diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
new file mode 100644
index 000000000..46d14e0e6
--- /dev/null
+++ b/.github/workflows/windows.yml
@@ -0,0 +1,55 @@
+name: windows
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        go-version: [1.20.x]
+        os: [windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: ${{ matrix.go-version }}
+          cache: true
+
+      - name: Install tools
+        run: |
+          go install golang.org/x/tools/cmd/goimports@latest
+
+      - name: Test
+        run: |
+          $Env:VDLPATH=$Env:GITHUB_WORKSPACE
+          go test --race --covermode=atomic --timeout=15m ./...
+          cd x/ref/examples
+          go test --race --covermode=atomic ./...
+
+  integration-tests:
+    runs-on: windows-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: 1.20.x
+          cache: true
+
+      - name: Install openssl
+        run: |
+          choco install openssl
+
+      - name: Test
+        run: |
+          make test-integration test-openssl-integration
diff --git a/go.mod b/go.mod
index 6766f9acc..18e41d398 100644
--- a/go.mod
+++ b/go.mod
@@ -13,6 +13,7 @@ require (
 	golang.org/x/mod v0.7.0
 	golang.org/x/net v0.5.0
 	golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4
+	golang.org/x/sys v0.4.0
 	golang.org/x/term v0.4.0
 	golang.org/x/text v0.6.0
 	v.io/x/lib v0.1.13
@@ -28,7 +29,6 @@ require (
 	github.com/tklauser/go-sysconf v0.3.11 // indirect
 	github.com/tklauser/numcpus v0.6.0 // indirect
 	github.com/yusufpapurcu/wmi v1.2.2 // indirect
-	golang.org/x/sys v0.4.0 // indirect
 )
 
 replace v.io/x/ref/lib/flags/sitedefaults => ./x/ref/lib/flags/sitedefaults
diff --git a/x/ref/lib/security/internal/lockedfile/filelock/filelock_windows.go b/x/ref/lib/security/internal/lockedfile/filelock/filelock_windows.go
index 4a9487290..8c4975c08 100644
--- a/x/ref/lib/security/internal/lockedfile/filelock/filelock_windows.go
+++ b/x/ref/lib/security/internal/lockedfile/filelock/filelock_windows.go
@@ -8,7 +8,7 @@
 package filelock
 
 import (
-	"internal/syscall/windows"
+	"golang.org/x/sys/windows"
 	"os"
 	"syscall"
 )
diff --git a/x/ref/runtime/factories/roaming/roaming.go b/x/ref/runtime/factories/roaming/roaming.go
index a7bc95743..6fc978a95 100644
--- a/x/ref/runtime/factories/roaming/roaming.go
+++ b/x/ref/runtime/factories/roaming/roaming.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux || darwin
-// +build linux darwin
+//go:build linux || darwin || windows
+// +build linux darwin windows
 
 // Package roaming implements a RuntimeFactory suitable for a variety of network
 // configurations, including 1-1 NATs, dhcp auto-configuration, Amazon Web
diff --git a/x/ref/runtime/factories/static/static.go b/x/ref/runtime/factories/static/static.go
index 45fa2a17f..356e6d5b4 100644
--- a/x/ref/runtime/factories/static/static.go
+++ b/x/ref/runtime/factories/static/static.go
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-//go:build linux || darwin
-// +build linux darwin
+//go:build linux || darwin || windows
+// +build linux darwin windows
 
 // Package static implements a RuntimeFactory suitable for a variety of network
 // configurations, including 1-1 NATs, Amazon Web Services and Google Compute