diff --git a/AppxManifest-ShellExt.xml.cmake b/AppxManifest-ShellExt.xml.cmake
new file mode 100644
index 000000000..24cfce6d5
--- /dev/null
+++ b/AppxManifest-ShellExt.xml.cmake
@@ -0,0 +1,52 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10"
+    xmlns:com="http://schemas.microsoft.com/appx/manifest/com/windows10"
+    xmlns:desktop4="http://schemas.microsoft.com/appx/manifest/desktop/windows10/4"
+    xmlns:desktop5="http://schemas.microsoft.com/appx/manifest/desktop/windows10/5"
+    xmlns:rescap="http://schemas.microsoft.com/appx/manifest/foundation/windows10/restrictedcapabilities"
+    xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10"
+    xmlns:uap10="http://schemas.microsoft.com/appx/manifest/uap/windows10/10"
+    IgnorableNamespaces="com desktop4 desktop5 rescap uap uap10">
+  <Identity Name="RiigiInfossteemiAmet.DigiDoc4ShellExt" ProcessorArchitecture="${PLATFORM}" Version="${PROJECT_VERSION}.0"
+    Publisher="${SIGNCERT_SUBJECT}" />
+  <Properties>
+    <DisplayName>DigiDoc4 Shell Extension</DisplayName>
+    <PublisherDisplayName>Riigi Infosüsteemi Amet</PublisherDisplayName>
+    <Logo>Assets\DigiDoc.50x50.png</Logo>
+    <uap10:AllowExternalContent>true</uap10:AllowExternalContent>
+  </Properties>
+  <Resources>
+    <Resource Language="en-us" />
+  </Resources>
+  <Dependencies>
+    <TargetDeviceFamily Name="Windows.Desktop" MinVersion="10.0.19041.0" MaxVersionTested="10.0.19041.0" />
+  </Dependencies>
+  <Capabilities>
+    <rescap:Capability Name="runFullTrust" />
+  </Capabilities>
+  <Applications>
+    <Application Id="DigiDoc4" Executable="qdigidoc4.exe" EntryPoint="Windows.FullTrustApplication">
+      <uap:VisualElements DisplayName="DigiDoc4 Shell Extension" Description="DigiDoc4 Shell Extension"
+        BackgroundColor="transparent" Square150x150Logo="Assets\DigiDoc.150x150.png"
+        Square44x44Logo="Assets\DigiDoc.44x44.png" AppListEntry="none" />
+      <Extensions>
+        <desktop4:Extension Category="windows.fileExplorerContextMenus">
+          <desktop4:FileExplorerContextMenus>
+            <desktop5:ItemType Type="*">
+              <desktop5:Verb Id="DigiDocSign" Clsid="4ef3a5aa-125c-45f5-b5fd-d4c478050afa"/>
+              <desktop5:Verb Id="DigiDocEnc" Clsid="bb67aa19-089b-4ec9-a059-13d985987cdc"/>
+            </desktop5:ItemType>
+          </desktop4:FileExplorerContextMenus>
+        </desktop4:Extension>
+        <com:Extension Category="windows.comServer">
+          <com:ComServer>
+            <com:SurrogateServer DisplayName="DigiDoc4 Shell Extension">
+              <com:Class Id="4ef3a5aa-125c-45f5-b5fd-d4c478050afa" Path="$<TARGET_FILE_NAME:EsteidShellExtensionV2>" ThreadingModel="STA"/>
+              <com:Class Id="bb67aa19-089b-4ec9-a059-13d985987cdc" Path="$<TARGET_FILE_NAME:EsteidShellExtensionV2>" ThreadingModel="STA"/>
+            </com:SurrogateServer>
+          </com:ComServer>
