From 080845bdaa84eba9f220d8ae82f41ed3253d341a Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Mon, 15 Dec 2025 14:25:43 +0900
Subject: [PATCH 01/16] Fix Envoy build on Windows

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/BUILD                                   |  9 +++
 bazel/com_google_protoconverter.patch         | 43 +++++++++++++
 bazel/envoy_internal.bzl                      |  8 ++-
 bazel/external/zstd.BUILD                     |  5 +-
 bazel/foreign_cc/BUILD                        | 27 +++++++-
 bazel/foreign_cc/cel-cpp.patch                | 43 +++++++++++++
 bazel/foreign_cc/luajit.patch                 | 64 ++++++++++++++++++-
 bazel/platforms/BUILD                         |  9 +++
 bazel/repo.bzl                                | 49 ++++++++------
 bazel/repositories.bzl                        |  9 +++
 bazel/repository_locations.bzl                | 15 +++++
 envoy/api/os_sys_calls.h                      | 11 ++++
 envoy/common/platform.h                       |  3 +
 source/common/api/win32/os_sys_calls_impl.cc  | 17 ++++-
 source/common/common/win32/thread_impl.cc     |  7 +-
 source/common/common/win32/thread_impl.h      |  2 +-
 source/common/event/win32/signal_impl.cc      |  3 +-
 .../common/filesystem/win32/watcher_impl.cc   |  5 +-
 source/common/memory/aligned_allocator.h      |  4 ++
 .../reverse_connection_address.cc             |  4 ++
 .../reverse_connection_address.h              |  5 ++
 .../reverse_connection_io_handle.cc           | 62 ++++++++++--------
 .../reverse_connection_io_handle.h            |  8 +--
 .../reverse_tunnel_acceptor.h                 |  2 -
 .../reverse_tunnel_acceptor_extension.h       |  2 -
 .../upstream_socket_manager.cc                |  4 ++
 .../upstream_socket_manager.h                 |  2 -
 .../reverse_connection/reverse_connection.h   |  5 ++
 source/extensions/common/aws/BUILD            |  1 +
 source/extensions/dynamic_modules/BUILD       |  7 +-
 .../dynamic_modules/dynamic_modules.cc        | 22 +++++--
 source/server/BUILD                           |  1 +
 tools/BUILD                                   |  6 ++
 tools/gen_dynamic_modules_windows_exports.py  | 28 ++++++++
 34 files changed, 415 insertions(+), 77 deletions(-)
 create mode 100644 tools/gen_dynamic_modules_windows_exports.py

diff --git a/bazel/BUILD b/bazel/BUILD
index 8a3d07e5a414b..6f1be306e0ca6 100644
--- a/bazel/BUILD
+++ b/bazel/BUILD
@@ -68,6 +68,15 @@ genrule(
     stamp = 1,
 )
 
+# For Windows, which must list each exported symbol individually.
+genrule(
+    name = "exported_symbols_windows",
+    srcs = ["//source/extensions/dynamic_modules:abi.h"],
+    outs = ["exported_symbols_windows.def"],
+    cmd = "$(location //tools:gen_dynamic_modules_windows_exports) $(location //source/extensions/dynamic_modules:abi.h) $@",
+    tools = ["//tools:gen_dynamic_modules_windows_exports"],
+)
+
 cc_library(
     name = "static_stdlib",
     linkopts = select({
diff --git a/bazel/com_google_protoconverter.patch b/bazel/com_google_protoconverter.patch
index cb80e7248c52e..efe37515864ac 100644
--- a/bazel/com_google_protoconverter.patch
+++ b/bazel/com_google_protoconverter.patch
@@ -1,3 +1,46 @@
+diff --git a/build_defs/BUILD.bazel b/build_defs/BUILD.bazel
+index 732514d..e8e451e 100644
+--- a/build_defs/BUILD.bazel
++++ b/build_defs/BUILD.bazel
+@@ -14,7 +14,7 @@ package(
+ 
+ create_compiler_config_setting(
+     name = "config_msvc",
+-    value = "msvc-cl",
++    values = ["msvc-cl", "clang-cl"],
+ )
+ 
+ config_setting(
+diff --git a/build_defs/compiler_config_setting.bzl b/build_defs/compiler_config_setting.bzl
+index 0aca1ad..1457298 100644
+--- a/build_defs/compiler_config_setting.bzl
++++ b/build_defs/compiler_config_setting.bzl
+@@ -14,7 +14,7 @@
+ 
+ """Creates config_setting that allows selecting based on 'compiler' value."""
+ 
+-def create_compiler_config_setting(name, value, visibility = None):
++def create_compiler_config_setting(name, values, visibility = None):
+     # The "do_not_use_tools_cpp_compiler_present" attribute exists to
+     # distinguish between older versions of Bazel that do not support
+     # "@bazel_tools//tools/cpp:compiler" flag_value, and newer ones that do.
+@@ -24,14 +24,12 @@ def create_compiler_config_setting(name, value, visibility = None):
+     if hasattr(cc_common, "do_not_use_tools_cpp_compiler_present"):
+         native.config_setting(
+             name = name,
+-            flag_values = {
+-                "@bazel_tools//tools/cpp:compiler": value,
+-            },
++            flag_values = {"@bazel_tools//tools/cpp:compiler": v for v in values},
+             visibility = visibility,
+         )
+     else:
+         native.config_setting(
+             name = name,
+-            values = {"compiler": value},
++            values = {"compiler": v for v in values},
+             visibility = visibility,
+         )
 diff --git a/src/google/protobuf/stubs/BUILD.bazel b/src/google/protobuf/stubs/BUILD.bazel
 index a7b8c82..4f66827 100644
 --- a/src/google/protobuf/stubs/BUILD.bazel
diff --git a/bazel/envoy_internal.bzl b/bazel/envoy_internal.bzl
index f6d6eac6e1591..34ed4e9652c3b 100644
--- a/bazel/envoy_internal.bzl
+++ b/bazel/envoy_internal.bzl
@@ -229,7 +229,10 @@ def envoy_exported_symbols_input():
     return [
         "@envoy//bazel:exported_symbols.txt",
         "@envoy//bazel:exported_symbols_apple.txt",
-    ]
+    ] + select({
+        "@envoy//bazel:windows_x86_64": ["//bazel:exported_symbols_windows.def"],
+        "//conditions:default": [],
+    })
 
 # Default symbols to be exported.
 def _envoy_default_exported_symbols():
@@ -240,6 +243,9 @@ def _envoy_default_exported_symbols():
         "@envoy//bazel:apple": [
             "-Wl,-exported_symbols_list,$(location @envoy//bazel:exported_symbols_apple.txt)",
         ],
+        "@envoy//bazel:windows_x86_64": [
+            "-DEF:$(location //bazel:exported_symbols_windows.def)",
+        ],
         "//conditions:default": [],
     })
 
diff --git a/bazel/external/zstd.BUILD b/bazel/external/zstd.BUILD
index f8b9c939083ae..f1b38493e693a 100644
--- a/bazel/external/zstd.BUILD
+++ b/bazel/external/zstd.BUILD
@@ -54,7 +54,10 @@ cc_library(
         "lib/zstd_errors.h",
     ],
     includes = ["lib"],
-    linkopts = ["-pthread"],
+    linkopts = select({
+        "@platforms//os:windows": [],
+        "//conditions:default": ["-pthread"],
+    }),
     linkstatic = True,
     local_defines = [
         "XXH_NAMESPACE=ZSTD_",
diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD
index 130cf22b78a5f..d196d0defe9dc 100644
--- a/bazel/foreign_cc/BUILD
+++ b/bazel/foreign_cc/BUILD
@@ -103,7 +103,10 @@ cc_library(
 
 configure_make(
     name = "luajit",
-    configure_command = "luajit_build.sh",
+    configure_command = select({
+        "//bazel:windows_x86_64": "luajit_build_win.sh",
+        "//conditions:default": "luajit_build.sh",
+    }),
     env = select({
         # This shouldn't be needed! See
         # https://github.com/envoyproxy/envoy/issues/6084
@@ -446,6 +449,28 @@ envoy_cmake(
     tags = ["skip_on_windows"],
 )
 
