diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000000..6313b56c578
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+* text=auto eol=lf
diff --git a/.github/actions/bootstrap/action.yaml b/.github/actions/bootstrap/action.yaml
index aad6d609085..e55cee894a7 100644
--- a/.github/actions/bootstrap/action.yaml
+++ b/.github/actions/bootstrap/action.yaml
@@ -38,7 +38,7 @@ runs:
 
     - name: Install binny-managed tools
       shell: bash
-      run: make binny:install
+      run: go run -C .make . binny:install
 
     - name: Install apt packages
       if: inputs.bootstrap-apt-packages != ''
@@ -68,4 +68,4 @@ runs:
     - name: Download test fixture cache
       if: inputs.download-test-fixture-cache == 'true'
       shell: bash
-      run: make download-test-fixture-cache
+      run: go run -C .make . download-test-fixture-cache
diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml
index b4bb10ec2eb..44bb7fdae1a 100644
--- a/.github/workflows/validations.yaml
+++ b/.github/workflows/validations.yaml
@@ -24,7 +24,7 @@ jobs:
     #   tmpfs: faster io-intensive workflows
     #   note: s3-cache intentionally omitted -- PR runs are untrusted and must not write to the
     #   shared cache backend that the trusted release workflow reads from (cache poisoning).
-    runs-on: &test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=32+128/family=r5+r6+r7+r8+m4+m5+m6+m7+m8/spot=price-capacity-optimized/extras=tmpfs"
+    runs-on: &linux-test-runner "runs-on=${{ github.run_id }}/cpu=4+8/ram=32+128/family=r5+r6+r7+r8+m4+m5+m6+m7+m8/spot=price-capacity-optimized/extras=tmpfs"
     permissions:
       contents: read
     steps:
@@ -46,7 +46,7 @@ jobs:
   Unit-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Unit tests"
-    runs-on: *test-runner
+    runs-on: *linux-test-runner
     permissions:
       contents: read
     steps:
@@ -65,10 +65,29 @@ jobs:
       - name: Check for capability drift
         run: make check-capability-drift
 
+  Unit-Test-Windows:
+    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
+    name: "Unit tests (Windows)"
+    runs-on: runs-on=${{ github.run_id }}/image=windows25-full-x64/family=r5+r6+r7+r8+m4+m5+m6+m7+m8/spot=price-capacity-optimized
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        with:
+          download-test-fixture-cache: true
+
+      - name: Run unit tests
+        run: make unit
+
   Integration-Test:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Integration tests"
-    runs-on: *test-runner
+    runs-on: *linux-test-runner
     permissions:
       contents: read
     steps:
@@ -131,7 +150,7 @@ jobs:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "Acceptance tests (Linux)"
     needs: [Build-Snapshot-Artifacts]
-    runs-on: *test-runner
+    runs-on: *linux-test-runner
     permissions:
       contents: read
     steps:
@@ -187,7 +206,6 @@ jobs:
         uses: ./.github/actions/bootstrap
         with:
           bootstrap-apt-packages: ""
-          go-dependencies: false
           download-test-fixture-cache: true
 
       - name: Download snapshot artifacts
@@ -205,11 +223,47 @@ jobs:
       - name: Run install.sh tests (Mac)
         run: make install-test-ci-mac
 
+  Acceptance-Windows:
+    # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
+    name: "Acceptance tests (Windows)"
+#    needs: [Build-Snapshot-Artifacts]
+    runs-on: windows-2022
+    permissions:
+      contents: read
+    steps:
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Bootstrap environment
+        uses: ./.github/actions/bootstrap
+        with:
+          bootstrap-apt-packages: ""
+          download-test-fixture-cache: true
+
+      - name: Unit tests
+        run: go run -C .make . test
+
+#      - name: Download snapshot artifacts
+#        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+#        with:
+#          name: snapshot
+#          path: snapshot
+
+#      - name: Run comparison tests (Windows)
+#        run: make compare-win
+#
+#      - name: Run install.sh tests (Windows)
+#        run: make install-test-ci-win
+
   Cli-Linux:
     # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
     name: "CLI tests (Linux)"
     needs: [Build-Snapshot-Artifacts]
-    runs-on: *test-runner
+    runs-on: *linux-test-runner
     permissions:
       contents: read
     steps: