diff --git a/.bazelrc b/.bazelrc
index f406f5a10..dc8b9a6f2 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -7,6 +7,7 @@ import %workspace%/.aspect/bazelrc/javascript.bazelrc
 import %workspace%/.aspect/bazelrc/performance.bazelrc
 
 ### YOUR PROJECT SPECIFIC OPTIONS GO HERE ###
+common --enable_platform_specific_config
 
 # For testing our --stamp behavior.
 # Normally users would use a --workspace_status_command with a script that calls `git describe`.
@@ -29,6 +30,17 @@ common --check_direct_dependencies=off
 # Make sure we don't regress this.
 common --incompatible_auto_exec_groups
 
+# Symlinks are pretty much required on windows so enable by default
+startup --windows_enable_symlinks
+
+# Point tools such as coursier (used in rules_jvm_external) to Bazel's downloaded JDK
+# suggested in https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk
+
+# This option fixes 20 tests on Windows but I am reluctant to enable it as it would be
+# better for this library to be tested with runfiles off (it is a performance drain on windows).
+# common:windows --enable_runfiles
+
 # Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
 # This file should appear in `.gitignore` so that settings are not shared with team members. This
 # should be last statement in this config so the user configuration is able to overwrite flags from
diff --git a/.bazelversion b/.bazelversion
index 0e7915245..56b6be4eb 100644
--- a/.bazelversion
+++ b/.bazelversion
@@ -1 +1 @@
-8.1.1
+8.3.1
diff --git a/.bcr/patches/go_dev_dep.patch b/.bcr/patches/go_dev_dep.patch
index c4c8c5a9d..20fb472b7 100644
--- a/.bcr/patches/go_dev_dep.patch
+++ b/.bcr/patches/go_dev_dep.patch
@@ -2,7 +2,7 @@ diff --git a/MODULE.bazel b/MODULE.bazel
 index e63fa5b..9d78a88 100644
 --- a/MODULE.bazel
 +++ b/MODULE.bazel
-@@ -50,19 +50,19 @@ use_repo(host, "aspect_bazel_lib_host")
+@@ -52,26 +52,26 @@ use_repo(host, "aspect_bazel_lib_host")
  bazel_dep(
      name = "gazelle",
      version = "0.40.0",
@@ -11,12 +11,20 @@ index e63fa5b..9d78a88 100644
  )
  bazel_dep(
      name = "rules_go",
-     version = "0.51.0",
+     version = "0.55.0",
      repo_name = "io_bazel_rules_go",
 -    # In released versions: dev_dependency = True
 +    dev_dependency = True,
  )
 
+ go_sdk = use_extension(
+     "@io_bazel_rules_go//go:extensions.bzl",
+     "go_sdk",
+-    # In released versions: dev_dependency = True
++    dev_dependency = True,
+ )
+ go_sdk.from_file(go_mod = "//:go.mod")
+
  go_deps = use_extension(
      "@gazelle//:extensions.bzl",
      "go_deps",
diff --git a/.github/workflows/ci.bazelrc b/.github/workflows/ci.bazelrc
index 74059fd66..db9d7adab 100644
--- a/.github/workflows/ci.bazelrc
+++ b/.github/workflows/ci.bazelrc
@@ -4,3 +4,6 @@ common --repository_cache=~/.cache/bazel-repository-cache
 
 # Debug where options came from
 common --announce_rc
+
+# Keep bazel stdout readable in logs
+common --noshow_progress
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 32f0cf194..7fd769cfc 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -35,16 +35,8 @@ jobs:
           echo "res=[${j%,}]" | tee -a $GITHUB_OUTPUT
       - id: os
         name: Prepare 'os' matrix axis
-        # Only run MacOS and Windows on main branch (not PRs) to minimize minutes (billed at 10X and 2X respectively)
-        # https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#included-storage-and-minutes
         run: |
-          a=( ubuntu )
-          if [[ "${{ github.ref_name }}" == "main" ]] || [[ "$HEAD_REF" == *"macos"* ]]; then
-            a+=( macos )
-          fi
-          if [[ "${{ github.ref_name }}" == "main" ]] || [[ "$HEAD_REF" == *"windows"* ]]; then
-            a+=( windows )
-          fi
+          a=( ubuntu, macos, windows )
           printf -v j '"%s",' "${a[@]}"
           echo "res=[${j%,}]" | tee -a $GITHUB_OUTPUT
     outputs:
@@ -89,11 +81,9 @@ jobs:
           - bazel-version:
               major: 6
             bzlmod: 1
-          # TODO: green up root Workspace on MacOS & Windows
+          # TODO: green up root Workspace on MacOS
           - folder: .
             os: macos
-          - folder: .
-            os: windows
         include:
           - folder: docs
             bzlmod: 1
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 706fc57a1..edded994a 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -21,11 +21,12 @@ on:
         type: string
 jobs:
   publish:
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.0.4
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v0.2.2
     with:
       tag_name: ${{ inputs.tag_name }}
       # GitHub repository which is a fork of the upstream where the Pull Request will be opened.
       registry_fork: bazel-contrib/bazel-central-registry
+      draft: false
     permissions:
       attestations: write
       contents: write
diff --git a/BUILD.bazel b/BUILD.bazel
index dcaec8b6e..662ad27f0 100644
--- a/BUILD.bazel
+++ b/BUILD.bazel
@@ -112,7 +112,8 @@ assert_contains(
     name = "bazel_version_test",
     actual = ".bazelversion",
     expected = str(host.bazel_version),
-    target_compatible_with = [] if host.bazel_version.startswith("7") else ["@platforms//:incompatible"],
+    # TODO: Enable this for windows
+    target_compatible_with = [] if host.bazel_version.startswith("7") and not host.is_windows else ["@platforms//:incompatible"],
 )
 
 bzl_library(
diff --git a/MODULE.bazel b/MODULE.bazel
index b0d25492d..c120818bd 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -9,9 +9,9 @@ module(
 
