To install security patches after the last full bugfix release, you must build Python from source:
Compile the Binaries
- Install
Visual Studio 2019 Community and select:
the Python development workload, and
the Python native development tools (this is under Optional, but is necessary in order to build python from source)

Download the python source code and unzip it.
Navigate to the folder and install required external dependencies by running PCbuild\get_externals.bat
Build the debug (python_d.exe) and release (python.exe) binaries
> PCbuild\build.bat -p x64 -c Debug
> PCbuild\build.bat -p x64 -c Release
you can also build the Profile Guided Optimization (pgo) binary
> PCbuild\build.bat -p x64 --pgo
The binaries on python.org are run through PGO by default, so a --pgo binary will be faster than a -c Release binary. The debug binary is necessary for adding breakpoints and debugging your code.
All built binaries are placed in PCbuild\amd64.
Build the Installer
The instructions for building an installer are in Tools\msi\README.txt.
- Download the extra build dependencies by running
Tools\msi\get_externals.bat
NOTE: This is done in addition to running PCbuild/get_externals.bat.
It installs additional binaries to externals\windows-installer that are
needed for making installers. Specifically,
- WiX (
wix.exe), which is a toolset that lets developers create installers for Windows Installer, the Windows installation
engine.
- HTML Help (
htmlhelp), which is for building documentation.
Turn on .NET Framework 3.5 Features under Turn Windows features on or off

NOTE: This is required by WiX.
- Build the installer by running
> .\Tools\msi\buildrelease.bat -x64
NOTE: Be sure the following environment variables are properly set or left blank so the script can set them:
PYTHON=<path to python.exe>
SPHINXBUILD=<path to sphinx-build.exe>
The installer will be placed in PCbuild\amd64\en-us. It is a single .exe (the installer entry point). The folder will also have a number of additional CAB and MSI files. Each MSI contains the logic required to install a component or feature of Python, but these should not be run directly.
Specify --pack to build an installer that does not require all MSIs to be available alongside. This takes longer, but is easier to share.