diff --git a/Get-WinSCP.ps1 b/Get-WinSCP.ps1
new file mode 100644
index 0000000..b8046f9
--- /dev/null
+++ b/Get-WinSCP.ps1
@@ -0,0 +1,41 @@
+# Downloads and unpacks the WinSCP automation package engine.ps1 needs.
+# Called by setup.bat. Safe to re-run.
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+$url  = "https://winscp.net/download/WinSCP-6.3.6-Automation.zip"
+$zip  = Join-Path $env:TEMP "winscp.zip"
+$dest = Join-Path $PSScriptRoot "WinSCP"
+
+if (Test-Path $zip) { Remove-Item $zip -Force }
+
+Write-Host "Downloading WinSCP from $url ..."
+try {
+    Invoke-WebRequest -Uri $url -OutFile $zip -UseBasicParsing
+} catch {
+    Write-Host "ERROR: Download failed - $($_.Exception.Message)" -ForegroundColor Red
+    Write-Host "Check your internet connection, or ask IT if winscp.net / sourceforge.net are blocked." -ForegroundColor Yellow
+    exit 1
+}
+
+$fileInfo = Get-Item $zip
+if ($fileInfo.Length -lt 1MB) {
+    Write-Host "ERROR: Downloaded file is only $($fileInfo.Length) bytes - too small to be WinSCP." -ForegroundColor Red
+    Write-Host "This usually means antivirus or a firewall blocked/altered the download instead of letting the real file through." -ForegroundColor Yellow
+    Write-Host "Try running setup.bat again. If it keeps happening, download WinSCP-6.3.6-Automation.zip manually from winscp.net and unzip it into:" -ForegroundColor Yellow
+    Write-Host "  $dest" -ForegroundColor Yellow
+    Remove-Item $zip -Force
+    exit 1
+}
+
+try {
+    Expand-Archive -Path $zip -DestinationPath $dest -Force
+} catch {
+    Write-Host "ERROR: Could not unzip the download - $($_.Exception.Message)" -ForegroundColor Red
+    Write-Host "The downloaded file was likely corrupted or cut short in transit. Try running setup.bat again." -ForegroundColor Yellow
+    Write-Host "Left the bad file at $zip in case you want to look at it." -ForegroundColor Yellow
+    exit 1
+}
+
+Remove-Item $zip -Force
+Write-Host "WinSCP ready." -ForegroundColor Green
diff --git a/setup.bat b/setup.bat
index 7822bf1..16fa4fb 100644
--- a/setup.bat
+++ b/setup.bat
@@ -1,5 +1,3 @@
 @echo off
-echo Downloading WinSCP...
-powershell.exe -ExecutionPolicy Bypass -Command ^
-  "$url = 'https://winscp.net/download/WinSCP-6.3.6-Automation.zip'; $zip = '%TEMP%\winscp.zip'; $dest = '%~dp0WinSCP'; Invoke-WebRequest -Uri $url -OutFile $zip; Expand-Archive -Path $zip -DestinationPath $dest -Force; Write-Host 'WinSCP ready.' -ForegroundColor Green"
+powershell.exe -ExecutionPolicy Bypass -File "%~dp0Get-WinSCP.ps1"
 pause