 # Lower-bounds (minimum) versions for direct runtime dependencies
 bazel_dep(name = "bazel_features", version = "1.9.0")
-bazel_dep(name = "bazel_skylib", version = "1.5.0")
+bazel_dep(name = "bazel_skylib", version = "1.8.1")
 bazel_dep(name = "platforms", version = "0.0.10")
-bazel_dep(name = "stardoc", version = "0.6.2")
+bazel_dep(name = "stardoc", version = "0.7.1")
 bazel_dep(name = "rules_shell", version = "0.4.1")
 
 # TODO(3.0): remove this back-compat
@@ -56,11 +56,18 @@ bazel_dep(
 )
 bazel_dep(
     name = "rules_go",
-    version = "0.51.0",
+    version = "0.55.0",
     repo_name = "io_bazel_rules_go",
     # In released versions: dev_dependency = True
 )
 
+go_sdk = use_extension(
+    "@io_bazel_rules_go//go:extensions.bzl",
+    "go_sdk",
+    # In released versions: dev_dependency = True
+)
+go_sdk.from_file(go_mod = "//:go.mod")
+
 go_deps = use_extension(
     "@gazelle//:extensions.bzl",
     "go_deps",
diff --git a/bzl_library.bzl b/bzl_library.bzl
index cd8b1d5f5..dfa932c8b 100644
--- a/bzl_library.bzl
+++ b/bzl_library.bzl
@@ -74,11 +74,19 @@ def bzl_library(name, srcs = [], deps = [], **kwargs):
     # native Bazel rule.
     # See bazelbuild/bazel-skylib#568
     if hasattr(native, "starlark_doc_extract") and "/private" not in native.package_name():
+        extract_targets = []
         for i, src in enumerate(srcs):
+            extract_target = "{}.doc_extract{}".format(name, i if i > 0 else "")
             native.starlark_doc_extract(
-                name = "{}.doc_extract{}".format(name, i if i > 0 else ""),
+                name = extract_target,
                 src = src,
                 deps = deps,
                 testonly = True,
                 visibility = ["//visibility:private"],
             )
+            extract_targets.append(extract_target)
+        native.filegroup(
+            name = "{}.docs-as-proto".format(name),
+            srcs = extract_targets,
+            testonly = True,
+        )
diff --git a/docs/.bazelversion b/docs/.bazelversion
index 0e7915245..56b6be4eb 100644
--- a/docs/.bazelversion
+++ b/docs/.bazelversion
@@ -1 +1 @@
-8.1.1
+8.3.1
diff --git a/docs/repositories.md b/docs/repositories.md
index c7094a8a0..9b3c9f0ec 100644
--- a/docs/repositories.md
+++ b/docs/repositories.md
@@ -120,7 +120,7 @@ Registers coreutils toolchain and repositories
 | Name  | Description | Default Value |
 | :------------- | :------------- | :------------- |
 | <a id="register_coreutils_toolchains-name"></a>name |  override the prefix for the generated toolchain repositories   |  `"coreutils"` |
-| <a id="register_coreutils_toolchains-version"></a>version |  the version of coreutils to execute (see https://github.com/uutils/coreutils/releases)   |  `"0.0.27"` |
+| <a id="register_coreutils_toolchains-version"></a>version |  the version of coreutils to execute (see https://github.com/uutils/coreutils/releases)   |  `"0.1.0"` |
 | <a id="register_coreutils_toolchains-register"></a>register |  whether to call through to native.register_toolchains. Should be True for WORKSPACE users, but false when used under bzlmod extension   |  `True` |
 
 
@@ -206,7 +206,7 @@ Registers yq toolchain and repositories
 | Name  | Description | Default Value |
 | :------------- | :------------- | :------------- |
 | <a id="register_yq_toolchains-name"></a>name |  override the prefix for the generated toolchain repositories   |  `"yq"` |
-| <a id="register_yq_toolchains-version"></a>version |  the version of yq to execute (see https://github.com/mikefarah/yq/releases)   |  `"4.45.1"` |
+| <a id="register_yq_toolchains-version"></a>version |  the version of yq to execute (see https://github.com/mikefarah/yq/releases)   |  `"4.45.2"` |
 | <a id="register_yq_toolchains-register"></a>register |  whether to call through to native.register_toolchains. Should be True for WORKSPACE users, but false when used under bzlmod extension   |  `True` |
 
 
diff --git a/e2e/api_entries/MODULE.bazel b/e2e/api_entries/MODULE.bazel
index 58575a347..b216f769d 100644
--- a/e2e/api_entries/MODULE.bazel
+++ b/e2e/api_entries/MODULE.bazel
@@ -4,4 +4,4 @@ local_path_override(
     path = "../..",
 )
 
-bazel_dep(name = "bazel_skylib", version = "1.7.1", dev_dependency = True)
+bazel_dep(name = "bazel_skylib", version = "1.8.1", dev_dependency = True)
diff --git a/e2e/copy_action/.bazelrc b/e2e/copy_action/.bazelrc
index e1b3ea109..e249407e3 100644
--- a/e2e/copy_action/.bazelrc
+++ b/e2e/copy_action/.bazelrc
@@ -8,6 +8,10 @@ import %workspace%/../../.aspect/bazelrc/performance.bazelrc
 
 ### YOUR PROJECT SPECIFIC OPTIONS GO HERE ###
 
+# Point tools such as coursier (used in rules_jvm_external) to Bazel's downloaded JDK
+# suggested in https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk
+
 # Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
 # This file should appear in `.gitignore` so that settings are not shared with team members. This
 # should be last statement in this config so the user configuration is able to overwrite flags from
diff --git a/e2e/copy_action/MODULE.bazel b/e2e/copy_action/MODULE.bazel
index 58575a347..b216f769d 100644
--- a/e2e/copy_action/MODULE.bazel
+++ b/e2e/copy_action/MODULE.bazel
@@ -4,4 +4,4 @@ local_path_override(
     path = "../..",
 )
 