+        </com:Extension>
+      </Extensions>
+    </Application>
+  </Applications>
+</Package>
diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt
index 6134800f4..065f0cdbd 100644
--- a/client/CMakeLists.txt
+++ b/client/CMakeLists.txt
@@ -224,18 +224,21 @@ elseif(WIN32)
 	set(WIX_CMD wix.exe build -nologo
 		-arch $ENV{PLATFORM}
 		-ext WixToolset.UI.wixext
+		-ext WixToolset.Util.wixext
 		-bv WixUIDialogBmp=${CMAKE_SOURCE_DIR}/common/dlgbmp.bmp
 		-bv WixUIBannerBmp=${CMAKE_SOURCE_DIR}/common/banner.bmp
 		-d ico_path=${CMAKE_CURRENT_SOURCE_DIR}/images/digidoc.ico
 		-d libs_path=${LIBS_PATH}
 		-d client_path=$<TARGET_FILE:${PROJECT_NAME}>
+		-d shellext_v2=$<TARGET_FILE:EsteidShellExtensionV2>
+		-d shellext_msix=${CMAKE_BINARY_DIR}/${SHELLEXT_MSIX_FILE}
 		-d qt_suffix=$<$<CONFIG:Debug>:d>
 		${CMAKE_SOURCE_DIR}/${PROJECT_NAME}.wxs
 		${CMAKE_SOURCE_DIR}/common/WelcomeDlg.wxs
 		${CMAKE_SOURCE_DIR}/common/WixUI_Minimal.wxs
 	)
 	get_filename_component(QT_BASE_DIR "${Qt6_DIR}/../../.." ABSOLUTE)
-	add_custom_target(msi DEPENDS ${PROJECT_NAME}
+	add_custom_target(msi DEPENDS ${PROJECT_NAME} msixshellext
 		COMMAND ${WIX_CMD} -o "${MSI_FILE}.msi"
 		#Build MSI with QT
 		COMMAND ${WIX_CMD} -d qt_path=${QT_BASE_DIR}/bin -o "${MSI_FILE}.qt.msi"
diff --git a/extensions/windows/CMakeLists.txt b/extensions/windows/CMakeLists.txt
index c4bb27403..bc70c082a 100644
--- a/extensions/windows/CMakeLists.txt
+++ b/extensions/windows/CMakeLists.txt
@@ -59,6 +59,30 @@ add_custom_target(msishellext DEPENDS ${PROJECT_NAME}
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
 )
 
+set(PLATFORM $ENV{PLATFORM})
+if(SIGNCERT)
+    execute_process(
+        COMMAND powershell -NoProfile -NonInteractive -Command
+            "(Get-ChildItem Cert:\\CurrentUser\\My | Where-Object { $_.Subject -like '*${SIGNCERT}*' } | Select-Object -First 1).Subject"
+        OUTPUT_VARIABLE SIGNCERT_SUBJECT
+        OUTPUT_STRIP_TRAILING_WHITESPACE
+    )
+endif()
+configure_file(${CMAKE_SOURCE_DIR}/AppxManifest-ShellExt.xml.cmake ${CMAKE_BINARY_DIR}/AppxManifest-ShellExt.xml.in)
+file(GENERATE OUTPUT ${CMAKE_BINARY_DIR}/AppxManifest-ShellExt.xml INPUT ${CMAKE_BINARY_DIR}/AppxManifest-ShellExt.xml.in)
+set(SHELLEXT_MSIX_FILE "DigiDoc4Shell.msix")
+set(SHELLEXT_MSIX_FILE ${SHELLEXT_MSIX_FILE} PARENT_SCOPE)
+
+add_custom_target(msixshellext DEPENDS ${PROJECT_NAME}V2
+    COMMAND ${CMAKE_COMMAND} -E remove ${SHELLEXT_MSIX_FILE}
+    COMMAND ${CMAKE_COMMAND} -E remove_directory appxshell
+    COMMAND ${CMAKE_COMMAND} -E make_directory appxshell
+    COMMAND ${CMAKE_COMMAND} -E copy ${CMAKE_BINARY_DIR}/AppxManifest-ShellExt.xml appxshell/AppxManifest.xml
+    COMMAND ${CMAKE_COMMAND} -E copy_directory ${CMAKE_SOURCE_DIR}/Assets appxshell/Assets
+    COMMAND makeappx.exe pack /nv -d appxshell -p ${SHELLEXT_MSIX_FILE}
+    WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
+)
+
 if(SIGNCERT)
