diff --git a/package.json b/package.json
index eee8626..d483893 100644
--- a/package.json
+++ b/package.json
@@ -17,7 +17,8 @@
   },
   "scripts": {
     "build": "tsc && npm run copy-assets",
-    "copy-assets": "mkdir -p dist/transitions/shaders && cp src/transitions/shaders/*.glsl dist/transitions/shaders/",
+    "copy-assets": "node scripts/copy-assets.mjs",
+    "prepare": "npm run build",
     "test": "vitest run",
     "test:watch": "vitest"
   },
diff --git a/scripts/copy-assets.mjs b/scripts/copy-assets.mjs
new file mode 100644
index 0000000..93bf7e2
--- /dev/null
+++ b/scripts/copy-assets.mjs
@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+/**
+ * Copy the GLSL shader sources into dist/.
+ *
+ * `tsc` only emits what it compiles, so the .glsl files shader-render reads at
+ * runtime have to be copied separately.
+ *
+ * This is a script rather than an inline npm command because `prepare` runs it
+ * on every install, including on Windows, where npm invokes lifecycle scripts
+ * through cmd.exe. The previous `mkdir -p ... && cp src/**\/*.glsl` is
+ * POSIX-only: cmd.exe has no `cp`, and `mkdir -p` there creates a directory
+ * literally named `-p`. An inline `node -e` would work but reintroduces the
+ * same hazard one level down, since quoting differs between cmd.exe and sh.
+ */
+import { mkdirSync, readdirSync, copyFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const from = join(root, 'src', 'transitions', 'shaders');
+const to = join(root, 'dist', 'transitions', 'shaders');
+
+mkdirSync(to, { recursive: true });
+
+// Only .glsl — the directory also holds index.ts and a README, which tsc
+// handles or which do not belong in dist at all.
+const shaders = readdirSync(from).filter(name => name.endsWith('.glsl'));
+for (const name of shaders) copyFileSync(join(from, name), join(to, name));
+
+// stderr, not stdout: `prepare` makes this run inside `npm pack --silent`,
+// whose stdout is captured as the tarball filename (see the pack-smoke job's
+// TARBALL=$(npm pack --silent)). A line on stdout here corrupts that capture.
+console.error(`copy-assets: ${shaders.length} shaders -> dist/transitions/shaders`);