+configure_make(
+    name = "dlfcn_win32_build",
+    configure_in_place = True,
+    configure_options = [
+        "--disable-shared",
+        "--enable-static",
+    ],
+    lib_source = "@com_github_dlfcn_win32//:all",
+    out_static_libs = select({
+        "//bazel:windows_x86_64": ["libdl.a"],
+        "//conditions:default": [],
+    }),
+)
+
+cc_library(
+    name = "dlfcn_win32",
+    deps = select({
+        "//bazel:windows_x86_64": [":dlfcn_win32_build"],
+        "//conditions:default": [],
+    }),
+)
+
 envoy_cmake(
     name = "maxmind",
     build_args = select({
diff --git a/bazel/foreign_cc/cel-cpp.patch b/bazel/foreign_cc/cel-cpp.patch
index 9b28219a40d53..ca578965b5728 100644
--- a/bazel/foreign_cc/cel-cpp.patch
+++ b/bazel/foreign_cc/cel-cpp.patch
@@ -1,3 +1,46 @@
+diff --git a/bazel/cel_proto_transitive_descriptor_set.bzl b/bazel/cel_proto_transitive_descriptor_set.bzl
+index e65e0b4a..0e143480 100644
+--- a/bazel/cel_proto_transitive_descriptor_set.bzl
++++ b/bazel/cel_proto_transitive_descriptor_set.bzl
+@@ -21,15 +21,33 @@ load("@com_google_protobuf//bazel/common:proto_info.bzl", "ProtoInfo")
+ def _cel_proto_transitive_descriptor_set(ctx):
+     output = ctx.actions.declare_file(ctx.attr.name + ".binarypb")
+     transitive_descriptor_sets = depset(transitive = [dep[ProtoInfo].transitive_descriptor_sets for dep in ctx.attr.deps])
+-    args = ctx.actions.args()
+-    args.use_param_file(param_file_arg = "%s", use_always = True)
+-    args.add_all(transitive_descriptor_sets)
++
++    # Generate script to concatenate files listed in a parameter file into an output file.
++    script = """
++set -euo pipefail
++PARAMS_FILE="$1"
++OUTPUT_FILE="$2"
++if [ ! -f "$PARAMS_FILE" ]; then
++    echo "Error: Parameter file not found at $PARAMS_FILE" >&2
++    exit 1
++fi
++exec > "$OUTPUT_FILE"
++while IFS= read -r file_to_cat || [[ -n "$file_to_cat" ]]; do
++    if [ -f "$file_to_cat" ]; then
++        cat "$file_to_cat"
++    fi
++done < "$PARAMS_FILE"
++"""
++
++    param_file_args = ctx.actions.args()
++    param_file_args.use_param_file(param_file_arg = "%s", use_always = True)
++    param_file_args.add_all(transitive_descriptor_sets)
+     ctx.actions.run_shell(
+         outputs = [output],
+         inputs = transitive_descriptor_sets,
+         progress_message = "Joining descriptors.",
+-        command = ("< \"$1\" xargs cat >{output}".format(output = output.path)),
+-        arguments = [args],
++        command=script,
++        arguments=[param_file_args, output.path],
+     )
+     return DefaultInfo(
+         files = depset([output]),
 diff --git a/common/internal/byte_string.cc b/common/internal/byte_string.cc
 index b9f47922..9d096424 100644
 --- a/common/internal/byte_string.cc
diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch
index 9e490c1544edc..81b0768b1655b 100644
--- a/bazel/foreign_cc/luajit.patch
+++ b/bazel/foreign_cc/luajit.patch
@@ -53,7 +53,7 @@ index c83abfa0..0276f9e3 100644
  ##############################################################################
 diff --git a/luajit_build.sh b/luajit_build.sh
 new file mode 100755
-index 00000000..3b4f8eca
+index 00000000..8dca96e6
 --- /dev/null
 +++ b/luajit_build.sh
 @@ -0,0 +1,68 @@
@@ -125,3 +125,65 @@ index 00000000..3b4f8eca
 +"${MAKE:-make}" -j$(nproc) V=1 PREFIX="$PREFIX" \
 +  "${EXTRA_MAKE_ARGS[@]}" \
 +  install
+diff --git a/luajit_build_win.sh b/luajit_build_win.sh
+new file mode 100755
+index 00000000..8fb0fbe8
+--- /dev/null
++++ b/luajit_build_win.sh
+@@ -0,0 +1,39 @@
++#!/bin/bash
++
++set -e
++
++PREFIX=""
++while [[ $# -gt 0 ]]; do
++    case $1 in
++        --prefix=*)
++            PREFIX="${1#*=}"
++            shift
++            ;;
++        --prefix)
++            PREFIX="$2"
++            shift 2
++            ;;
++        *)
++            shift
++            ;;
++    esac
++done
++
++# Copy source tree to a build directory
++SRC_DIR="$(dirname "$(realpath "$0")")"
++BUILD_DIR="$(basename "$SRC_DIR")"
++cp -r "$SRC_DIR" "$BUILD_DIR"
++cd "$BUILD_DIR"
++
++ ls
++ cd src
++./msvcbuild.bat static
++
++mkdir -p "$PREFIX/lib"
++cp lua51.lib "$PREFIX/lib"
++mkdir -p "$PREFIX/include/luajit-2.1"
++for header in lauxlib.h luaconf.h lua.h lua.hpp luajit.h lualib.h; do
++    cp "$header" "$PREFIX/include/luajit-2.1"
++done
++mkdir -p "$PREFIX/bin"
++cp luajit.exe "$PREFIX/bin"
+diff --git a/src/msvcbuild.bat b/src/msvcbuild.bat
+index d6aed170..8a86b766 100644
+--- a/src/msvcbuild.bat
++++ b/src/msvcbuild.bat
+@@ -18,9 +18,9 @@
+ @rem Add more debug flags here, e.g. DEBUGCFLAGS=/DLUA_USE_ASSERT
+ @set DEBUGCFLAGS=
+ @set LJCOMPILE=cl /nologo /c /O2 /W3 /D_CRT_SECURE_NO_DEPRECATE /D_CRT_STDIO_INLINE=__declspec(dllexport)__inline
+-@set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MD
+-@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MDd 
+-@set LJCOMPILETARGET=/Zi
++@set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MT
++@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MTd 
++@set LJCOMPILETARGET=/Z7
+ @set LJLINKTYPE=/DEBUG /RELEASE
+ @set LJLINKTYPE_DEBUG=/DEBUG
+ @set LJLINKTARGET=/OPT:REF /OPT:ICF /INCREMENTAL:NO
diff --git a/bazel/platforms/BUILD b/bazel/platforms/BUILD
index f204c7089a027..d522f9cb24cb5 100644
--- a/bazel/platforms/BUILD
+++ b/bazel/platforms/BUILD
@@ -111,3 +111,12 @@ platform(
         "@platforms//os:macos",
     ],
 )
+
+platform(
+    name = "x64_windows-clang-cl",
+    constraint_values = [
+        "@platforms//cpu:x86_64",
+        "@platforms//os:windows",
+        "@bazel_tools//tools/cpp:clang-cl",
+    ],
+)
diff --git a/bazel/repo.bzl b/bazel/repo.bzl
index f1a2547a52e0a..5448f640e362c 100644
--- a/bazel/repo.bzl
+++ b/bazel/repo.bzl
@@ -65,25 +65,36 @@ def _envoy_repo_impl(repository_ctx):
 
     """
 
-    # parse container information for use in RBE
-    json_result = repository_ctx.execute([
-        repository_ctx.path(repository_ctx.attr.yq),
-        repository_ctx.path(repository_ctx.attr.envoy_ci_config),
-        "-ojson",
-    ])
-    if json_result.return_code != 0:
-        fail("yq failed: {}".format(json_result.stderr))
-    repository_ctx.file("ci-config.json", json_result.stdout)
-    config_data = json.decode(repository_ctx.read("ci-config.json"))
-    repository_ctx.file("containers.bzl", CONTAINERS.format(
-        repo = config_data["build-image"]["repo"],
-        repo_gcr = config_data["build-image"]["repo-gcr"],
-        sha = config_data["build-image"]["sha"],
-        sha_gcc = config_data["build-image"]["sha-gcc"],
-        sha_mobile = config_data["build-image"]["sha-mobile"],
-        sha_worker = config_data["build-image"]["sha-worker"],
-        tag = config_data["build-image"]["tag"],
-    ))
+    if repository_ctx.os.name.lower().find("windows") == -1:
+        json_result = repository_ctx.execute([
+            repository_ctx.path(repository_ctx.attr.yq),
+            repository_ctx.path(repository_ctx.attr.envoy_ci_config),
+            "-ojson",
+        ])
+        if json_result.return_code != 0:
+            fail("yq failed: {}".format(json_result.stderr))
+        repository_ctx.file("ci-config.json", json_result.stdout)
+        config_data = json.decode(repository_ctx.read("ci-config.json"))
+        repository_ctx.file("containers.bzl", CONTAINERS.format(
+            repo = config_data["build-image"]["repo"],
+            repo_gcr = config_data["build-image"]["repo-gcr"],
+            sha = config_data["build-image"]["sha"],
+            sha_gcc = config_data["build-image"]["sha-gcc"],
+            sha_mobile = config_data["build-image"]["sha-mobile"],
+            sha_worker = config_data["build-image"]["sha-worker"],
+            tag = config_data["build-image"]["tag"],
+        ))
+    else:
+        # yq via bazel doesn't work on Windows, but we don't need the file either
+        repository_ctx.file("containers.bzl", CONTAINERS.format(
+            repo = "",
+            repo_gcr = "",
+            sha = "",
+            sha_gcc = "",
+            sha_mobile = "",
+            sha_worker = "",
+            tag = "",
+        ))
     repo_version_path = repository_ctx.path(repository_ctx.attr.envoy_version)
     api_version_path = repository_ctx.path(repository_ctx.attr.envoy_api_version)
     version = repository_ctx.read(repo_version_path).strip()
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 86ffd5ef3dcef..8ecc81a5654cc 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -13,6 +13,8 @@ WINDOWS_SKIP_TARGETS = [
     "envoy.filters.http.sxg",
     "envoy.tracers.dynamic_ot",
     "envoy.tracers.datadog",
+    # Only implemented for Linux.
+    "envoy.resource_monitors.cpu_utilization",
     # Extensions that require CEL.
     "envoy.access_loggers.extension_filters.cel",
     "envoy.rate_limit_descriptors.expr",
@@ -215,6 +217,7 @@ def envoy_dependencies(skip_targets = []):
     external_http_archive("envoy_examples")
     external_http_archive("envoy_toolshed")
 
+    _com_github_dlfcn_win32()
     _com_github_maxmind_libmaxminddb()
 
     external_http_archive("rules_license")
@@ -918,3 +921,9 @@ def _com_github_maxmind_libmaxminddb():
         name = "com_github_maxmind_libmaxminddb",
         build_file_content = BUILD_ALL_CONTENT,
     )
+
+def _com_github_dlfcn_win32():
+    external_http_archive(
+        name = "com_github_dlfcn_win32",
+        build_file_content = BUILD_ALL_CONTENT,
+    )
diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index d5df43825bd60..d5568a7b7a4b6 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -1683,6 +1683,21 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         license = "Apache-2.0",
         license_url = "https://github.com/bazelbuild/rules_license/blob/{version}/LICENSE",
     ),
+    com_github_dlfcn_win32 = dict(
+        project_name = "dlfcn-win32",
+        project_desc = "An implementation of dlfcn for Windows.",
+        project_url = "https://github.com/dlfcn-win32/dlfcn-win32",
+        version = "1.4.2",
+        sha256 = "f61a874bc9163ab488accb364fd681d109870c86e8071f4710cbcdcbaf9f2565",
+        strip_prefix = "dlfcn-win32-{version}",
+        urls = ["https://github.com/dlfcn-win32/dlfcn-win32/archive/refs/tags/v{version}.tar.gz"],
+        use_category = ["dataplane_ext"],
+        extensions = ["envoy.filters.http.dynamic_modules"],
+        release_date = "2025-03-05",
+        cpe = "N/A",
+        license = "MIT",
+        license_url = "https://github.com/dlfcn-win32/dlfcn-win32/blob/v{version}/COPYING",
+    ),
     com_github_maxmind_libmaxminddb = dict(
         project_name = "maxmind_libmaxminddb",
         project_desc = "C library for reading MaxMind DB files",
diff --git a/envoy/api/os_sys_calls.h b/envoy/api/os_sys_calls.h
index 08f2227c4f564..85f6c25af3a0b 100644
--- a/envoy/api/os_sys_calls.h
+++ b/envoy/api/os_sys_calls.h
@@ -1,6 +1,9 @@
 #pragma once
 
+#ifndef _WIN32
 #include <sys/resource.h>
+
+#endif
 #include <sys/stat.h>
 
 #include <chrono>
@@ -13,6 +16,14 @@
 #include "envoy/common/pure.h"
 #include "envoy/network/address.h"
 
+#ifdef _WIN32
+struct rlimit {
+  int rlim_cur;
+  int rlim_max;
+};
+#define RLIMIT_NOFILE 7
+#endif // _WIN32
+
 namespace Envoy {
 namespace Api {
 
diff --git a/envoy/common/platform.h b/envoy/common/platform.h
index 42075f881f80d..58a4c15ae8614 100644
--- a/envoy/common/platform.h
+++ b/envoy/common/platform.h
@@ -69,11 +69,14 @@ typedef DWORD signal_t;            // NOLINT(modernize-use-using)
 
 typedef unsigned int sa_family_t;
 