-bazel_dep(name = "bazel_skylib", version = "1.7.1", dev_dependency = True)
+bazel_dep(name = "bazel_skylib", version = "1.8.1", dev_dependency = True)
diff --git a/e2e/copy_to_directory/.bazelrc b/e2e/copy_to_directory/.bazelrc
index e1b3ea109..e249407e3 100644
--- a/e2e/copy_to_directory/.bazelrc
+++ b/e2e/copy_to_directory/.bazelrc
@@ -8,6 +8,10 @@ import %workspace%/../../.aspect/bazelrc/performance.bazelrc
 
 ### YOUR PROJECT SPECIFIC OPTIONS GO HERE ###
 
+# Point tools such as coursier (used in rules_jvm_external) to Bazel's downloaded JDK
+# suggested in https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk
+
 # Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
 # This file should appear in `.gitignore` so that settings are not shared with team members. This
 # should be last statement in this config so the user configuration is able to overwrite flags from
diff --git a/e2e/copy_to_directory/MODULE.bazel b/e2e/copy_to_directory/MODULE.bazel
index 58575a347..b216f769d 100644
--- a/e2e/copy_to_directory/MODULE.bazel
+++ b/e2e/copy_to_directory/MODULE.bazel
@@ -4,4 +4,4 @@ local_path_override(
     path = "../..",
 )
 
-bazel_dep(name = "bazel_skylib", version = "1.7.1", dev_dependency = True)
+bazel_dep(name = "bazel_skylib", version = "1.8.1", dev_dependency = True)
diff --git a/e2e/coreutils/.bazelrc b/e2e/coreutils/.bazelrc
index e1b3ea109..e249407e3 100644
--- a/e2e/coreutils/.bazelrc
+++ b/e2e/coreutils/.bazelrc
@@ -8,6 +8,10 @@ import %workspace%/../../.aspect/bazelrc/performance.bazelrc
 
 ### YOUR PROJECT SPECIFIC OPTIONS GO HERE ###
 
+# Point tools such as coursier (used in rules_jvm_external) to Bazel's downloaded JDK
+# suggested in https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk
+
 # Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
 # This file should appear in `.gitignore` so that settings are not shared with team members. This
 # should be last statement in this config so the user configuration is able to overwrite flags from
diff --git a/e2e/external_copy_to_directory/.bazelrc b/e2e/external_copy_to_directory/.bazelrc
index e1b3ea109..e249407e3 100644
--- a/e2e/external_copy_to_directory/.bazelrc
+++ b/e2e/external_copy_to_directory/.bazelrc
@@ -8,6 +8,10 @@ import %workspace%/../../.aspect/bazelrc/performance.bazelrc
 
 ### YOUR PROJECT SPECIFIC OPTIONS GO HERE ###
 
+# Point tools such as coursier (used in rules_jvm_external) to Bazel's downloaded JDK
+# suggested in https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk
+
 # Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
 # This file should appear in `.gitignore` so that settings are not shared with team members. This
 # should be last statement in this config so the user configuration is able to overwrite flags from
diff --git a/e2e/external_copy_to_directory/MODULE.bazel b/e2e/external_copy_to_directory/MODULE.bazel
index 58575a347..b216f769d 100644
--- a/e2e/external_copy_to_directory/MODULE.bazel
+++ b/e2e/external_copy_to_directory/MODULE.bazel
@@ -4,4 +4,4 @@ local_path_override(
     path = "../..",
 )
 
-bazel_dep(name = "bazel_skylib", version = "1.7.1", dev_dependency = True)
+bazel_dep(name = "bazel_skylib", version = "1.8.1", dev_dependency = True)
diff --git a/e2e/smoke/.bazelrc b/e2e/smoke/.bazelrc
index 3cc9865b4..5c54737dd 100644
--- a/e2e/smoke/.bazelrc
+++ b/e2e/smoke/.bazelrc
@@ -11,6 +11,10 @@ import %workspace%/../../.aspect/bazelrc/performance.bazelrc
 # For testing expand_template
 common --workspace_status_command="echo BUILD_SCM_VERSION 1.2.3"
 
+# Point tools such as coursier (used in rules_jvm_external) to Bazel's downloaded JDK
+# suggested in https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk
+
 # Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
 # This file should appear in `.gitignore` so that settings are not shared with team members. This
 # should be last statement in this config so the user configuration is able to overwrite flags from
diff --git a/e2e/smoke/MODULE.bazel b/e2e/smoke/MODULE.bazel
index 3846db6b7..fbda5dba3 100644
--- a/e2e/smoke/MODULE.bazel
+++ b/e2e/smoke/MODULE.bazel
@@ -4,5 +4,5 @@ local_path_override(
     path = "../..",
 )
 
-bazel_dep(name = "bazel_skylib", version = "1.7.1", dev_dependency = True)
-bazel_dep(name = "rules_go", version = "0.53.0", dev_dependency = True, repo_name = "io_bazel_rules_go")
+bazel_dep(name = "bazel_skylib", version = "1.8.1", dev_dependency = True)
+bazel_dep(name = "rules_go", version = "0.55.0", dev_dependency = True, repo_name = "io_bazel_rules_go")
diff --git a/e2e/write_source_files/.bazelrc b/e2e/write_source_files/.bazelrc
index e1b3ea109..e249407e3 100644
--- a/e2e/write_source_files/.bazelrc
+++ b/e2e/write_source_files/.bazelrc
@@ -8,6 +8,10 @@ import %workspace%/../../.aspect/bazelrc/performance.bazelrc
 
