diff --git a/package.json b/package.json
index 0b56888..439cb84 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "main": "electron/main.cjs",
   "scripts": {
-    "generate-pwa-assets": "pwa-assets-generator",
+    "generate-pwa-assets": "node scripts/generate-pwa-assets.mjs",
     "dev": "vite --host",
     "build": "vue-tsc -b && vite build",
     "preview": "vite preview --host",
diff --git a/scripts/generate-pwa-assets.mjs b/scripts/generate-pwa-assets.mjs
new file mode 100644
index 0000000..e6cfa01
--- /dev/null
+++ b/scripts/generate-pwa-assets.mjs
@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+// Wraps pwa-assets-generator and removes the staged brand source after
+// generation. pwa-assets.config.ts copies $BRAND_DIR/logo.{svg,png}
+// into public/icons/.brand-source.* because the CLI emits next to the
+// source. Without this cleanup the full-resolution source ships in
+// dist/icons/ and is publicly served.
+import { spawnSync } from 'node:child_process'
+import { existsSync, rmSync } from 'node:fs'
+import { resolve } from 'node:path'
+
+const cli = resolve('node_modules/.bin/pwa-assets-generator')
+const { status } = spawnSync(cli, process.argv.slice(2), { stdio: 'inherit' })
+if (status !== 0) process.exit(status ?? 1)
+
+const stagingDir = resolve('public/icons')
+for (const ext of ['svg', 'png']) {
+  const staged = resolve(stagingDir, `.brand-source.${ext}`)
+  if (existsSync(staged)) rmSync(staged)
+}