diff --git a/.gitattributes b/.gitattributes
index 97038dfe..1c42d790 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -2,3 +2,5 @@
 *.vv linguist-language=V text=auto eol=lf
 *.vsh linguist-language=V text=auto eol=lf
 **/v.mod linguist-language=V text=auto eol=lf
+# Batch files are only ever run by cmd.exe, which expects CRLF endings.
+*.bat text=auto eol=crlf
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a68e6bf..07f2a3f8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -106,13 +106,15 @@ jobs:
         uses: actions/checkout@v4
         with:
           path: gitly
-      - name: Install SQLite
-        run: |
-          .github\workflows\windows-install-sqlite.bat
-          dir thirdparty\sqlite\
       - name: Build V
         run: |
           ./make.bat -gcc
+
+      # Must come after "Build V": this used to run first, when neither `v`
+      # nor `v.exe` existed, so the referenced script could not work at all.
+      - name: Install SQLite
+        run: .github\workflows\windows-install-sqlite.bat
+
       - name: Compile gitly
         run: |
           dir
diff --git a/.github/workflows/windows-install-sqlite.bat b/.github/workflows/windows-install-sqlite.bat
new file mode 100644
index 00000000..9254f31c
--- /dev/null
+++ b/.github/workflows/windows-install-sqlite.bat
@@ -0,0 +1,9 @@
+@echo off
+REM ci.yml originally called this before V was built, when neither `v` nor
+REM `v.exe` existed yet, so the script could not delegate to V's own
+REM downloader. It is now run after "Build V" and shells out to the
+REM installer V ships, which verifies both the size and the SHA3 of the
+REM amalgamation instead of trusting a pinned checksum maintained by hand.
+.\v.exe run vlib\db\sqlite\install_thirdparty_sqlite.vsh
+if errorlevel 1 exit /b 1
+dir thirdparty\sqlite\