 ### YOUR PROJECT SPECIFIC OPTIONS GO HERE ###
 
+# Point tools such as coursier (used in rules_jvm_external) to Bazel's downloaded JDK
+# suggested in https://github.com/bazelbuild/rules_jvm_external/issues/445
+common --repo_env=JAVA_HOME=../bazel_tools/jdk
+
 # Load any settings & overrides specific to the current user from `.aspect/bazelrc/user.bazelrc`.
 # This file should appear in `.gitignore` so that settings are not shared with team members. This
 # should be last statement in this config so the user configuration is able to overwrite flags from
diff --git a/go.mod b/go.mod
index f4226fa68..777cccf44 100644
--- a/go.mod
+++ b/go.mod
@@ -1,11 +1,9 @@
 module github.com/bazel-contrib/bazel-lib
 
-go 1.22
-
-toolchain go1.24.0
+go 1.24.6
 
 require (
-	github.com/bazelbuild/rules_go v0.53.0
+	github.com/bazelbuild/rules_go v0.55.0
 	github.com/bmatcuk/doublestar/v4 v4.7.1
 	golang.org/x/exp v0.0.0-20240823005443-9b4947da3948
 	golang.org/x/sys v0.30.0
diff --git a/go.sum b/go.sum
index 0def0ae95..c454ceb75 100644
--- a/go.sum
+++ b/go.sum
@@ -1,12 +1,8 @@
-github.com/bazelbuild/rules_go v0.52.0 h1:+ozpngVAW67pCAwfhepaXSSrG3yHcj8K9hNAxSYBno4=
-github.com/bazelbuild/rules_go v0.52.0/go.mod h1:M+YrupNArA7OiTlv++rFUgQ6Sm+ZXbQ5HPUj0cGa0us=
-github.com/bazelbuild/rules_go v0.53.0 h1:u160DT+RRb+Xb2aSO4piN8xhs4aZvWz2UDXCq48F4ao=
-github.com/bazelbuild/rules_go v0.53.0/go.mod h1:xB1jfsYHWlnZyPPxzlOSst4q2ZAwS251Mp9Iw6TPuBc=
+github.com/bazelbuild/rules_go v0.55.0 h1:S8X/b/Oygw/Dtv7NuyW7ht0QwdynMEdXQqYigX5A1KY=
+github.com/bazelbuild/rules_go v0.55.0/go.mod h1:T90Gpyq4HDFlsrvtQa2CBdHNJ2P4rAu/uUTmQbanzf0=
 github.com/bmatcuk/doublestar/v4 v4.7.1 h1:fdDeAqgT47acgwd9bd9HxJRDmc9UAmPpc+2m0CXv75Q=
 github.com/bmatcuk/doublestar/v4 v4.7.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 golang.org/x/exp v0.0.0-20240823005443-9b4947da3948 h1:kx6Ds3MlpiUHKj7syVnbp57++8WpuKPcR5yjLBjvLEA=
 golang.org/x/exp v0.0.0-20240823005443-9b4947da3948/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
-golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
-golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
 golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
diff --git a/lib/private/copy_directory.bzl b/lib/private/copy_directory.bzl
index 65b35ab2e..e3a12b653 100644
--- a/lib/private/copy_directory.bzl
+++ b/lib/private/copy_directory.bzl
@@ -63,6 +63,8 @@ def copy_directory_bin_action(
         outputs = [dst],
         executable = copy_directory_bin,
         arguments = args,
+        # TODO: Drop this after https://github.com/bazel-contrib/bazel-lib/issues/1146
+        env = {"GODEBUG": "winsymlink=0"},
         mnemonic = "CopyDirectory",
         progress_message = "Copying directory %{input}",
         execution_requirements = _COPY_EXECUTION_REQUIREMENTS,
diff --git a/lib/private/copy_to_directory.bzl b/lib/private/copy_to_directory.bzl
index 0e5626b23..f584f519d 100644
--- a/lib/private/copy_to_directory.bzl
+++ b/lib/private/copy_to_directory.bzl
@@ -510,6 +510,8 @@ def copy_to_directory_bin_action(
         outputs = [dst],
         executable = copy_to_directory_bin,
         arguments = [config_file.path, ctx.label.workspace_name],
+        # TODO: Drop this after https://github.com/bazel-contrib/bazel-lib/issues/1146
+        env = {"GODEBUG": "winsymlink=0"},
         mnemonic = "CopyToDirectory",
         progress_message = "Copying files to directory %{output}",
         execution_requirements = _COPY_EXECUTION_REQUIREMENTS,
diff --git a/lib/private/coreutils_toolchain.bzl b/lib/private/coreutils_toolchain.bzl
index 18c11fd0d..df1fb480b 100644
--- a/lib/private/coreutils_toolchain.bzl
+++ b/lib/private/coreutils_toolchain.bzl
@@ -32,6 +32,12 @@ COREUTILS_PLATFORMS = {
             "@platforms//cpu:x86_64",
         ],
     ),
+    "windows_arm64": struct(
+        compatible_with = [
+            "@platforms//os:windows",
+            "@platforms//cpu:aarch64",
+        ],
+    ),
 }
 
