diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 52d2899..3bb011e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -46,7 +46,7 @@ jobs:
       - name: Build
         if: steps.filter.outputs.code == 'true' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         working-directory: CTNH-Modules
-        run: ./gradlew :modules:CTNH-Core:build --stacktrace
+        run: ./gradlew :modules:CTNH-Core:build --init-script gradle/strip-forge-signatures.init.gradle --stacktrace
 
       - name: Version Suffix
         if: github.event_name != 'release' && (steps.filter.outputs.code == 'true' || github.event_name == 'workflow_dispatch')
diff --git a/build.gradle b/build.gradle
index cee52c1..2588a7c 100644
--- a/build.gradle
+++ b/build.gradle
@@ -134,26 +134,4 @@ configure(ctnhSubprojects) {
     lombok {
         version = "1.18.38"
     }
-
-    // Strip JAR signatures from Forge JARs before lang injection tasks,
-    // otherwise JarFile verification throws SecurityException when
-    // ModDevGradle artifact transforms modify signed JAR entries.
-    tasks.configureEach {
-        if (it.name.startsWith('injectLangBytecode')) {
-            it.doFirst {
-                it.compileClasspath.files.each { file ->
-                    if (file.name.contains('forge') && file.name.endsWith('.jar') && file.exists()) {
-                        project.ant.exec(executable: 'zip', resultproperty: 'zipResult',
-                                         failonerror: false) {
-                            arg(value: '-d')
-                            arg(value: file.absolutePath)
-                            arg(value: 'META-INF/*.SF')
-                            arg(value: 'META-INF/*.RSA')
-                            arg(value: 'META-INF/*.DSA')
-                        }
-                    }
-                }
-            }
-        }
-    }
 }
diff --git a/gradle/strip-forge-signatures.init.gradle b/gradle/strip-forge-signatures.init.gradle
new file mode 100644
index 0000000..b9a2fcc
--- /dev/null
+++ b/gradle/strip-forge-signatures.init.gradle
@@ -0,0 +1,26 @@
+// Strip JAR signatures from Forge JARs before lang injection tasks.
+// JarFile verification throws SecurityException when ModDevGradle
+// artifact transforms modify signed JAR entries (SHA-384 digest mismatch).
+// Only used on CI — Windows developers don't have the 'zip' command.
+allprojects {
+    afterEvaluate {
+        tasks.configureEach {
+            if (it.name.startsWith('injectLangBytecode')) {
+                it.doFirst {
+                    it.compileClasspath.files.each { file ->
+                        if (file.name.contains('forge') && file.name.endsWith('.jar') && file.exists()) {
+                            ant.exec(executable: 'zip', resultproperty: 'zipResult',
+                                     failonerror: false) {
+                                arg(value: '-d')
+                                arg(value: file.absolutePath)
+                                arg(value: 'META-INF/*.SF')
+                                arg(value: 'META-INF/*.RSA')
+                                arg(value: 'META-INF/*.DSA')
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}