+#ifndef _STRUCT_IOVEC
 // Posix structure for scatter/gather I/O, not present on Windows.
 struct iovec {
   void* iov_base;
   size_t iov_len;
 };
+#define _STRUCT_IOVEC
+#endif // _STRUCT_IOVEC
 
 // Posix structure for describing messages sent by 'sendmsg` and received by
 // 'recvmsg'
diff --git a/source/common/api/win32/os_sys_calls_impl.cc b/source/common/api/win32/os_sys_calls_impl.cc
index 7fda90aa08814..dc32868f62574 100644
--- a/source/common/api/win32/os_sys_calls_impl.cc
+++ b/source/common/api/win32/os_sys_calls_impl.cc
@@ -10,6 +10,14 @@
 
 #define DWORD_MAX UINT32_MAX
 
+#ifndef SIO_SET_RECV_IP_ECN
+#define SIO_SET_RECV_IP_ECN _WSAIOW(IOC_VENDOR, 12)
+#endif
+
+#ifndef SIO_GET_RECV_IP_ECN
+#define SIO_GET_RECV_IP_ECN _WSAIOR(IOC_VENDOR, 13)
+#endif
+
 namespace Envoy {
 namespace Api {
 namespace {
@@ -245,7 +253,10 @@ SysCallIntResult OsSysCallsImpl::fstat(os_fd_t fd, struct stat* buf) {
 SysCallIntResult OsSysCallsImpl::setsockopt(os_fd_t sockfd, int level, int optname,
                                             const void* optval, socklen_t optlen) {
   if (optname == IP_RECVTOS || optname == IPV6_RECVTCLASS) {
-    const int rc = ::WSASetRecvIPEcn(sockfd, *(int*)optval == 1);
+    DWORD enabled = (*(int*)optval == 1) ? 1 : 0;
+    DWORD bytes_returned;
+    const int rc = ::WSAIoctl(sockfd, SIO_SET_RECV_IP_ECN, &enabled, sizeof(enabled), nullptr, 0,
+                              &bytes_returned, nullptr, nullptr);
     return {rc, rc != -1 ? 0 : ::WSAGetLastError()};
   }
   const int rc = ::setsockopt(sockfd, level, optname, static_cast<const char*>(optval), optlen);
@@ -255,7 +266,9 @@ SysCallIntResult OsSysCallsImpl::setsockopt(os_fd_t sockfd, int level, int optna
 SysCallIntResult OsSysCallsImpl::getsockopt(os_fd_t sockfd, int level, int optname, void* optval,
                                             socklen_t* optlen) {
   if (optname == IP_RECVTOS || optname == IPV6_RECVTCLASS) {
-    const int rc = ::WSAGetRecvIPEcn(sockfd, (DWORD*)optval);
+    DWORD bytes_returned;
+    const int rc = ::WSAIoctl(sockfd, SIO_GET_RECV_IP_ECN, nullptr, 0, optval, sizeof(DWORD),
+                              &bytes_returned, nullptr, nullptr);
     return {rc, rc != -1 ? 0 : ::WSAGetLastError()};
   }
   const int rc = ::getsockopt(sockfd, level, optname, static_cast<char*>(optval), optlen);
diff --git a/source/common/common/win32/thread_impl.cc b/source/common/common/win32/thread_impl.cc
index c1beac6a52905..c98902b2e3844 100644
--- a/source/common/common/win32/thread_impl.cc
+++ b/source/common/common/win32/thread_impl.cc
@@ -22,9 +22,8 @@ ThreadImplWin32::ThreadImplWin32(std::function<void()> thread_routine, OptionsOp
         return 0;
       },
       this, 0, nullptr));
-  if (options && options.thread_priority_ &&
-      !SetThreadPriority(thread_handle_, *options.thread_priority_)) {
-    ENVOY_LOG_MISC(warn, "Could not set the thread priority to {}", *options.thread_priority_);
+  if (options && options->priority_ && !SetThreadPriority(thread_handle_, *options->priority_)) {
+    ENVOY_LOG_MISC(warn, "Could not set the thread priority to {}", *options->priority_);
   }
   RELEASE_ASSERT(thread_handle_ != 0, "");
 }
@@ -41,7 +40,7 @@ ThreadPtr ThreadFactoryImplWin32::createThread(std::function<void()> thread_rout
   return std::make_unique<ThreadImplWin32>(thread_routine, options);
 }
 
-ThreadId ThreadFactoryImplWin32::currentThreadId() {
+ThreadId ThreadFactoryImplWin32::currentThreadId() const {
   // TODO(mhoran): test this in windows please.
   return ThreadId(static_cast<int64_t>(::GetCurrentThreadId()));
 }
diff --git a/source/common/common/win32/thread_impl.h b/source/common/common/win32/thread_impl.h
index 87be085291c86..d40a6b0c6b878 100644
--- a/source/common/common/win32/thread_impl.h
+++ b/source/common/common/win32/thread_impl.h
@@ -37,7 +37,7 @@ class ThreadFactoryImplWin32 : public ThreadFactory {
 public:
   // Thread::ThreadFactory
   ThreadPtr createThread(std::function<void()> thread_routine, OptionsOptConstRef options) override;
-  ThreadId currentThreadId() override;
+  ThreadId currentThreadId() const override;
 };
 
 } // namespace Thread
diff --git a/source/common/event/win32/signal_impl.cc b/source/common/event/win32/signal_impl.cc
index 0466ee6b732f0..8cdc1b2510607 100644
--- a/source/common/event/win32/signal_impl.cc
+++ b/source/common/event/win32/signal_impl.cc
@@ -32,9 +32,10 @@ SignalEventImpl::SignalEventImpl(DispatcherImpl& dispatcher, signal_t signal_num
 
   read_handle_->initializeFileEvent(
       dispatcher,
-      [this](uint32_t events) -> void {
+      [this](uint32_t events) -> absl::Status {
         ASSERT(events == Event::FileReadyType::Read);
         cb_();
+        return absl::OkStatus();
       },
       Event::FileTriggerType::Level, Event::FileReadyType::Read);
   eventBridgeHandlersSingleton::get()[signal_num] = write_handle;
diff --git a/source/common/filesystem/win32/watcher_impl.cc b/source/common/filesystem/win32/watcher_impl.cc
index 58905d996d22c..833d657ac255c 100644
--- a/source/common/filesystem/win32/watcher_impl.cc
+++ b/source/common/filesystem/win32/watcher_impl.cc
@@ -22,9 +22,10 @@ WatcherImpl::WatcherImpl(Event::Dispatcher& dispatcher, Filesystem::Instance& fi
 
   read_handle_->initializeFileEvent(
       dispatcher,
-      [this](uint32_t events) -> void {
+      [this](uint32_t events) -> absl::Status {
         ASSERT(events == Event::FileReadyType::Read);
         onDirectoryEvent();
+        return absl::OkStatus();
       },
       Event::FileTriggerType::Level, Event::FileReadyType::Read);
 
@@ -203,7 +204,7 @@ void WatcherImpl::directoryChangeCompletion(DWORD err, DWORD num_bytes, LPOVERLA
       if (watch.file_ == file && (watch.events_ & events)) {
         ENVOY_LOG(debug, "matched callback: file: {}", watcher->wstring_converter_.to_bytes(file));
         const auto cb = watch.cb_;
-        const auto cb_closure = [cb, events]() -> void { cb(events); };
+        const auto cb_closure = [cb, events]() -> void { (void)cb(events); };
         watcher->active_callbacks_.push(cb_closure);
         // write a byte to the other end of the socket that libevent is watching
         // this tells the libevent callback to pull this callback off the active_callbacks_
diff --git a/source/common/memory/aligned_allocator.h b/source/common/memory/aligned_allocator.h
index f45e7f74b2263..f715987527fcc 100644
--- a/source/common/memory/aligned_allocator.h
+++ b/source/common/memory/aligned_allocator.h
@@ -45,6 +45,8 @@ template <typename T, std::size_t Alignment> class AlignedAllocator {
       return nullptr;
     }
     return static_cast<T*>(ptr);
+#elif defined(_WIN32)
+    return static_cast<T*>(_aligned_malloc(bytes, Alignment));
 #else
     // Ensure bytes is a multiple of Alignment, which is required by std::aligned_alloc.
     bytes = round_up_to_alignment(bytes);
@@ -56,6 +58,8 @@ template <typename T, std::size_t Alignment> class AlignedAllocator {
     if (p != nullptr) {
 #ifdef ALIGNED_ALLOCATOR_USE_POSIX_MEMALIGN
       free(p);
+#elif defined(_WIN32)
+      _aligned_free(p);
 #else
       std::free(p);
 #endif
diff --git a/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.cc b/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.cc
index dcf868020fb5c..4104956251edb 100644
--- a/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.cc
+++ b/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.cc
@@ -1,8 +1,12 @@
 #include "source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.h"
 
+#ifndef _WIN32
 #include <arpa/inet.h>
 #include <netinet/in.h>
 #include <sys/socket.h>
+#else
+#include <winsock2.h>
+#endif // _WIN32
 
 #include <cstring>
 #include <functional>
diff --git a/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.h b/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.h
index dac27da17d40e..914315e4c574f 100644
--- a/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.h
+++ b/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_address.h
@@ -1,8 +1,13 @@
 #pragma once
 
+#ifndef _WIN32
 #include <netinet/in.h>
 #include <sys/socket.h>
 
+#else
+#include <winsock2.h>
+#endif // _WIN32
+
 #include <functional>
 
 #include "envoy/network/address.h"
diff --git a/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_io_handle.cc b/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_io_handle.cc
index 751857d7140f9..8ab47295eb3be 100644
--- a/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_io_handle.cc
+++ b/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_io_handle.cc
@@ -10,6 +10,7 @@
 #include "envoy/network/connection.h"
 #include "envoy/upstream/cluster_manager.h"
 
+#include "source/common/api/os_sys_calls_impl.h"
 #include "source/common/buffer/buffer_impl.h"
 #include "source/common/common/logger.h"
 #include "source/common/event/real_time_system.h"
@@ -56,13 +57,14 @@ void ReverseConnectionIOHandle::cleanup() {
                  "reverse_tunnel: cleaning up trigger pipe; "
                  "trigger_pipe_write_fd_={}, trigger_pipe_read_fd_={}",
                  trigger_pipe_write_fd_, trigger_pipe_read_fd_);
-  if (trigger_pipe_write_fd_ >= 0) {
-    ::close(trigger_pipe_write_fd_);
-    trigger_pipe_write_fd_ = -1;
+  auto& os_sys_calls = Api::OsSysCallsSingleton::get();
+  if (trigger_pipe_write_fd_ != INVALID_SOCKET) {
+    os_sys_calls.close(trigger_pipe_write_fd_);
+    trigger_pipe_write_fd_ = INVALID_SOCKET;
   }
-  if (trigger_pipe_read_fd_ >= 0) {
-    ::close(trigger_pipe_read_fd_);
-    trigger_pipe_read_fd_ = -1;
+  if (trigger_pipe_read_fd_ != INVALID_SOCKET) {
+    os_sys_calls.close(trigger_pipe_read_fd_);
+    trigger_pipe_read_fd_ = INVALID_SOCKET;
   }
 
