diff --git a/scripts/Publish.ps1 b/scripts/Publish.ps1
index 248fbbc..fa3a571 100644
--- a/scripts/Publish.ps1
+++ b/scripts/Publish.ps1
@@ -83,6 +83,30 @@ function Add-CoderSignature([string] $path) {
     }
 }
 
+function Download-File([string] $url, [string] $outputPath, [string] $etagFile) {
+    Write-Host "Downloading '$url' to '$outputPath'"
+    # We use `curl.exe` here because `Invoke-WebRequest` is notoriously slow.
+    & curl.exe `
+        --progress-bar `
+        --show-error `
+        --fail `
+        --location `
+        --etag-compare $etagFile `
+        --etag-save $etagFile `
+        --output $outputPath `
+        $url
+    if ($LASTEXITCODE -ne 0) { throw "Failed to download $url" }
+    if (!(Test-Path $outputPath) -or (Get-Item $outputPath).Length -eq 0) {
+        throw "Failed to download '$url', output file '$outputPath' is missing or empty"
+    }
+}
+
+$goArch = switch ($arch) {
+    "x64" { "amd64" }
+    "arm64" { "arm64" }
+    default { throw "Unsupported architecture: $arch" }
+}
+
 # CD to the root of the repo
 $repoRoot = Resolve-Path (Join-Path $PSScriptRoot "..")
 Push-Location $repoRoot
@@ -145,6 +169,24 @@ if ($null -eq $wintunDllSrc) {
 $wintunDllDest = Join-Path $vpnFilesPath "wintun.dll"
 Copy-Item $wintunDllSrc $wintunDllDest
 
+# Download the mutagen binary from our bucket for this platform if we don't have
+# it yet (or it's different).
+$mutagenVersion = "v0.18.1"
+$mutagenSrcPath = Join-Path $repoRoot "scripts\files\mutagen-windows-$($goArch).exe"
+$mutagenSrcUrl = "https://storage.googleapis.com/coder-desktop/mutagen/$($mutagenVersion)/mutagen-windows-$($goArch).exe"
+$mutagenEtagFile = $mutagenSrcPath + ".etag"
+Download-File $mutagenSrcUrl $mutagenSrcPath $mutagenEtagFile
+$mutagenDestPath = Join-Path $vpnFilesPath "mutagen.exe"
+Copy-Item $mutagenSrcPath $mutagenDestPath
+
+# Download mutagen agents tarball.
+$mutagenAgentsSrcPath = Join-Path $repoRoot "scripts\files\mutagen-agents.tar.gz"
+$mutagenAgentsSrcUrl = "https://storage.googleapis.com/coder-desktop/mutagen/$($mutagenVersion)/mutagen-agents.tar.gz"
+$mutagenAgentsEtagFile = $mutagenAgentsSrcPath + ".etag"
+Download-File $mutagenAgentsSrcUrl $mutagenAgentsSrcPath $mutagenAgentsEtagFile
+$mutagenAgentsDestPath = Join-Path $vpnFilesPath "mutagen-agents.tar.gz"
+Copy-Item $mutagenAgentsSrcPath $mutagenAgentsDestPath
+
 # Build the MSI installer
 & dotnet.exe run --project .\Installer\Installer.csproj -c Release -- `
     build-msi `
diff --git a/scripts/files/.gitignore b/scripts/files/.gitignore
new file mode 100644
index 0000000..859c764
--- /dev/null
+++ b/scripts/files/.gitignore
@@ -0,0 +1,3 @@
+mutagen-*.tar.gz
+mutagen-*.exe
+*.etag