diff --git a/engine.ps1 b/engine.ps1
index 68defc4..0f1a954 100644
--- a/engine.ps1
+++ b/engine.ps1
@@ -51,7 +51,21 @@ if (-not (Test-Path $winscpDll)) {
     Write-Log "error" "WinSCP DLL not found at $winscpDll"
     exit 1
 }
-Add-Type -Path $winscpDll
+
+# Unblock every run, regardless of how the WinSCP folder got here - Windows
+# tags files as untrusted ("Mark of the Web") if they were ever downloaded or
+# copied from a network share/zip, which blocks Add-Type from loading them.
+Get-ChildItem -Path (Join-Path $scriptRoot "WinSCP") -Recurse -File |
+    Unblock-File -ErrorAction SilentlyContinue
+
+try {
+    Add-Type -Path $winscpDll
+} catch {
+    Write-Host "ERROR: Could not load WinSCPnet.dll - $($_.Exception.Message)" -ForegroundColor Red
+    Write-Host "Try deleting the WinSCP\ folder and running setup.bat again." -ForegroundColor Yellow
+    Write-Log "error" "Add-Type failed for $winscpDll : $($_.Exception.Message)"
+    exit 1
+}
 
 # -- Entity config -------------------------------------------------------------
 $entityConfigFile = Join-Path $EntityDir "entity.json"