   // Cancel the retry timer safely.
@@ -163,8 +165,8 @@ void ReverseConnectionIOHandle::initializeFileEvent(Event::Dispatcher& dispatche
 
   // Replace the monitored FD with pipe read FD
   // This must happen before any event registration.
-  int trigger_fd = getPipeMonitorFd();
-  if (trigger_fd != -1) {
+  os_fd_t trigger_fd = getPipeMonitorFd();
+  if (trigger_fd != INVALID_SOCKET) {
     ENVOY_LOG(info, "Replacing monitored FD from {} to pipe read FD {}", fd_, trigger_fd);
     fd_ = trigger_fd;
   }
@@ -190,7 +192,9 @@ Envoy::Network::IoHandlePtr ReverseConnectionIOHandle::accept(struct sockaddr* a
   ENVOY_LOG(debug, "reverse_tunnel: accept() called");
   if (isTriggerPipeReady()) {
     char trigger_byte;
-    ssize_t bytes_read = ::read(trigger_pipe_read_fd_, &trigger_byte, 1);
+    auto& os_sys_calls = Api::OsSysCallsSingleton::get();
+    ssize_t bytes_read =
+        os_sys_calls.recv(trigger_pipe_read_fd_, &trigger_byte, 1, 0).return_value_;
     if (bytes_read == 1) {
       ENVOY_LOG(debug, "reverse_tunnel: received trigger, processing connection.");
       // When a connection is established, a byte is written to the trigger_pipe_write_fd_ and the
@@ -361,7 +365,7 @@ void ReverseConnectionIOHandle::onEvent(Network::ConnectionEvent event) {
   ENVOY_LOG(trace, "reverse_tunnel: event: {}", static_cast<int>(event));
 }
 
-int ReverseConnectionIOHandle::getPipeMonitorFd() const { return trigger_pipe_read_fd_; }
+os_fd_t ReverseConnectionIOHandle::getPipeMonitorFd() const { return trigger_pipe_read_fd_; }
 
 // Get time source for consistent time operations.
 TimeSource& ReverseConnectionIOHandle::getTimeSource() const {
@@ -1015,30 +1019,32 @@ bool ReverseConnectionIOHandle::initiateOneReverseConnection(const std::string&
 // Trigger pipe used to wake up accept() when a connection is established.
 void ReverseConnectionIOHandle::createTriggerPipe() {
   ENVOY_LOG(debug, "reverse_tunnel: Creating trigger pipe for single-byte mechanism");
-  int pipe_fds[2];
-  if (pipe(pipe_fds) == -1) {
-    ENVOY_LOG(error, "Failed to create trigger pipe: {}", errorDetails(errno));
-    trigger_pipe_read_fd_ = -1;
-    trigger_pipe_write_fd_ = -1;
+  os_fd_t pipe_fds[2];
+  auto& os_sys_calls = Api::OsSysCallsSingleton::get();
+#ifdef _WIN32
+  // On Windows, we use AF_INET to emulate a pipe with a TCP socket pair.
+  const int domain = AF_INET;
+#else
+  const int domain = AF_UNIX;
+#endif // _WIN32
+  auto result = os_sys_calls.socketpair(domain, SOCK_STREAM, 0, pipe_fds);
+  if (result.return_value_ != 0) {
+    ENVOY_LOG(error, "Failed to create trigger pipe: {}", errorDetails(result.errno_));
+    trigger_pipe_read_fd_ = INVALID_SOCKET;
+    trigger_pipe_write_fd_ = INVALID_SOCKET;
     return;
   }
   trigger_pipe_read_fd_ = pipe_fds[0];
   trigger_pipe_write_fd_ = pipe_fds[1];
   // Make both ends non-blocking.
-  int flags = fcntl(trigger_pipe_write_fd_, F_GETFL, 0);
-  if (flags != -1) {
-    fcntl(trigger_pipe_write_fd_, F_SETFL, flags | O_NONBLOCK);
-  }
-  flags = fcntl(trigger_pipe_read_fd_, F_GETFL, 0);
-  if (flags != -1) {
-    fcntl(trigger_pipe_read_fd_, F_SETFL, flags | O_NONBLOCK);
-  }
+  os_sys_calls.setsocketblocking(trigger_pipe_write_fd_, false);
+  os_sys_calls.setsocketblocking(trigger_pipe_read_fd_, false);
   ENVOY_LOG(debug, "reverse_tunnel: Created trigger pipe: read_fd={}, write_fd={}",
             trigger_pipe_read_fd_, trigger_pipe_write_fd_);
 }
 
 bool ReverseConnectionIOHandle::isTriggerPipeReady() const {
-  return trigger_pipe_read_fd_ != -1 && trigger_pipe_write_fd_ != -1;
+  return trigger_pipe_read_fd_ != INVALID_SOCKET && trigger_pipe_write_fd_ != INVALID_SOCKET;
 }
 
 void ReverseConnectionIOHandle::onConnectionDone(const std::string& error,
@@ -1185,14 +1191,16 @@ void ReverseConnectionIOHandle::onConnectionDone(const std::string& error,
       // Trigger accept mechanism safely.
       if (isTriggerPipeReady()) {
         char trigger_byte = 1;
-        ssize_t bytes_written = ::write(trigger_pipe_write_fd_, &trigger_byte, 1);
-        if (bytes_written == 1) {
+        auto& os_sys_calls = Api::OsSysCallsSingleton::get();
+        auto result = os_sys_calls.send(trigger_pipe_write_fd_, &trigger_byte, 1, 0);
+        if (result.return_value_ == 1) {
           ENVOY_LOG(info,
                     "reverse_tunnel: Successfully triggered reverse_conn_listener "
                     "accept() for host {}",
                     host_address);
         } else {
-          ENVOY_LOG(error, "reverse_tunnel: Failed to write trigger byte: {}", errorDetails(errno));
+          ENVOY_LOG(error, "reverse_tunnel: Failed to write trigger byte: {}",
+                    errorDetails(result.errno_));
         }
       }
     }
diff --git a/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_io_handle.h b/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_io_handle.h
index 9d13e36f2ecdd..0143f2e466e4b 100644
--- a/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_io_handle.h
+++ b/source/extensions/bootstrap/reverse_tunnel/downstream_socket_interface/reverse_connection_io_handle.h
@@ -205,7 +205,7 @@ class ReverseConnectionIOHandle : public Network::IoSocketHandleImpl,
    * Get the file descriptor for the pipe monitor used to wake up accept().
    * @return the file descriptor for the pipe monitor
    */
-  int getPipeMonitorFd() const;
+  os_fd_t getPipeMonitorFd() const;
 
   // Callbacks from RCConnectionWrapper.
   /**
@@ -406,8 +406,8 @@ class ReverseConnectionIOHandle : public Network::IoSocketHandleImpl,
 
   // Simple pipe-based trigger mechanism to wake up accept() when a connection is established.
   // Inlined directly for simplicity and reduced test coverage requirements.
-  int trigger_pipe_read_fd_{-1};
-  int trigger_pipe_write_fd_{-1};
+  os_fd_t trigger_pipe_read_fd_{INVALID_SOCKET};
+  os_fd_t trigger_pipe_write_fd_{INVALID_SOCKET};
 
   // Connection management : We store the established connections in a queue.
   // and pop the last established connection when data is read on trigger_pipe_read_fd_
@@ -422,7 +422,7 @@ class ReverseConnectionIOHandle : public Network::IoSocketHandleImpl,
   Event::Dispatcher* worker_dispatcher_{nullptr}; // Dispatcher for the worker thread
 
   // Store original socket FD for cleanup.
-  os_fd_t original_socket_fd_{-1};
+  os_fd_t original_socket_fd_{static_cast<os_fd_t>(-1)};
 };
 
 } // namespace ReverseConnection
diff --git a/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/reverse_tunnel_acceptor.h b/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/reverse_tunnel_acceptor.h
index b5437525439c2..fdb98e0624378 100644
--- a/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/reverse_tunnel_acceptor.h
+++ b/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/reverse_tunnel_acceptor.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <unistd.h>
-
 #include <atomic>
 #include <cstdint>
 
diff --git a/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/reverse_tunnel_acceptor_extension.h b/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/reverse_tunnel_acceptor_extension.h
index 2f16d81f8c72e..15ab6d45ce256 100644
--- a/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/reverse_tunnel_acceptor_extension.h
+++ b/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/reverse_tunnel_acceptor_extension.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <unistd.h>
-
 #include <atomic>
 #include <cstdint>
 
diff --git a/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/upstream_socket_manager.cc b/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/upstream_socket_manager.cc
index 822ce649a2e28..bfe5f123e00e1 100644
--- a/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/upstream_socket_manager.cc
+++ b/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/upstream_socket_manager.cc
@@ -291,7 +291,11 @@ void UpstreamSocketManager::markSocketDead(const int fd) {
       // Found the FD in idle pool, this is an idle socket.
       ENVOY_LOG(debug, "reverse_tunnel: marking idle socket dead. node: {} cluster: {} fd: {}.",
                 node_id, cluster_id, fd);
+#ifndef _WIN32
       ::shutdown(fd, SHUT_RDWR);
+#else
+      ::shutdown(fd, SD_BOTH);
+#endif // _WIN32
       itr = sockets.erase(itr);
       is_idle_socket = true;
 
diff --git a/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/upstream_socket_manager.h b/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/upstream_socket_manager.h
index 95e3e898aa3a8..4eba23c6c1633 100644
--- a/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/upstream_socket_manager.h
+++ b/source/extensions/bootstrap/reverse_tunnel/upstream_socket_interface/upstream_socket_manager.h
@@ -1,7 +1,5 @@
 #pragma once
 
-#include <unistd.h>
-
 #include <atomic>
 #include <cstdint>
 #include <list>
diff --git a/source/extensions/clusters/reverse_connection/reverse_connection.h b/source/extensions/clusters/reverse_connection/reverse_connection.h
index f45aad8707687..9d7106ff4467e 100644
--- a/source/extensions/clusters/reverse_connection/reverse_connection.h
+++ b/source/extensions/clusters/reverse_connection/reverse_connection.h
@@ -1,8 +1,13 @@
 #pragma once
 