     if(CROSSSIGNCERT)
         target_link_options(${PROJECT_NAME} PRIVATE "/INTEGRITYCHECK")
@@ -74,4 +98,15 @@ if(SIGNCERT)
             /tr http://timestamp.digicert.com /td SHA256
             "${CMAKE_BINARY_DIR}/Digidoc_ShellExt-${VERSION}$ENV{VER_SUFFIX}.$ENV{PLATFORM}.msi"
     )
+    add_custom_command(TARGET ${PROJECT_NAME}V2 POST_BUILD
+        COMMAND signtool.exe sign /a /v /s MY /n "${SIGNCERT}" /fd SHA256 /du http://installer.id.ee
+            "$<$<BOOL:${CROSSSIGNCERT}>:/ph;/ac;${CROSSSIGNCERT}>"
+            /tr http://timestamp.digicert.com /td SHA256 $<TARGET_FILE:EsteidShellExtensionV2>
+        COMMAND_EXPAND_LISTS
+    )
+    add_custom_command(TARGET msixshellext POST_BUILD
+        COMMAND signtool.exe sign /a /v /s MY /n "${SIGNCERT}" /fd SHA256 /du http://installer.id.ee
+            /tr http://timestamp.digicert.com /td SHA256
+            "${CMAKE_BINARY_DIR}/${SHELLEXT_MSIX_FILE}"
+    )
 endif()
diff --git a/extensions/windows/EsteidShellExtensionV2.cpp b/extensions/windows/EsteidShellExtensionV2.cpp
index 9ec0b3d0e..6af142d55 100644
--- a/extensions/windows/EsteidShellExtensionV2.cpp
+++ b/extensions/windows/EsteidShellExtensionV2.cpp
@@ -92,10 +92,10 @@ struct EsteidShellExtension : public winrt::implements<EsteidShellExtension<IsCr
 		else parameters += L"\"-sign\" ";
 		for (DWORD i = 0; i < count; ++i)
 		{
-			IShellItem* psi = nullptr;
+			IShellItem* psi{};
 			if(auto hr = psiItemArray->GetItemAt(i, &psi); FAILED(hr))
 				return hr;
-			LPWSTR path;
+			LPWSTR path{};
 			auto hr = psi->GetDisplayName(SIGDN_FILESYSPATH, &path);
 			psi->Release();
 			if(FAILED(hr))
diff --git a/qdigidoc4.wxs b/qdigidoc4.wxs
index b002f491f..14fdfbab9 100644
--- a/qdigidoc4.wxs
+++ b/qdigidoc4.wxs
@@ -17,7 +17,8 @@
 <?endif?>
 
 <Wix xmlns="http://wixtoolset.org/schemas/v4/wxs"
-     xmlns:ui="http://wixtoolset.org/schemas/v4/wxs/ui">
+     xmlns:ui="http://wixtoolset.org/schemas/v4/wxs/ui"
+     xmlns:util="http://wixtoolset.org/schemas/v4/wxs/util">
   <Package Name="DigiDoc4 Client $(sys.BUILDARCH)" UpgradeCode="67932072-aa9e-45e3-b697-d825349f273d"
       Language="1033" Version="!(bind.FileVersion.qdigidoc4.exe)" Manufacturer="RIA" Scope="perMachine">
     <MediaTemplate EmbedCab="yes" CompressionLevel="high" />
@@ -29,6 +30,43 @@
     <Launch Condition="Installed OR (VersionNT &gt;= 601)" Message="[ProductName] requires Windows 7 or higher." />
     <ui:WixUI Id="WixUI_Minimal2" />
 
+    <!-- Shell extension registration -->
+    <SetProperty Id="RegisterShellExtMsixCurrentUser"
+        Value="&quot;[System64Folder]WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command &quot;Add-AppxPackage -Path '[INSTALLFOLDER]DigiDoc4Shell.msix' -ExternalLocation '[INSTALLFOLDER]'&quot;"
+        Before="RegisterShellExtMsixCurrentUser"
+        Sequence="execute" />
+    <CustomAction Id="RegisterShellExtMsixCurrentUser"
+        DllEntry="WixSilentExec"