 # https://github.com/uutils/coreutils/releases
@@ -39,6 +45,32 @@ COREUTILS_PLATFORMS = {
 # The integrity hashes can be automatically fetched for the coreutils releases by running
 # `tools/coreutils_mirror_release.sh`.
 COREUTILS_VERSIONS = {
+    "0.1.0": {
+        "darwin_arm64": {
+            "filename": "coreutils-0.1.0-aarch64-apple-darwin.tar.gz",
+            "sha256": "sha256-fYBo89ESeNlveOtCtn0kC7j7I4ZyTqWXSB6X7HUmXZw=",
+        },
+        "windows_arm64": {
+            "filename": "coreutils-0.1.0-aarch64-pc-windows-msvc.zip",
+            "sha256": "sha256-n6oOwPPfR8r6Cgn86tRtoo4mQLX+ExatnLfhHxkFC9Q=",
+        },
+        "linux_arm64": {
+            "filename": "coreutils-0.1.0-aarch64-unknown-linux-musl.tar.gz",
+            "sha256": "sha256-ZXIpLudLtqfvqI8F0NCnpcaWuuCuNBpDi5g653dcnUc=",
+        },
+        "darwin_amd64": {
+            "filename": "coreutils-0.1.0-x86_64-apple-darwin.tar.gz",
+            "sha256": "sha256-CifwnwOBEom53c/4xrfBv26XG16sPdU2IIpA4sHqnNk=",
+        },
+        "windows_amd64": {
+            "filename": "coreutils-0.1.0-x86_64-pc-windows-msvc.zip",
+            "sha256": "sha256-T/PH5RSa3iCjQkh9HAnMbMY1ma9t+yjSVYuSV4CnLYI=",
+        },
+        "linux_amd64": {
+            "filename": "coreutils-0.1.0-x86_64-unknown-linux-musl.tar.gz",
+            "sha256": "sha256-RjZINHsfwzdBSoZL2pYMnL0b1KVA80TAEP9bs1GZ5tc=",
+        },
+    },
     "0.0.27": {
         "darwin_arm64": {
             "filename": "coreutils-0.0.27-aarch64-apple-darwin.tar.gz",
diff --git a/lib/private/yq_toolchain.bzl b/lib/private/yq_toolchain.bzl
index 55e3d6267..f042a8a06 100644
--- a/lib/private/yq_toolchain.bzl
+++ b/lib/private/yq_toolchain.bzl
@@ -52,11 +52,17 @@ YQ_PLATFORMS = {
             "@platforms//cpu:x86_64",
         ],
     ),
+    "windows_arm64": struct(
+        compatible_with = [
+            "@platforms//os:windows",
+            "@platforms//cpu:aarch64",
+        ],
+    ),
 }
 
 # Note: this is not the latest release, because it has significant breaking changes.
 # See https://github.com/bazel-contrib/bazel-lib/pull/421
-DEFAULT_YQ_VERSION = "4.45.1"
+DEFAULT_YQ_VERSION = "4.45.2"
 
 # https://github.com/mikefarah/yq/releases
 #
@@ -67,6 +73,17 @@ DEFAULT_YQ_VERSION = "4.45.1"
 # Alternatively, you can compute them manually by running
 # `shasum -b -a 384 [downloaded file] | awk '{ print $1 }' | xxd -r -p | base64`
 YQ_VERSIONS = {
+    "4.45.2": {
+        "darwin_amd64": "sha384-TBsrUTy6n6qA2hiSlpnEN6iEDDz4Tiy++AxLOpeXU1aUaI6uIuEBx8hgPYWWuD8V",
+        "darwin_arm64": "sha384-bnZ5TqsG5pcWB6gC87QKrBrjcKYmdOcSD7TpFVeCU6Nj7z5egeZzm4BH1FHbqo0e",
+        "linux_amd64": "sha384-jEOdMXHPvRiaFXWRnSA5Mw41VCKkNPv42i35i9BiVxrAnfyl/3/Li/iyQyj16QIr",
+        "linux_arm64": "sha384-4bEWn6fDQhIomb6Smzm8yw26RvqsjHh3PH/SogwWoLC9uJRoyQagY2PJZaYWxUDY",
+        "linux_s390x": "sha384-9uU3CXqjUG/SuPiHPKIUqbOVyqx7JiVOtRzeFta9IBFkJyUB0pBBOYkoDppvrmzz",
+        "linux_riscv64": "sha384-FWM1djpKjWctmhaInat/z/CcwQuiqLTeQcb0MMU5+sNiwMTuWyjvNlbwA4rRG3ZQ",
+        "linux_ppc64le": "sha384-bB03rZ0ptRt2EuFnA9SvscPMe3gVJecBvxhzPbYe7wsfoHvzzYqWffCchZVxRg+9",
+        "windows_amd64": "sha384-vG8R2+s/sD8DbeCM9H0xCy5JgtAOII7SLRx2g+ALtQZWW/q3XjXlzN2CKW/zU+EH",
+        "windows_arm64": "sha384-XHgi894S4cQ2qgJx47cPu5vtb2MOXA2YZ7QgExODwNoIPhji5wXK2MrgMB+RI7gZ",
+    },
     "4.45.1": {
         "darwin_amd64": "sha384-ZoEgzfCLmDk7eoKdJSoq/nny1iX3Cq9mMJ3gnPZ2ejhKMxSgHUQIa7MREToxYl6Z",
         "darwin_arm64": "sha384-nHYFqoarTzGba/XtpN8N3U0X9hMTg64Vn7XZ8yiF2cbJFdY3VWFVw80vsg/JXaOg",
diff --git a/lib/private/zstd_toolchain.bzl b/lib/private/zstd_toolchain.bzl
index 3af968be1..3cb57cf20 100644
--- a/lib/private/zstd_toolchain.bzl
+++ b/lib/private/zstd_toolchain.bzl
@@ -25,24 +25,38 @@ ZSTD_PLATFORMS = {
             "@platforms//cpu:aarch64",
         ],
     ),
+    "windows_amd64": struct(
+        compatible_with = [
+            "@platforms//os:windows",
+            "@platforms//cpu:x86_64",
+        ],
+    ),
 }
 