+#ifndef _WIN32
 #include <netinet/in.h>
 #include <sys/socket.h>
 
+#else
+#include <winsock2.h>
+#endif // _WIN32
+
 #include <cstdint>
 #include <cstring>
 #include <functional>
diff --git a/source/extensions/common/aws/BUILD b/source/extensions/common/aws/BUILD
index c5cc8c00200e5..799ad67102e17 100644
--- a/source/extensions/common/aws/BUILD
+++ b/source/extensions/common/aws/BUILD
@@ -77,6 +77,7 @@ envoy_cc_library(
     ],
     deps = [
         "//envoy/common:pure_lib",
+        "//envoy/common:time_interface",
         "//source/common/common:cleanup_lib",
         "//source/common/common:lock_guard_lib",
         "//source/common/common:thread_lib",
diff --git a/source/extensions/dynamic_modules/BUILD b/source/extensions/dynamic_modules/BUILD
index dc0b799a35b14..ff35ea3d124d7 100644
--- a/source/extensions/dynamic_modules/BUILD
+++ b/source/extensions/dynamic_modules/BUILD
@@ -18,7 +18,10 @@ envoy_cc_library(
     deps = [
         ":abi_version_lib",
         "//envoy/common:exception_lib",
-    ],
+    ] + select({
+        "//bazel:windows_x86_64": ["//bazel/foreign_cc:dlfcn_win32"],
+        "//conditions:default": [],
+    }),
 )
 
 envoy_cc_library(
@@ -27,3 +30,5 @@ envoy_cc_library(
         "abi_version.h",
     ],
 )
+
+exports_files(["abi.h"])
diff --git a/source/extensions/dynamic_modules/dynamic_modules.cc b/source/extensions/dynamic_modules/dynamic_modules.cc
index f07d6a23b10ec..dd178e0892d37 100644
--- a/source/extensions/dynamic_modules/dynamic_modules.cc
+++ b/source/extensions/dynamic_modules/dynamic_modules.cc
@@ -23,14 +23,18 @@ newDynamicModule(const std::filesystem::path& object_file_absolute_path, const b
   // > This can be used to test if the object is already resident (dlopen() returns NULL if it
   // > is not, or the object's handle if it is resident).
   //
+  void* handle = nullptr;
+#ifndef _WIN32
   // So we can use RTLD_NOLOAD to check if the module is already loaded to avoid the duplicate call
-  // to the init function.
-  void* handle = dlopen(object_file_absolute_path.c_str(), RTLD_NOLOAD | RTLD_LAZY);
+  // to the init function. Because Windows doesn't support RTLD_NOLOAD, modules that support it
+  // will need to have idempotent init functions.
+  handle = dlopen(object_file_absolute_path.string().c_str(), RTLD_NOLOAD | RTLD_LAZY);
   if (handle != nullptr) {
     // This means the module is already loaded, and the return value is the handle of the already
     // loaded module. We don't need to call the init function again.
     return std::make_unique<DynamicModule>(handle);
   }
+#endif // _WIN32
   // RTLD_LAZY is required for not only performance but also simply to load the module, otherwise
   // dlopen results in Invalid argument.
   int mode = RTLD_LAZY;
@@ -40,13 +44,15 @@ newDynamicModule(const std::filesystem::path& object_file_absolute_path, const b
     // RTLD_LOCAL is used by default to avoid collisions between multiple modules.
     mode |= RTLD_LOCAL;
   }
+#ifndef _WIN32
   if (do_not_close) {
     mode |= RTLD_NODELETE;
   }
-  handle = dlopen(object_file_absolute_path.c_str(), mode);
+#endif // _WIN32
+  handle = dlopen(object_file_absolute_path.string().c_str(), mode);
   if (handle == nullptr) {
     return absl::InvalidArgumentError(absl::StrCat(
-        "Failed to load dynamic module: ", object_file_absolute_path.c_str(), " : ", dlerror()));
+        "Failed to load dynamic module: ", object_file_absolute_path.string(), " : ", dlerror()));
   }
 
   DynamicModulePtr dynamic_module = std::make_unique<DynamicModule>(handle);
@@ -62,14 +68,14 @@ newDynamicModule(const std::filesystem::path& object_file_absolute_path, const b
   const char* abi_version = (*init_function.value())();
   if (abi_version == nullptr) {
     return absl::InvalidArgumentError(
-        absl::StrCat("Failed to initialize dynamic module: ", object_file_absolute_path.c_str()));
+        absl::StrCat("Failed to initialize dynamic module: ", object_file_absolute_path.string()));
   }
   // Checks the kAbiVersion and the version of the dynamic module.
   if (absl::string_view(abi_version) != absl::string_view(kAbiVersion)) {
     return absl::InvalidArgumentError(
         absl::StrCat("ABI version mismatch: got ", abi_version, ", but expected ", kAbiVersion));
   }
-  return dynamic_module;
+  return std::move(dynamic_module);
 }
 
 absl::StatusOr<DynamicModulePtr> newDynamicModuleByName(const absl::string_view module_name,
@@ -82,7 +88,11 @@ absl::StatusOr<DynamicModulePtr> newDynamicModuleByName(const absl::string_view
                                                    " is not set"));
   }
   const std::filesystem::path file_path_absolute =
+#ifndef _WIN32
       std::filesystem::absolute(fmt::format("{}/lib{}.so", module_search_path, module_name));
+#else
+      std::filesystem::absolute(fmt::format("{}/{}.dll", module_search_path, module_name));
+#endif // _WIN32
   return newDynamicModule(file_path_absolute, do_not_close, load_globally);
 }
 
diff --git a/source/server/BUILD b/source/server/BUILD
index c0246b1758b5e..df1af5bd0cc89 100644
--- a/source/server/BUILD
+++ b/source/server/BUILD
@@ -239,6 +239,7 @@ envoy_cc_library(
         "//envoy/filesystem:filesystem_interface",
         "//source/common/common:logger_lib",
         "//source/common/filesystem:filesystem_lib",
+        "//source/common/singleton:threadsafe_singleton",
         "@com_google_absl//absl/strings",
         "@com_google_absl//absl/types:optional",
     ],
diff --git a/tools/BUILD b/tools/BUILD
index a34039b363a9d..2ad4ec01bfdb7 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -7,6 +7,12 @@ exports_files([
     "check_repositories.sh",
 ])
 
+py_binary(
+    name = "gen_dynamic_modules_windows_exports",
+    srcs = ["gen_dynamic_modules_windows_exports.py"],
+    visibility = ["//visibility:public"],
+)
+
 py_binary(
     name = "stack_decode",
     srcs = ["stack_decode.py"],
diff --git a/tools/gen_dynamic_modules_windows_exports.py b/tools/gen_dynamic_modules_windows_exports.py
new file mode 100644
index 0000000000000..30248f5e6c681
--- /dev/null
+++ b/tools/gen_dynamic_modules_windows_exports.py
@@ -0,0 +1,28 @@
+import re
+import sys
+
+def main():
+    if len(sys.argv) != 3:
+        print("Usage: gen_dynamic_modules_def.py <input_header> <output_def>")
+        sys.exit(1)
+
+    input_header = sys.argv[1]
+    output_def = sys.argv[2]
+
+    with open(input_header, 'r') as f:
+        content = f.read()
+
+    # Find all function declarations starting with envoy_dynamic_module_callback_
+    # Example: void envoy_dynamic_module_callback_http_get_header(
+    matches = re.findall(r'\b(envoy_dynamic_module_callback_\w+)\(', content)
+
+    # Remove duplicates and sort
+    symbols = sorted(list(set(matches)))
+
+    with open(output_def, 'w') as f:
+        f.write("EXPORTS\n")
+        for symbol in symbols:
+            f.write(f"    {symbol}\n")
+
+if __name__ == "__main__":
+    main()

From 6fcbc41d459a8e558d476d0d6b680e0ffac65ac5 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Thu, 18 Dec 2025 17:11:37 +0900
Subject: [PATCH 02/16] Remove redundant move

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 source/extensions/dynamic_modules/dynamic_modules.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/source/extensions/dynamic_modules/dynamic_modules.cc b/source/extensions/dynamic_modules/dynamic_modules.cc
index dd178e0892d37..4c9cb5325f9d9 100644
--- a/source/extensions/dynamic_modules/dynamic_modules.cc
+++ b/source/extensions/dynamic_modules/dynamic_modules.cc
@@ -75,7 +75,7 @@ newDynamicModule(const std::filesystem::path& object_file_absolute_path, const b
     return absl::InvalidArgumentError(
         absl::StrCat("ABI version mismatch: got ", abi_version, ", but expected ", kAbiVersion));
   }
-  return std::move(dynamic_module);
+  return dynamic_module;
 }
 
 absl::StatusOr<DynamicModulePtr> newDynamicModuleByName(const absl::string_view module_name,

From 8b02976c8661ad1fa8125c12b762eea596b6c98c Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Thu, 18 Dec 2025 18:00:16 +0900
Subject: [PATCH 03/16] Lints

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/repository_locations.bzl               | 2 +-
 tools/gen_dynamic_modules_windows_exports.py | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)
 mode change 100644 => 100755 tools/gen_dynamic_modules_windows_exports.py

diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index d5568a7b7a4b6..9ce997afb65ec 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -1693,7 +1693,7 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         urls = ["https://github.com/dlfcn-win32/dlfcn-win32/archive/refs/tags/v{version}.tar.gz"],
         use_category = ["dataplane_ext"],
         extensions = ["envoy.filters.http.dynamic_modules"],
-        release_date = "2025-03-05",
+        release_date = "2025-03-04",
         cpe = "N/A",
         license = "MIT",
         license_url = "https://github.com/dlfcn-win32/dlfcn-win32/blob/v{version}/COPYING",
diff --git a/tools/gen_dynamic_modules_windows_exports.py b/tools/gen_dynamic_modules_windows_exports.py
old mode 100644
new mode 100755
index 30248f5e6c681..ca0cea8e2e7bf
--- a/tools/gen_dynamic_modules_windows_exports.py
+++ b/tools/gen_dynamic_modules_windows_exports.py
@@ -1,6 +1,7 @@
 import re
 import sys
 
+
 def main():
     if len(sys.argv) != 3:
         print("Usage: gen_dynamic_modules_def.py <input_header> <output_def>")
@@ -24,5 +25,6 @@ def main():
         for symbol in symbols:
             f.write(f"    {symbol}\n")
 
+
 if __name__ == "__main__":
     main()

From cd0e20dadc25b9906d5acdbb27a9a5cfdd3a34d3 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Fri, 19 Dec 2025 13:10:05 +0900
Subject: [PATCH 04/16] Simplify cel-cpp patch

