diff --git a/packaging/build_release.ps1 b/packaging/build_release.ps1
index 535f5e8..722f9d7 100644
--- a/packaging/build_release.ps1
+++ b/packaging/build_release.ps1
@@ -242,7 +242,9 @@ if ($CreateVenv) {
     # Keep ensurepip - venv creation needs it. Same result on CI and local builds.
     $xdRuntime = @("Doc", "tcl", "Tools", "Lib\test", "Lib\idlelib", "Lib\tkinter", "Lib\turtledemo") |
         ForEach-Object { Join-Path $prefix $_ }
-    $xfRuntime = @("_tkinter.pyd", "tcl86t.dll", "tk86t.dll", "*.pyc")
+    # python-*.exe: the GitHub runner's toolcache keeps the full Python installer (~25MB)
+    # in the prefix; _test*.pyd: stdlib test extensions.
+    $xfRuntime = @("_tkinter.pyd", "tcl86t.dll", "tk86t.dll", "*.pyc", "python-*.exe", "_test*.pyd", "_ctypes_test.pyd", "xxlimited*.pyd")
     & $robocopy $prefix $rtDir /E /XD $spEx __pycache__ @xdRuntime /XF @xfRuntime /NFL /NDL /NJH /NJS /nc /ns /np | Out-Null
     if ($LASTEXITCODE -ge 8) { throw "robocopy_python_runtime_failed: exit $LASTEXITCODE" }
 
diff --git a/packaging/publish_forgejo_release.ps1 b/packaging/publish_forgejo_release.ps1
index 8e3df11..c51c3e4 100644
--- a/packaging/publish_forgejo_release.ps1
+++ b/packaging/publish_forgejo_release.ps1
@@ -115,7 +115,9 @@ function Upload-ForgejoAsset {
     $curl = Get-Command curl.exe -ErrorAction SilentlyContinue
     if (-not $curl) { throw "curl.exe required for asset upload" }
     # --ssl-no-revoke: schannel CRYPT_E_REVOCATION_OFFLINE often fails via proxy/offline CA.
-    & $curl.Source -f -sS --ssl-no-revoke -X POST `
+    # --noproxy: a desktop proxy in HTTP(S)_PROXY cannot reach a LAN Forgejo (502).
+    $forgejoHost = ([Uri]$ForgejoBase).Host
+    & $curl.Source -f -sS --ssl-no-revoke --noproxy $forgejoHost -X POST `
         -H "Authorization: token $Token" `
         -F "attachment=@$Path" `
         $url