 ZSTD_PREBUILT = {
     "darwin_amd64": (
-        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6/zstd_darwin_amd64",
-        "e4d517212005cf26f8b8d657455d1380318b071cb52a3ffd9dfbdf4c2ba71a13",
+        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6-bcr1/zstd_darwin_amd64",
+        "E4D517212005CF26F8B8D657455D1380318B071CB52A3FFD9DFBDF4C2BA71A13",
     ),
     "darwin_arm64": (
-        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6/zstd_darwin_arm64",
-        "6e210eeae08fb6ba38c3ac2d1857075c28113aef68296f7e396f1180f7e894b9",
+        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6-bcr1/zstd_darwin_arm64",
+        "6E210EEAE08FB6BA38C3AC2D1857075C28113AEF68296F7E396F1180F7E894B9",
     ),
     "linux_amd64": (
-        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6/zstd_linux_amd64",
-        "0f0bd1193509a598629d7fa745c4b0b6d5fa6719e0c94c01ef0f20e466d801a7",
+        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6-bcr1/zstd_linux_amd64",
+        "0F0BD1193509A598629D7FA745C4B0B6D5FA6719E0C94C01EF0F20E466D801A7",
     ),
     "linux_arm64": (
-        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6/zstd_linux_arm64",
-        "82aacf8f1c67ff3c94e04afb0721a848bbba70fbf8249ee4bc4c9085afb84548",
+        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6-bcr1/zstd_linux_arm64",
+        "82AACF8F1C67FF3C94E04AFB0721A848BBBA70FBF8249EE4BC4C9085AFB84548",
+    ),
+    "windows_amd64": (
+        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6-bcr1/zstd_windows_x86_64.exe",
+        "A944FDE13D01892C7CF0970FE4271F9561373F5E0A46ECEA756B6AE9A31E056C",
+    ),
+    "windows_arm64": (
+        "https://github.com/aspect-build/zstd-prebuilt/releases/download/v1.5.6-bcr1/zstd_windows_arm64.exe",
+        "8CA462473BCCD13C9D9A952F09E5F628153785323949D539E8858B2ABB85E246",
     ),
 }
 
diff --git a/lib/tests/BUILD.bazel b/lib/tests/BUILD.bazel
index aebfad0c9..6b668d9ba 100644
--- a/lib/tests/BUILD.bazel
+++ b/lib/tests/BUILD.bazel
@@ -70,6 +70,10 @@ assert_contains(
     name = "expand_template_contains",
     actual = "expand_template_test.sh",
     expected = "stuff",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 bzl_library(
diff --git a/lib/tests/assert_contains/BUILD.bazel b/lib/tests/assert_contains/BUILD.bazel
index 1c4234868..83dd2dc0f 100644
--- a/lib/tests/assert_contains/BUILD.bazel
+++ b/lib/tests/assert_contains/BUILD.bazel
@@ -6,16 +6,28 @@ assert_contains(
     name = "regexy-args-1",
     actual = ":case1.txt",
     expected = "--arg1='/{{[{]?(.*?)[}]?}}/'",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 assert_contains(
     name = "regexy-args-2",
     actual = ":case1.txt",
     expected = "--arg2='/{%(.*?)%}/'",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 assert_contains(
     name = "backtick",
     actual = ":case1.txt",
     expected = "`ff`",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
diff --git a/lib/tests/bats/BUILD.bazel b/lib/tests/bats/BUILD.bazel
index 32743c133..81bd00396 100644
--- a/lib/tests/bats/BUILD.bazel
+++ b/lib/tests/bats/BUILD.bazel
@@ -26,6 +26,11 @@ bats_test(
         "basic.bats",
     ],
     args = ["--timing"],
+    # flaky on windows; timeouts
+    target_compatible_with = select({
+        "@platforms//os:windows": ["@platforms//:incompatible"],
+        "//conditions:default": [],
+    }),
 )
 
 bats_test(
@@ -40,6 +45,10 @@ bats_test(
     env = {
         "DATA_PATH": "$(location :data.bin)",
     },
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 bats_test(
diff --git a/lib/tests/copy_directory_bin_action/BUILD.bazel b/lib/tests/copy_directory_bin_action/BUILD.bazel
index f2ee76add..b28f86a76 100644
--- a/lib/tests/copy_directory_bin_action/BUILD.bazel
+++ b/lib/tests/copy_directory_bin_action/BUILD.bazel
@@ -1,9 +1,7 @@
 load("//lib:diff_test.bzl", "diff_test")
 load(":pkg.bzl", "pkg")
 
-not_windows = select({
-    # 2023/10/10 18:59:00 lstat lib\tests\copy_directory_bin_action\d\d\s1 failed:
-    # CreateFile .\1: The system cannot find the file specified.
+NOT_WINDOWS = select({
     "@platforms//os:windows": ["@platforms//:incompatible"],
     "//conditions:default": [],
 })
@@ -12,30 +10,38 @@ pkg(
     name = "pkg",
     src = "d",
     out = "d2",
-    target_compatible_with = not_windows,
+    # TODO: re-enable this test on windows
+    target_compatible_with = NOT_WINDOWS,
 )
 
 pkg(
     name = "pkg2",
     src = "pkg",
     out = "d3",
-    target_compatible_with = not_windows,
+    # TODO: re-enable this test on windows
+    target_compatible_with = NOT_WINDOWS,
 )
 
 diff_test(
     name = "copy_test",
     file1 = ":d",
     file2 = ":pkg",
+    # TODO: re-enable this test on windows
+    target_compatible_with = NOT_WINDOWS,
 )
 
 diff_test(
     name = "hardlink_test",
     file1 = ":d",
     file2 = ":pkg2",
+    # TODO: re-enable this test on windows
+    target_compatible_with = NOT_WINDOWS,
 )
 