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/foreign_cc/cel-cpp.patch | 41 +++++-----------------------------
 1 file changed, 5 insertions(+), 36 deletions(-)

diff --git a/bazel/foreign_cc/cel-cpp.patch b/bazel/foreign_cc/cel-cpp.patch
index ca578965b5728..81aeb08405cbd 100644
--- a/bazel/foreign_cc/cel-cpp.patch
+++ b/bazel/foreign_cc/cel-cpp.patch
@@ -1,43 +1,12 @@
 diff --git a/bazel/cel_proto_transitive_descriptor_set.bzl b/bazel/cel_proto_transitive_descriptor_set.bzl
-index e65e0b4a..0e143480 100644
+index e65e0b4a..18837236 100644
 --- a/bazel/cel_proto_transitive_descriptor_set.bzl
 +++ b/bazel/cel_proto_transitive_descriptor_set.bzl
-@@ -21,15 +21,33 @@ load("@com_google_protobuf//bazel/common:proto_info.bzl", "ProtoInfo")
- def _cel_proto_transitive_descriptor_set(ctx):
-     output = ctx.actions.declare_file(ctx.attr.name + ".binarypb")
-     transitive_descriptor_sets = depset(transitive = [dep[ProtoInfo].transitive_descriptor_sets for dep in ctx.attr.deps])
--    args = ctx.actions.args()
--    args.use_param_file(param_file_arg = "%s", use_always = True)
--    args.add_all(transitive_descriptor_sets)
-+
-+    # Generate script to concatenate files listed in a parameter file into an output file.
-+    script = """
-+set -euo pipefail
-+PARAMS_FILE="$1"
-+OUTPUT_FILE="$2"
-+if [ ! -f "$PARAMS_FILE" ]; then
-+    echo "Error: Parameter file not found at $PARAMS_FILE" >&2
-+    exit 1
-+fi
-+exec > "$OUTPUT_FILE"
-+while IFS= read -r file_to_cat || [[ -n "$file_to_cat" ]]; do
-+    if [ -f "$file_to_cat" ]; then
-+        cat "$file_to_cat"
-+    fi
-+done < "$PARAMS_FILE"
-+"""
-+
-+    param_file_args = ctx.actions.args()
-+    param_file_args.use_param_file(param_file_arg = "%s", use_always = True)
-+    param_file_args.add_all(transitive_descriptor_sets)
-     ctx.actions.run_shell(
-         outputs = [output],
-         inputs = transitive_descriptor_sets,
+@@ -30,6 +30,7 @@ def _cel_proto_transitive_descriptor_set(ctx):
          progress_message = "Joining descriptors.",
--        command = ("< \"$1\" xargs cat >{output}".format(output = output.path)),
--        arguments = [args],
-+        command=script,
-+        arguments=[param_file_args, output.path],
+         command = ("< \"$1\" xargs cat >{output}".format(output = output.path)),
+         arguments = [args],
++        use_default_shell_env = True,
      )
      return DefaultInfo(
          files = depset([output]),

From d42ba513a57ac07e2b8428d6880aae77ebb59947 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Fri, 19 Dec 2025 13:11:11 +0900
Subject: [PATCH 05/16] Simplify protoconverter patch

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/com_google_protoconverter.patch | 56 ++++++++++-----------------
 1 file changed, 21 insertions(+), 35 deletions(-)

diff --git a/bazel/com_google_protoconverter.patch b/bazel/com_google_protoconverter.patch
index efe37515864ac..c7fb4e62e8aa2 100644
--- a/bazel/com_google_protoconverter.patch
+++ b/bazel/com_google_protoconverter.patch
@@ -1,46 +1,32 @@
 diff --git a/build_defs/BUILD.bazel b/build_defs/BUILD.bazel
-index 732514d..e8e451e 100644
+index 732514d..a6be18b 100644
 --- a/build_defs/BUILD.bazel
 +++ b/build_defs/BUILD.bazel
-@@ -14,7 +14,7 @@ package(
+@@ -13,10 +13,23 @@ package(
+ )
  
  create_compiler_config_setting(
-     name = "config_msvc",
--    value = "msvc-cl",
-+    values = ["msvc-cl", "clang-cl"],
+-    name = "config_msvc",
++    name = "config_msvc_cl",
+     value = "msvc-cl",
  )
  
++create_compiler_config_setting(
++    name = "config_clang_cl",
++    value = "clang-cl",
++)
++
++selects.config_setting_group(
++    name = "config_msvc",
++    match_any = [
++        ":config_clang_cl",
++        ":config_msvc_cl",
++    ],
++)
++
  config_setting(
-diff --git a/build_defs/compiler_config_setting.bzl b/build_defs/compiler_config_setting.bzl
-index 0aca1ad..1457298 100644
---- a/build_defs/compiler_config_setting.bzl
-+++ b/build_defs/compiler_config_setting.bzl
-@@ -14,7 +14,7 @@
- 
- """Creates config_setting that allows selecting based on 'compiler' value."""
- 
--def create_compiler_config_setting(name, value, visibility = None):
-+def create_compiler_config_setting(name, values, visibility = None):
-     # The "do_not_use_tools_cpp_compiler_present" attribute exists to
-     # distinguish between older versions of Bazel that do not support
-     # "@bazel_tools//tools/cpp:compiler" flag_value, and newer ones that do.
-@@ -24,14 +24,12 @@ def create_compiler_config_setting(name, value, visibility = None):
-     if hasattr(cc_common, "do_not_use_tools_cpp_compiler_present"):
-         native.config_setting(
-             name = name,
--            flag_values = {
--                "@bazel_tools//tools/cpp:compiler": value,
--            },
-+            flag_values = {"@bazel_tools//tools/cpp:compiler": v for v in values},
-             visibility = visibility,
-         )
-     else:
-         native.config_setting(
-             name = name,
--            values = {"compiler": value},
-+            values = {"compiler": v for v in values},
-             visibility = visibility,
-         )
+     name = "aarch64",
+     values = {"cpu": "linux-aarch_64"},
 diff --git a/src/google/protobuf/stubs/BUILD.bazel b/src/google/protobuf/stubs/BUILD.bazel
 index a7b8c82..4f66827 100644
 --- a/src/google/protobuf/stubs/BUILD.bazel

From e0bfb72a40aca40fc5f12574fb7b0235d22be264 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Fri, 19 Dec 2025 13:23:22 +0900
Subject: [PATCH 06/16] Move script to windows folder

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/BUILD                                            |  4 ++--
 tools/BUILD                                            |  2 +-
 tools/windows/BUILD                                    | 10 ++++++++++
 .../gen_dynamic_modules_exports.py}                    |  0
 4 files changed, 13 insertions(+), 3 deletions(-)
 create mode 100644 tools/windows/BUILD
 rename tools/{gen_dynamic_modules_windows_exports.py => windows/gen_dynamic_modules_exports.py} (100%)

diff --git a/bazel/BUILD b/bazel/BUILD
index 6f1be306e0ca6..5c4c427771ab7 100644
--- a/bazel/BUILD
+++ b/bazel/BUILD
@@ -73,8 +73,8 @@ genrule(
     name = "exported_symbols_windows",
     srcs = ["//source/extensions/dynamic_modules:abi.h"],
     outs = ["exported_symbols_windows.def"],
-    cmd = "$(location //tools:gen_dynamic_modules_windows_exports) $(location //source/extensions/dynamic_modules:abi.h) $@",
-    tools = ["//tools:gen_dynamic_modules_windows_exports"],
+    cmd = "$(location //tools/windows:gen_dynamic_modules_exports) $(location //source/extensions/dynamic_modules:abi.h) $@",
+    tools = ["//tools/windows:gen_dynamic_modules_exports"],
 )
 
 cc_library(
diff --git a/tools/BUILD b/tools/BUILD
index 2ad4ec01bfdb7..ab69a695efdc7 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -9,7 +9,7 @@ exports_files([
 
 py_binary(
     name = "gen_dynamic_modules_windows_exports",
-    srcs = ["gen_dynamic_modules_windows_exports.py"],
+    srcs = ["windows/gen_dynamic_modules_exports.py"],
     visibility = ["//visibility:public"],
 )
 
diff --git a/tools/windows/BUILD b/tools/windows/BUILD
new file mode 100644
index 0000000000000..33a598f5ea407
--- /dev/null
+++ b/tools/windows/BUILD
@@ -0,0 +1,10 @@
+load("@rules_python//python:defs.bzl", "py_binary")
+
+licenses(["notice"])  # Apache 2
+
+
+py_binary(
+    name = "gen_dynamic_modules_exports",
+    srcs = ["gen_dynamic_modules_exports.py"],
+    visibility = ["//visibility:public"],
+)
diff --git a/tools/gen_dynamic_modules_windows_exports.py b/tools/windows/gen_dynamic_modules_exports.py
similarity index 100%
rename from tools/gen_dynamic_modules_windows_exports.py
rename to tools/windows/gen_dynamic_modules_exports.py

From 4d1fee3300c23af564be59b8eea695c9aa7ba68b Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Fri, 19 Dec 2025 14:13:32 +0900
Subject: [PATCH 07/16] Simplify luajit patch

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/foreign_cc/luajit.patch | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch
index 81b0768b1655b..71b8acda198a0 100644
--- a/bazel/foreign_cc/luajit.patch
+++ b/bazel/foreign_cc/luajit.patch
@@ -127,10 +127,10 @@ index 00000000..8dca96e6
 +  install
 diff --git a/luajit_build_win.sh b/luajit_build_win.sh
 new file mode 100755
-index 00000000..8fb0fbe8
+index 00000000..c6267893
 --- /dev/null
 +++ b/luajit_build_win.sh
-@@ -0,0 +1,39 @@
+@@ -0,0 +1,38 @@
 +#!/bin/bash
 +
 +set -e
@@ -158,8 +158,7 @@ index 00000000..8fb0fbe8
 +cp -r "$SRC_DIR" "$BUILD_DIR"
 +cd "$BUILD_DIR"
 +
-+ ls
-+ cd src
++cd src
 +./msvcbuild.bat static
 +
 +mkdir -p "$PREFIX/lib"
@@ -171,18 +170,16 @@ index 00000000..8fb0fbe8
 +mkdir -p "$PREFIX/bin"
 +cp luajit.exe "$PREFIX/bin"
 diff --git a/src/msvcbuild.bat b/src/msvcbuild.bat
-index d6aed170..8a86b766 100644
+index d6aed170..67c255ab 100644
 --- a/src/msvcbuild.bat
 +++ b/src/msvcbuild.bat
-@@ -18,9 +18,9 @@
- @rem Add more debug flags here, e.g. DEBUGCFLAGS=/DLUA_USE_ASSERT
+@@ -19,8 +19,8 @@
  @set DEBUGCFLAGS=
  @set LJCOMPILE=cl /nologo /c /O2 /W3 /D_CRT_SECURE_NO_DEPRECATE /D_CRT_STDIO_INLINE=__declspec(dllexport)__inline
--@set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MD
+ @set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MD
 -@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MDd 
 -@set LJCOMPILETARGET=/Zi
-+@set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MT
-+@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MTd 
++@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MDd
 +@set LJCOMPILETARGET=/Z7
  @set LJLINKTYPE=/DEBUG /RELEASE
  @set LJLINKTYPE_DEBUG=/DEBUG

