diff --git a/scripts/build_exe.ps1 b/scripts/build_exe.ps1
index 31f1275..5a8f42b 100644
--- a/scripts/build_exe.ps1
+++ b/scripts/build_exe.ps1
@@ -7,9 +7,10 @@
 #   .\scripts\build_exe.ps1 -Clean     # remove build\ + dist\ first
 #
 # The exe is a console application hosting every CLI verb (check-config,
-# list-servers, list-devices, list-tags, the future run/probe/service verbs).
-# It is not itself a service binary: the Phase 3 service host will register
-# this same exe with the SCM via the 'install' verb (IMPLEMENTATION_PLAN 6).
+# list-servers, list-items, read/probe, run) AND the Windows service host:
+# 'install' registers this same exe with the SCM (IMPLEMENTATION_PLAN 6);
+# when the SCM starts it, the fixed 'service' argv shape dispatches to
+# the ServiceFramework host.
 #
 # Hard rules enforced here:
 #   1. 32-bit interpreter (SPECIFICATION 11): the OPC DA Automation Wrapper
@@ -49,8 +50,14 @@ $HiddenImports = @(
     # opc backend modules imported lazily in main.py CLI verbs
     'opcda_diagnozer.opc.automation',
     'opcda_diagnozer.opc.browse',
-    # future service host (Phase 3) - keep it in the bundle from day one
-    'opcda_diagnozer.service'
+    # the service host (Phase 3) - lazily imported by main (SCM dispatch) and
+    # itself importing win32serviceutil/win32service/servicemanager/
+    # win32evtlogutil only inside functions
+    'opcda_diagnozer.service',
+    'win32service',
+    'win32serviceutil',
+    'servicemanager',
+    'win32evtlogutil'
 )
 
 function Fail {