diff --git a/cbits/getentropy_win.c b/cbits/getentropy_win.c
new file mode 100644
index 000000000..682d92683
--- /dev/null
+++ b/cbits/getentropy_win.c
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: Apache-2.0
+// getentropy() shim for Windows, where it is absent from the CRT.
+// Follows the POSIX contract: fills `buffer` with `length` random bytes
+// (length must not exceed 256), returns 0 on success or -1 with errno set.
+#ifdef _WIN32
+#include <errno.h>
+#include <stddef.h>
+#include <windows.h>
+#include <bcrypt.h>
+
+int getentropy(void *buffer, size_t length) {
+    if (length > 256) {
+        errno = EIO;
+        return -1;
+    }
+    NTSTATUS status = BCryptGenRandom(NULL, (PUCHAR)buffer, (ULONG)length,
+                                      BCRYPT_USE_SYSTEM_PREFERRED_RNG);
+    if (!BCRYPT_SUCCESS(status)) {
+        errno = EIO;
+        return -1;
+    }
+    return 0;
+}
+#endif
diff --git a/simplexmq.cabal b/simplexmq.cabal
index fa2a8840d..be0d8d72f 100644
--- a/simplexmq.cabal
+++ b/simplexmq.cabal
@@ -333,6 +333,11 @@ library
       cbits/blst/build/assembly.S
   extra-libraries:
       crypto
+  if os(windows)
+    c-sources:
+        cbits/getentropy_win.c
+    extra-libraries:
+        bcrypt
   build-depends:
       aeson ==2.2.*
     , asn1-encoding ==0.9.*