From 2ce46e62d07b44e58a5445ea6534c22643c916c2 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Fri, 19 Dec 2025 14:14:34 +0900
Subject: [PATCH 08/16] Formatting

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 tools/windows/BUILD | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/windows/BUILD b/tools/windows/BUILD
index 33a598f5ea407..7ddee365b9048 100644
--- a/tools/windows/BUILD
+++ b/tools/windows/BUILD
@@ -2,7 +2,6 @@ load("@rules_python//python:defs.bzl", "py_binary")
 
 licenses(["notice"])  # Apache 2
 
-
 py_binary(
     name = "gen_dynamic_modules_exports",
     srcs = ["gen_dynamic_modules_exports.py"],

From e05b8fdc246942dd4c6d7a4153cbccebfb7aa207 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Fri, 19 Dec 2025 14:16:02 +0900
Subject: [PATCH 09/16] Preserve trailing whitespace

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/foreign_cc/luajit.patch | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch
index 71b8acda198a0..4ad9a031a63b6 100644
--- a/bazel/foreign_cc/luajit.patch
+++ b/bazel/foreign_cc/luajit.patch
@@ -170,16 +170,14 @@ index 00000000..c6267893
 +mkdir -p "$PREFIX/bin"
 +cp luajit.exe "$PREFIX/bin"
 diff --git a/src/msvcbuild.bat b/src/msvcbuild.bat
-index d6aed170..67c255ab 100644
+index d6aed170..44afb72e 100644
 --- a/src/msvcbuild.bat
 +++ b/src/msvcbuild.bat
-@@ -19,8 +19,8 @@
- @set DEBUGCFLAGS=
+@@ -20,7 +20,7 @@
  @set LJCOMPILE=cl /nologo /c /O2 /W3 /D_CRT_SECURE_NO_DEPRECATE /D_CRT_STDIO_INLINE=__declspec(dllexport)__inline
  @set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MD
--@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MDd 
+ @set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MDd 
 -@set LJCOMPILETARGET=/Zi
-+@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MDd
 +@set LJCOMPILETARGET=/Z7
  @set LJLINKTYPE=/DEBUG /RELEASE
  @set LJLINKTYPE_DEBUG=/DEBUG

From f1dc4f8c6a5734055be10808a1c034f6893a7d25 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Fri, 19 Dec 2025 14:59:07 +0900
Subject: [PATCH 10/16] luajit incremental link

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/foreign_cc/luajit.patch | 17 ++---------------
 1 file changed, 2 insertions(+), 15 deletions(-)

diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch
index 4ad9a031a63b6..39bcbf3c59795 100644
--- a/bazel/foreign_cc/luajit.patch
+++ b/bazel/foreign_cc/luajit.patch
@@ -127,7 +127,7 @@ index 00000000..8dca96e6
 +  install
 diff --git a/luajit_build_win.sh b/luajit_build_win.sh
 new file mode 100755
-index 00000000..c6267893
+index 00000000..a493e7e0
 --- /dev/null
 +++ b/luajit_build_win.sh
 @@ -0,0 +1,38 @@
@@ -162,23 +162,10 @@ index 00000000..c6267893
 +./msvcbuild.bat static
 +
 +mkdir -p "$PREFIX/lib"
-+cp lua51.lib "$PREFIX/lib"
++cp lua51.lib vc140.pdb "$PREFIX/lib"
 +mkdir -p "$PREFIX/include/luajit-2.1"
 +for header in lauxlib.h luaconf.h lua.h lua.hpp luajit.h lualib.h; do
 +    cp "$header" "$PREFIX/include/luajit-2.1"
 +done
 +mkdir -p "$PREFIX/bin"
 +cp luajit.exe "$PREFIX/bin"
-diff --git a/src/msvcbuild.bat b/src/msvcbuild.bat
-index d6aed170..44afb72e 100644
---- a/src/msvcbuild.bat
-+++ b/src/msvcbuild.bat
-@@ -20,7 +20,7 @@
- @set LJCOMPILE=cl /nologo /c /O2 /W3 /D_CRT_SECURE_NO_DEPRECATE /D_CRT_STDIO_INLINE=__declspec(dllexport)__inline
- @set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MD
- @set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MDd 
--@set LJCOMPILETARGET=/Zi
-+@set LJCOMPILETARGET=/Z7
- @set LJLINKTYPE=/DEBUG /RELEASE
- @set LJLINKTYPE_DEBUG=/DEBUG
- @set LJLINKTARGET=/OPT:REF /OPT:ICF /INCREMENTAL:NO

From db16aa1c1ff2f90cd521f4dd40151fcfa4477ab1 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Fri, 19 Dec 2025 15:14:55 +0900
Subject: [PATCH 11/16] Remove leftover rule

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 tools/BUILD | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/tools/BUILD b/tools/BUILD
index ab69a695efdc7..a34039b363a9d 100644
--- a/tools/BUILD
+++ b/tools/BUILD
@@ -7,12 +7,6 @@ exports_files([
     "check_repositories.sh",
 ])
 
-py_binary(
-    name = "gen_dynamic_modules_windows_exports",
-    srcs = ["windows/gen_dynamic_modules_exports.py"],
-    visibility = ["//visibility:public"],
-)
-
 py_binary(
     name = "stack_decode",
     srcs = ["stack_decode.py"],

From c6f5fc6cdd6debb792837ab392a8472e2780fb22 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Tue, 6 Jan 2026 15:09:21 +0900
Subject: [PATCH 12/16] Add network filter to dep allowlist.

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/repository_locations.bzl | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/bazel/repository_locations.bzl b/bazel/repository_locations.bzl
index 93be4369626fb..ae2fff29389ee 100644
--- a/bazel/repository_locations.bzl
+++ b/bazel/repository_locations.bzl
@@ -1692,7 +1692,11 @@ REPOSITORY_LOCATIONS_SPEC = dict(
         strip_prefix = "dlfcn-win32-{version}",
         urls = ["https://github.com/dlfcn-win32/dlfcn-win32/archive/refs/tags/v{version}.tar.gz"],
         use_category = ["dataplane_ext"],
-        extensions = ["envoy.filters.http.dynamic_modules"],
+        extensions = [
+            "envoy.filters.http.dynamic_modules",
+            "envoy.filters.listener.dynamic_modules",
+            "envoy.filters.network.dynamic_modules",
+        ],
         release_date = "2025-03-04",
         cpe = "N/A",
         license = "MIT",

From e04dab66776273e9d17c288e5d19bc39bb4c9cd3 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Wed, 7 Jan 2026 10:41:11 +0900
Subject: [PATCH 13/16] Separate windows patches

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/com_google_protoconverter.patch     | 29 --------------
 bazel/com_google_protoconverter_win.patch | 29 ++++++++++++++
 bazel/foreign_cc/BUILD                    |  2 +
 bazel/foreign_cc/cel-cpp.patch            | 12 ------
 bazel/foreign_cc/luajit.patch             | 46 +----------------------
 bazel/foreign_cc/luajit_win.patch         | 44 ++++++++++++++++++++++
 bazel/repositories.bzl                    | 10 ++++-
 7 files changed, 84 insertions(+), 88 deletions(-)
 create mode 100644 bazel/com_google_protoconverter_win.patch
 create mode 100644 bazel/foreign_cc/luajit_win.patch

diff --git a/bazel/com_google_protoconverter.patch b/bazel/com_google_protoconverter.patch
index c7fb4e62e8aa2..cb80e7248c52e 100644
--- a/bazel/com_google_protoconverter.patch
+++ b/bazel/com_google_protoconverter.patch
@@ -1,32 +1,3 @@
-diff --git a/build_defs/BUILD.bazel b/build_defs/BUILD.bazel
-index 732514d..a6be18b 100644
---- a/build_defs/BUILD.bazel
-+++ b/build_defs/BUILD.bazel
-@@ -13,10 +13,23 @@ package(
- )
- 
- create_compiler_config_setting(
--    name = "config_msvc",
-+    name = "config_msvc_cl",
-     value = "msvc-cl",
- )
- 
-+create_compiler_config_setting(
-+    name = "config_clang_cl",
-+    value = "clang-cl",
-+)
-+
-+selects.config_setting_group(
-+    name = "config_msvc",
-+    match_any = [
-+        ":config_clang_cl",
-+        ":config_msvc_cl",
-+    ],
-+)
-+
- config_setting(
-     name = "aarch64",
-     values = {"cpu": "linux-aarch_64"},
 diff --git a/src/google/protobuf/stubs/BUILD.bazel b/src/google/protobuf/stubs/BUILD.bazel
 index a7b8c82..4f66827 100644
 --- a/src/google/protobuf/stubs/BUILD.bazel
diff --git a/bazel/com_google_protoconverter_win.patch b/bazel/com_google_protoconverter_win.patch
new file mode 100644
index 0000000000000..853d5b57e28e5
--- /dev/null
+++ b/bazel/com_google_protoconverter_win.patch
@@ -0,0 +1,29 @@
+diff --git a/build_defs/BUILD.bazel b/build_defs/BUILD.bazel
+index 732514d..a6be18b 100644
+--- a/build_defs/BUILD.bazel
++++ b/build_defs/BUILD.bazel
+@@ -13,10 +13,23 @@ package(
+ )
+ 
+ create_compiler_config_setting(
+-    name = "config_msvc",
++    name = "config_msvc_cl",
+     value = "msvc-cl",
+ )
+ 
++create_compiler_config_setting(
++    name = "config_clang_cl",
++    value = "clang-cl",
++)
++
++selects.config_setting_group(
++    name = "config_msvc",
++    match_any = [
++        ":config_clang_cl",
++        ":config_msvc_cl",
++    ],
++)
++
+ config_setting(
+     name = "aarch64",
+     values = {"cpu": "linux-aarch_64"},
diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD
index d196d0defe9dc..de85d8b7a06d7 100644
--- a/bazel/foreign_cc/BUILD
+++ b/bazel/foreign_cc/BUILD
@@ -41,6 +41,7 @@ configure_make(
         "skip_on_windows",
     ],
     targets = ["install"],
+    target_compatible_with = ["@platforms//os:linux"],
 )
 
 envoy_cc_library(
@@ -461,6 +462,7 @@ configure_make(
         "//bazel:windows_x86_64": ["libdl.a"],
         "//conditions:default": [],
     }),
+    target_compatible_with = ["@platforms//os:windows"],
 )
 