 diff_test(
     name = "sanity_test",
     file1 = ":pkg",
     file2 = ":pkg2",
+    # TODO: re-enable this test on windows
+    target_compatible_with = NOT_WINDOWS,
 )
diff --git a/lib/tests/copy_to_directory/BUILD.bazel b/lib/tests/copy_to_directory/BUILD.bazel
index 04f0f8e4a..b9fc24be2 100644
--- a/lib/tests/copy_to_directory/BUILD.bazel
+++ b/lib/tests/copy_to_directory/BUILD.bazel
@@ -151,6 +151,10 @@ copy_to_directory(
     name = "case_6",
     srcs = case_srcs,
     include_external_repositories = ["external_test_repo?"],
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 # TODO: This test is a false positive. sh_test always includes default
diff --git a/lib/tests/copy_to_directory_bin_action/BUILD.bazel b/lib/tests/copy_to_directory_bin_action/BUILD.bazel
index 2b6e40d29..da970d3fb 100644
--- a/lib/tests/copy_to_directory_bin_action/BUILD.bazel
+++ b/lib/tests/copy_to_directory_bin_action/BUILD.bazel
@@ -5,6 +5,11 @@ load("//lib:diff_test.bzl", "diff_test")
 load(":lib.bzl", "lib")
 load(":pkg.bzl", "pkg")
 
+NOT_WINDOWS = select({
+    "@platforms//os:windows": ["@platforms//:incompatible"],
+    "//conditions:default": [],
+})
+
 copy_to_bin(
     name = "copy_1",
     srcs = ["1"],
@@ -47,12 +52,8 @@ pkg(
     out = "pkg",
     # RBE not happy with the symlinks in this test case
     tags = ["no-remote"],
-    target_compatible_with = select({
-        # D:/a/bazel-lib/bazel-lib/lib/tests/copy_to_directory_bin_action/BUILD.bazel:36:4:
-        # declared output 'lib/tests/copy_to_directory_bin_action/pkg_symlink_0' is not a symlink
-        "@platforms//os:windows": ["@platforms//:incompatible"],
-        "//conditions:default": [],
-    }),
+    # TODO: re-enable this test on windows
+    target_compatible_with = NOT_WINDOWS,
     use_declare_symlink = select({
         "//lib/tests:allow_unresolved_symlinks": True,
         "//conditions:default": False,
@@ -65,6 +66,8 @@ diff_test(
     file2 = ":expected_pkg",
     # RBE not happy with the symlinks in this test case
     tags = ["no-remote"],
+    # TODO: re-enable this test on windows
+    target_compatible_with = NOT_WINDOWS,
 )
 
 bzl_library(
diff --git a/lib/tests/coreutils/BUILD.bazel b/lib/tests/coreutils/BUILD.bazel
index 9844d861b..ffeaa3f5a 100644
--- a/lib/tests/coreutils/BUILD.bazel
+++ b/lib/tests/coreutils/BUILD.bazel
@@ -14,11 +14,13 @@ diff_test(
     file2 = ":ls",
 )
 
+# Windows platform writes ' *' between hash and filename; Linux writes '  '.
+# use sed to transform windows output into linux style before assertion.
 genrule(
     name = "sha256sum",
     srcs = ["test.bin"],
     outs = ["sha256sum.txt"],
-    cmd = "$(COREUTILS_BIN) sha256sum $(location :test.bin) > $@",
+    cmd = "$(COREUTILS_BIN) sha256sum $(location :test.bin) | sed 's/ \\*/  /' > $@",
     toolchains = ["@coreutils_toolchains//:resolved_toolchain"],
 )
 
@@ -27,16 +29,18 @@ assert_contains(
     actual = "sha256sum.txt",
     expected = """9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08  lib/tests/coreutils/test.bin""",
     target_compatible_with = select({
-        "@platforms//os:windows": ["@platforms//:incompatible"],
-        "//conditions:default": [],
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
     }),
 )
 
+# Windows platform writes ' *' between hash and filename; Linux writes '  '.
+# use sed to transform windows output into linux style before assertion.
 genrule(
     name = "sha512sum",
     srcs = ["test.bin"],
     outs = ["sha512sum.txt"],
-    cmd = "$(COREUTILS_BIN) sha512sum $(location :test.bin) > $@",
+    cmd = "$(COREUTILS_BIN) sha512sum $(location :test.bin) | sed 's/ \\*/  /' > $@",
     toolchains = ["@coreutils_toolchains//:resolved_toolchain"],
 )
 
@@ -45,8 +49,8 @@ assert_contains(
     actual = "sha512sum.txt",
     expected = """ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff  lib/tests/coreutils/test.bin""",
     target_compatible_with = select({
-        "@platforms//os:windows": ["@platforms//:incompatible"],
-        "//conditions:default": [],
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
     }),
 )
 
