diff --git a/.github/workflows/_tauri.yml b/.github/workflows/_tauri.yml
index b23880dab..cd01fe070 100644
--- a/.github/workflows/_tauri.yml
+++ b/.github/workflows/_tauri.yml
@@ -87,6 +87,8 @@ jobs:
       - name: Build release exe and MSI / deb
         # Signs the exe before bundling it into the MSI
         run: pnpm build
+      - name: Ensure unmodified Git workspace
+        run: git diff --exit-code
       # We need to sign the exe inside the MSI. Currently
       # we do this in a "beforeBundleCommand" hook in tauri.windows.conf.json.
       # But this will soon be natively supported in Tauri.
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 20372ea8b..e20d12be2 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -1907,6 +1907,7 @@ dependencies = [
  "secrecy",
  "serde",
  "serde_json",
+ "subtle",
  "tauri",
  "tauri-build",
  "tauri-runtime",
diff --git a/rust/gui-client/src-tauri/Cargo.toml b/rust/gui-client/src-tauri/Cargo.toml
index debba7e27..8198a9ea3 100644
--- a/rust/gui-client/src-tauri/Cargo.toml
+++ b/rust/gui-client/src-tauri/Cargo.toml
@@ -29,6 +29,9 @@ sadness-generator = "0.5.0"
 secrecy = { workspace = true }
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
+subtle = "2.5.0"
+# `notification` is not needed on Windows, but if we remove it, Tauri's bundler will just add it back. #6597
+tauri = { version = "1.7.1", features = [ "dialog", "icon-png", "notification", "shell-open-api", "system-tray" ] }
 tauri-runtime = "0.14.2"
 tauri-utils = "1.6.0"
 thiserror = { version = "1.0", default-features = false }
@@ -43,12 +46,10 @@ uuid = { version = "1.10.0", features = ["v4"] }
 [target.'cfg(target_os = "linux")'.dependencies]
 dirs = "5.0.1"
 nix = { version = "0.29.0", features = ["user"] }
-tauri = { version = "1.7.1", features = [ "dialog", "icon-png", "notification", "shell-open-api", "system-tray" ] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 
 [target.'cfg(target_os = "windows")'.dependencies]
-tauri = { version = "1.7.1", features = [ "dialog", "icon-png", "shell-open-api", "system-tray" ] }
 tauri-winrt-notification = "0.5.0"
 
 [target.'cfg(target_os = "windows")'.dependencies.windows]