExeName}"; IconFilen
 
 [Run]
 ; iroh uses UDP hole-punching; pre-authorizing avoids a mid-call firewall prompt.
+; Delete first so an upgrade replaces our owned rule instead of accumulating an
+; identical rule on every install. `netsh delete` removes every matching rule;
+; its no-match exit code on a first install is harmless to Inno Setup.
+Filename: "{sys}\netsh.exe"; Parameters: "advfirewall firewall delete rule name=""PeerSpeak"""; Flags: runhidden; Tasks: firewall
 Filename: "{sys}\netsh.exe"; Parameters: "advfirewall firewall add rule name=""PeerSpeak"" dir=in action=allow program=""{app}\{#MyAppExeName}"" enable=yes profile=any"; Flags: runhidden; Tasks: firewall
 Filename: "{app}\{#MyAppExeName}"; Description: "{cm:LaunchProgram,{#MyAppName}}"; Flags: nowait postinstall skipifsilent