@@ -62,4 +66,8 @@ assert_contains(
     name = "test_wc",
     actual = "wc.txt",
     expected = """0 1 4 lib/tests/coreutils/test.bin""",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
diff --git a/lib/tests/expand_template/BUILD.bazel b/lib/tests/expand_template/BUILD.bazel
index 3d22c8667..514cf71df 100644
--- a/lib/tests/expand_template/BUILD.bazel
+++ b/lib/tests/expand_template/BUILD.bazel
@@ -57,6 +57,10 @@ assert_contains(
     name = "default_info_test",
     actual = ":a_tmpl_stamp",
     expected = "WORKSPACE:",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 # No `out` specified, because we don't care what the name of the generated file is.
@@ -73,6 +77,10 @@ assert_contains(
     name = "inline_template_test",
     actual = ":inline_template",
     expected = "line3",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 # When `out` is not specified, the output file is the same name as the template
@@ -89,4 +97,8 @@ assert_contains(
     name = "index_html_out_test",
     actual = ":index_html_out",
     expected = "index.js",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
diff --git a/lib/tests/run_binary/BUILD.bazel b/lib/tests/run_binary/BUILD.bazel
index 60fca4c5f..af0c6484a 100644
--- a/lib/tests/run_binary/BUILD.bazel
+++ b/lib/tests/run_binary/BUILD.bazel
@@ -79,4 +79,8 @@ assert_contains(
     name = "dir_a_rootpath_test",
     actual = ":dir_a_rootpath",
     expected = "lib/tests/run_binary/dir_a_out",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
diff --git a/lib/tests/transitions/BUILD.bazel b/lib/tests/transitions/BUILD.bazel
index 7c65ae57b..d1ccca780 100644
--- a/lib/tests/transitions/BUILD.bazel
+++ b/lib/tests/transitions/BUILD.bazel
@@ -135,7 +135,7 @@ platform_transition_test(
 platform_transition_test(
     name = "transitioned_go_test_arm64",
     binary = ":test_transition_test",
-    # only run this test on an x86_64 host
+    # only run this test on an arm64 host
     target_compatible_with = [] if sorted(HOST_CONSTRAINTS) == [
         "@platforms//cpu:aarch64",
         "@platforms//os:linux",
@@ -152,6 +152,10 @@ sh_test(
         "x86-64",
     ],
     data = [":transitioned_go_binary_x86_64"],
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 sh_test(
@@ -163,6 +167,10 @@ sh_test(
         "aarch64",
     ],
     data = [":transitioned_go_binary_arm64"],
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 sh_test(
@@ -174,6 +182,10 @@ sh_test(
         "x86-64",
     ],
     data = [":transitioned_go_test_x86_64"],
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 sh_test(
diff --git a/lib/tests/write_source_files/BUILD.bazel b/lib/tests/write_source_files/BUILD.bazel
index 949d34d48..818de3734 100644
--- a/lib/tests/write_source_files/BUILD.bazel
+++ b/lib/tests/write_source_files/BUILD.bazel
@@ -118,12 +118,20 @@ write_source_file_test(
     name = "a_test",
     in_file = ":a-desired",
     out_file = "a.js",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 write_source_file_test(
     name = "b_test",
     in_file = ":b-desired",
     out_file = "b.js",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 write_source_file(
@@ -144,12 +152,20 @@ write_source_file_test(
     name = "f_test",
     in_file = ":f-desired",
     out_file = "f.js",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 write_source_file_test(
     name = "g_test",
     in_file = ":g-desired",
     out_file = "g.js",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 write_source_file(
@@ -172,6 +188,10 @@ write_source_files(
         "f2.js": ":f-desired",
         "g2.js": ":g-desired",
     },
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 genrule(
@@ -233,6 +253,10 @@ write_source_file_test(
     check_that_out_file_exists = False,
     in_file = ":a-desired",
     out_file = "//lib/tests/write_source_files/subpkg:a.js",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
 
 # Test that we can write to a parent package
@@ -241,4 +265,8 @@ write_source_file_test(
     check_that_out_file_exists = False,
     in_file = ":a-desired",
     out_file = "//lib/tests:a.js",
+    target_compatible_with = select({
+        "@aspect_bazel_lib//lib:enable_runfiles": [],
+        "//conditions:default": ["@platforms//:incompatible"],
+    }),
 )
diff --git a/lib/tests/write_source_files/write_source_file_test.bzl b/lib/tests/write_source_files/write_source_file_test.bzl
index d24206701..66846a11c 100644
--- a/lib/tests/write_source_files/write_source_file_test.bzl
+++ b/lib/tests/write_source_files/write_source_file_test.bzl
@@ -172,7 +172,7 @@ _write_source_file_test = rule(
     test = True,
 )
 
-def write_source_file_test(name, in_file, out_file, check_that_out_file_exists = True, size = "small"):
+def write_source_file_test(name, in_file, out_file, check_that_out_file_exists = True, size = "small", **kwargs):
     """Stamp a write_source_files executable and a test to run against it"""
 
     _write_source_file(
@@ -191,4 +191,5 @@ def write_source_file_test(name, in_file, out_file, check_that_out_file_exists =
         in_file = in_file,
         out_file = out_file,
         size = size,
+        **kwargs
     )
diff --git a/lib/tests/zstd/BUILD.bazel b/lib/tests/zstd/BUILD.bazel
index aede11376..0c2114b69 100644
--- a/lib/tests/zstd/BUILD.bazel
+++ b/lib/tests/zstd/BUILD.bazel
@@ -7,7 +7,10 @@ genrule(
         "srcfile",
     ],
     outs = ["1.tar.gz"],
-    cmd = "$(BSDTAR_BIN) --create --gzip --dereference --file $@ -s '#$(BINDIR)##' $(execpath srcfile)",
+    cmd = select({
+        "@platforms//os:windows": "$(BSDTAR_BIN) -c -z --dereference --file $@ $(execpath srcfile)",
+        "//conditions:default": "$(BSDTAR_BIN) --create --gzip --dereference --file $@ -s '#$(BINDIR)##' $(execpath srcfile)",
+    }),
     toolchains = ["@bsd_tar_toolchains//:resolved_toolchain"],
 )
 
diff --git a/tools/yq_mirror_release.sh b/tools/yq_mirror_release.sh
index fc8ebe2f3..e550df8f1 100755
--- a/tools/yq_mirror_release.sh
+++ b/tools/yq_mirror_release.sh
@@ -21,7 +21,7 @@ chmod u+x extract-checksum.sh
 
 # Extract the checksums and output a starlark map entry
 echo "\"$version\": {"
-platforms=(darwin_{amd64,arm64} linux_{amd64,arm64,s390x,riscv64,ppc64le} windows_amd64)
+platforms=(darwin_{amd64,arm64} linux_{amd64,arm64,s390x,riscv64,ppc64le} windows_{amd64,arm64})
 for release in ${platforms[@]}; do
   artifact=$release
   if [[ $release == windows* ]]; then