+        BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)"
+        Execute="deferred"
+        Impersonate="yes"
+        Return="ignore" />
+    <SetProperty Id="RegisterShellExtTask"
+        Value="&quot;[System64Folder]WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command &quot;Register-ScheduledTask -Force -TaskName DigiDoc4ShellExt -Action (New-ScheduledTaskAction -Execute powershell.exe -Argument '-NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command \&quot;Add-AppxPackage -Path ''[INSTALLFOLDER]DigiDoc4Shell.msix'' -ExternalLocation ''[INSTALLFOLDER]'' -ErrorAction SilentlyContinue\&quot;') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Principal (New-ScheduledTaskPrincipal -GroupId Users -RunLevel Limited) -Settings (New-ScheduledTaskSettingsSet -Hidden)&quot;"
+        Before="RegisterShellExtTask"
+        Sequence="execute" />
+    <CustomAction Id="RegisterShellExtTask"
+        DllEntry="WixSilentExec"
+        BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)"
+        Execute="deferred"
+        Impersonate="no"
+        Return="ignore" />
+    <SetProperty Id="UnregisterShellExtMsix"
+        Value="&quot;[System64Folder]WindowsPowerShell\v1.0\powershell.exe&quot; -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command &quot;Unregister-ScheduledTask -TaskName DigiDoc4ShellExt -Confirm:$false -ErrorAction SilentlyContinue; Get-AppxPackage -Name RiigiInfossteemiAmet.DigiDoc4ShellExt -AllUsers | Remove-AppxPackage -AllUsers&quot;"
+        Before="UnregisterShellExtMsix"
+        Sequence="execute" />
+    <CustomAction Id="UnregisterShellExtMsix"
+        DllEntry="WixSilentExec"
+        BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)"
+        Execute="deferred"
+        Impersonate="no"
+        Return="ignore" />
+    <InstallExecuteSequence>
+      <Custom Action="RegisterShellExtMsixCurrentUser" After="InstallFiles" Condition="NOT Installed OR WIX_UPGRADE_DETECTED" />
+      <Custom Action="RegisterShellExtTask" After="RegisterShellExtMsixCurrentUser" Condition="NOT Installed OR WIX_UPGRADE_DETECTED" />
+      <Custom Action="UnregisterShellExtMsix" Before="RemoveFiles" Condition="REMOVE~=&quot;ALL&quot; OR WIX_UPGRADE_DETECTED" />
+    </InstallExecuteSequence>
+
     <!-- Desktop shortcut -->
     <StandardDirectory Id="DesktopFolder">
       <Component Id="DesktopShortcut4" Guid="7B821ED0-4838-4290-997C-AA4119F99DAD" Transitive="yes" Condition="DESKTOP_SHORTCUT = 1">
@@ -68,6 +106,8 @@
           </ProgId>
           <RegistryValue Root="HKCR" Key=".pdf\OpenWithProgids" Name="qdigidoc4.document" Value="" Type="string" />
         </Component>
+        <File Source="$(var.shellext_v2)" />
+        <File Source="$(var.shellext_msix)" Name="DigiDoc4Shell.msix" />
         <File Name="zlib$(var.qt_suffix)1.dll" />
         <File Name="libxml2.dll" />
         <File Name="libxmlsec1.dll" />