diff --git a/.gitea/workflows/build-iso-windows.yaml b/.gitea/workflows/build-iso-windows.yaml
index a02a4d9..101a581 100644
--- a/.gitea/workflows/build-iso-windows.yaml
+++ b/.gitea/workflows/build-iso-windows.yaml
@@ -62,20 +62,33 @@ jobs:
         id: iso
         shell: pwsh
         env:
-          ISO_URL: ${{ vars.SILVERMETAL_BASE_ISO_URL }}
+          ISO_SRC:  ${{ vars.SILVERMETAL_BASE_ISO_URL }}   # HTTP(S) URL or UNC/local path
+          SMB_USER: ${{ secrets.SILVERMETAL_ISO_SHARE_USER }}
+          SMB_PASS: ${{ secrets.SILVERMETAL_ISO_SHARE_PASS }}
         run: |
+          $dst    = "$env:RUNNER_TEMP\base.iso"
           $staged = 'C:\silvermetal\base.iso'
-          if ($env:ISO_URL) {
-            $dst = "$env:RUNNER_TEMP\base.iso"
-            Write-Host "Downloading base ISO from repo variable URL..."
-            Invoke-WebRequest $env:ISO_URL -OutFile $dst
-            "path=$dst" >> $env:GITHUB_OUTPUT
+          if ($env:ISO_SRC -match '^(?i)https?://') {
+            Write-Host 'Downloading base ISO (HTTP)...'
+            Invoke-WebRequest $env:ISO_SRC -OutFile $dst
+          } elseif ($env:ISO_SRC) {
+            # UNC or local path. The runner is SYSTEM; if the share needs auth,
+            # provide repo secrets SILVERMETAL_ISO_SHARE_USER/_PASS and we map it.
+            if ($env:ISO_SRC -like '\\*' -and $env:SMB_USER) {
+              $root = [regex]::Match($env:ISO_SRC, '^\\\\[^\\]+\\[^\\]+').Value
+              Write-Host "Authenticating to $root"
+              cmd /c "net use `"$root`" /user:$env:SMB_USER $env:SMB_PASS" | Out-Null
+            }
+            if (-not (Test-Path -LiteralPath $env:ISO_SRC)) { throw "ISO path not reachable by the runner (SYSTEM): $env:ISO_SRC" }
+            Write-Host 'Copying base ISO from path...'
+            Copy-Item -LiteralPath $env:ISO_SRC -Destination $dst -Force
           } elseif (Test-Path $staged) {
             Write-Host "Using pre-staged ISO: $staged"
-            "path=$staged" >> $env:GITHUB_OUTPUT
+            Copy-Item -LiteralPath $staged -Destination $dst -Force
           } else {
-            throw "No base ISO. Set repo variable SILVERMETAL_BASE_ISO_URL or stage it at $staged on the runner."
+            throw "No base ISO. Set repo variable SILVERMETAL_BASE_ISO_URL (URL or UNC/local path) or stage it at $staged."
           }
+          "path=$dst" >> $env:GITHUB_OUTPUT
 
       - name: Build packed ISO
         shell: pwsh