 cc_library(
diff --git a/bazel/foreign_cc/cel-cpp.patch b/bazel/foreign_cc/cel-cpp.patch
index 81aeb08405cbd..9b28219a40d53 100644
--- a/bazel/foreign_cc/cel-cpp.patch
+++ b/bazel/foreign_cc/cel-cpp.patch
@@ -1,15 +1,3 @@
-diff --git a/bazel/cel_proto_transitive_descriptor_set.bzl b/bazel/cel_proto_transitive_descriptor_set.bzl
-index e65e0b4a..18837236 100644
---- a/bazel/cel_proto_transitive_descriptor_set.bzl
-+++ b/bazel/cel_proto_transitive_descriptor_set.bzl
-@@ -30,6 +30,7 @@ def _cel_proto_transitive_descriptor_set(ctx):
-         progress_message = "Joining descriptors.",
-         command = ("< \"$1\" xargs cat >{output}".format(output = output.path)),
-         arguments = [args],
-+        use_default_shell_env = True,
-     )
-     return DefaultInfo(
-         files = depset([output]),
 diff --git a/common/internal/byte_string.cc b/common/internal/byte_string.cc
 index b9f47922..9d096424 100644
 --- a/common/internal/byte_string.cc
diff --git a/bazel/foreign_cc/luajit.patch b/bazel/foreign_cc/luajit.patch
index 39bcbf3c59795..9e490c1544edc 100644
--- a/bazel/foreign_cc/luajit.patch
+++ b/bazel/foreign_cc/luajit.patch
@@ -53,7 +53,7 @@ index c83abfa0..0276f9e3 100644
  ##############################################################################
 diff --git a/luajit_build.sh b/luajit_build.sh
 new file mode 100755
-index 00000000..8dca96e6
+index 00000000..3b4f8eca
 --- /dev/null
 +++ b/luajit_build.sh
 @@ -0,0 +1,68 @@
@@ -125,47 +125,3 @@ index 00000000..8dca96e6
 +"${MAKE:-make}" -j$(nproc) V=1 PREFIX="$PREFIX" \
 +  "${EXTRA_MAKE_ARGS[@]}" \
 +  install
-diff --git a/luajit_build_win.sh b/luajit_build_win.sh
-new file mode 100755
-index 00000000..a493e7e0
---- /dev/null
-+++ b/luajit_build_win.sh
-@@ -0,0 +1,38 @@
-+#!/bin/bash
-+
-+set -e
-+
-+PREFIX=""
-+while [[ $# -gt 0 ]]; do
-+    case $1 in
-+        --prefix=*)
-+            PREFIX="${1#*=}"
-+            shift
-+            ;;
-+        --prefix)
-+            PREFIX="$2"
-+            shift 2
-+            ;;
-+        *)
-+            shift
-+            ;;
-+    esac
-+done
-+
-+# Copy source tree to a build directory
-+SRC_DIR="$(dirname "$(realpath "$0")")"
-+BUILD_DIR="$(basename "$SRC_DIR")"
-+cp -r "$SRC_DIR" "$BUILD_DIR"
-+cd "$BUILD_DIR"
-+
-+cd src
-+./msvcbuild.bat static
-+
-+mkdir -p "$PREFIX/lib"
-+cp lua51.lib vc140.pdb "$PREFIX/lib"
-+mkdir -p "$PREFIX/include/luajit-2.1"
-+for header in lauxlib.h luaconf.h lua.h lua.hpp luajit.h lualib.h; do
-+    cp "$header" "$PREFIX/include/luajit-2.1"
-+done
-+mkdir -p "$PREFIX/bin"
-+cp luajit.exe "$PREFIX/bin"
diff --git a/bazel/foreign_cc/luajit_win.patch b/bazel/foreign_cc/luajit_win.patch
new file mode 100644
index 0000000000000..6907431d4e5df
--- /dev/null
+++ b/bazel/foreign_cc/luajit_win.patch
@@ -0,0 +1,44 @@
+diff --git a/luajit_build_win.sh b/luajit_build_win.sh
+new file mode 100755
+index 00000000..a493e7e0
+--- /dev/null
++++ b/luajit_build_win.sh
+@@ -0,0 +1,38 @@
++#!/bin/bash
++
++set -e
++
++PREFIX=""
++while [[ $# -gt 0 ]]; do
++    case $1 in
++        --prefix=*)
++            PREFIX="${1#*=}"
++            shift
++            ;;
++        --prefix)
++            PREFIX="$2"
++            shift 2
++            ;;
++        *)
++            shift
++            ;;
++    esac
++done
++
++# Copy source tree to a build directory
++SRC_DIR="$(dirname "$(realpath "$0")")"
++BUILD_DIR="$(basename "$SRC_DIR")"
++cp -r "$SRC_DIR" "$BUILD_DIR"
++cd "$BUILD_DIR"
++
++cd src
++./msvcbuild.bat static
++
++mkdir -p "$PREFIX/lib"
++cp lua51.lib vc140.pdb "$PREFIX/lib"
++mkdir -p "$PREFIX/include/luajit-2.1"
++for header in lauxlib.h luaconf.h lua.h lua.hpp luajit.h lualib.h; do
++    cp "$header" "$PREFIX/include/luajit-2.1"
++done
++mkdir -p "$PREFIX/bin"
++cp luajit.exe "$PREFIX/bin"
diff --git a/bazel/repositories.bzl b/bazel/repositories.bzl
index 54a85279ba8bb..25761ce4bcc8b 100644
--- a/bazel/repositories.bzl
+++ b/bazel/repositories.bzl
@@ -83,7 +83,10 @@ def _cc_deps():
     external_http_archive(
         name = "com_google_protoconverter",
         patch_args = ["-p1"],
-        patches = ["@envoy//bazel:com_google_protoconverter.patch"],
+        patches = [
+            "@envoy//bazel:com_google_protoconverter.patch",
+            "@envoy//bazel:com_google_protoconverter_win.patch",
+        ],
         patch_cmds = [
             "rm src/google/protobuf/stubs/common.cc",
             "rm src/google/protobuf/stubs/common.h",
@@ -808,7 +811,10 @@ def _com_github_luajit_luajit():
     external_http_archive(
         name = "com_github_luajit_luajit",
         build_file_content = BUILD_ALL_CONTENT,
-        patches = ["@envoy//bazel/foreign_cc:luajit.patch"],
+        patches = [
+            "@envoy//bazel/foreign_cc:luajit.patch",
+            "@envoy//bazel/foreign_cc:luajit_win.patch",
+        ],
         patch_args = ["-p1"],
     )
 

From 376665904c7e6a52cd4cc4a5a1f86e016819b7ed Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Wed, 7 Jan 2026 11:02:15 +0900
Subject: [PATCH 14/16] Cleanup containers.bzl

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/repo.bzl | 49 +++++++++++++++++++++++++++++--------------------
 1 file changed, 29 insertions(+), 20 deletions(-)

diff --git a/bazel/repo.bzl b/bazel/repo.bzl
index 5448f640e362c..0ebadc128ea33 100644
--- a/bazel/repo.bzl
+++ b/bazel/repo.bzl
@@ -65,6 +65,17 @@ def _envoy_repo_impl(repository_ctx):
 
     """
 
+    repo = ""
+    repo_gcr = ""
+    sha = ""
+    sha_gcc = ""
+    sha_mobile = ""
+    sha_worker = ""
+    tag = ""
+
+    # yq via bazel doesn't work on Windows, but we don't need the real flag_values
+    # there either. For this and other reasons, ideally we could parse YAML directly.
+    # https://github.com/bazelbuild/bazel/issues/24766
     if repository_ctx.os.name.lower().find("windows") == -1:
         json_result = repository_ctx.execute([
             repository_ctx.path(repository_ctx.attr.yq),
@@ -75,26 +86,24 @@ def _envoy_repo_impl(repository_ctx):
             fail("yq failed: {}".format(json_result.stderr))
         repository_ctx.file("ci-config.json", json_result.stdout)
         config_data = json.decode(repository_ctx.read("ci-config.json"))
-        repository_ctx.file("containers.bzl", CONTAINERS.format(
-            repo = config_data["build-image"]["repo"],
-            repo_gcr = config_data["build-image"]["repo-gcr"],
-            sha = config_data["build-image"]["sha"],
-            sha_gcc = config_data["build-image"]["sha-gcc"],
-            sha_mobile = config_data["build-image"]["sha-mobile"],
-            sha_worker = config_data["build-image"]["sha-worker"],
-            tag = config_data["build-image"]["tag"],
-        ))
-    else:
-        # yq via bazel doesn't work on Windows, but we don't need the file either
-        repository_ctx.file("containers.bzl", CONTAINERS.format(
-            repo = "",
-            repo_gcr = "",
-            sha = "",
-            sha_gcc = "",
-            sha_mobile = "",
-            sha_worker = "",
-            tag = "",
-        ))
+        repo = config_data["build-image"]["repo"]
+        repo_gcr = config_data["build-image"]["repo-gcr"]
+        sha = config_data["build-image"]["sha"]
+        sha_gcc = config_data["build-image"]["sha-gcc"]
+        sha_mobile = config_data["build-image"]["sha-mobile"]
+        sha_worker = config_data["build-image"]["sha-worker"]
+        tag = config_data["build-image"]["tag"]
+
+    repository_ctx.file("containers.bzl", CONTAINERS.format(
+        repo = repo,
+        repo_gcr = repo_gcr,
+        sha = sha,
+        sha_gcc = sha_gcc,
+        sha_mobile = sha_mobile,
+        sha_worker = sha_worker,
+        tag = tag,
+    ))
+
     repo_version_path = repository_ctx.path(repository_ctx.attr.envoy_version)
     api_version_path = repository_ctx.path(repository_ctx.attr.envoy_api_version)
     version = repository_ctx.read(repo_version_path).strip()

From 95bb385109a9ea68b0452d2ecdbae76e93133b97 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Wed, 7 Jan 2026 11:57:04 +0900
Subject: [PATCH 15/16] Formatting

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/foreign_cc/BUILD | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bazel/foreign_cc/BUILD b/bazel/foreign_cc/BUILD
index de85d8b7a06d7..902e893ad2cc4 100644
--- a/bazel/foreign_cc/BUILD
+++ b/bazel/foreign_cc/BUILD
@@ -40,8 +40,8 @@ configure_make(
         "nocompdb",
         "skip_on_windows",
     ],
-    targets = ["install"],
     target_compatible_with = ["@platforms//os:linux"],
+    targets = ["install"],
 )
 
 envoy_cc_library(

From a60d4d55e1b3d1e99ca34107222438eec717fdb8 Mon Sep 17 00:00:00 2001
From: Anuraag Agrawal <anuraaga@gmail.com>
Date: Wed, 7 Jan 2026 14:32:04 +0900
Subject: [PATCH 16/16] Restore luajit compile flags

Signed-off-by: Anuraag Agrawal <anuraaga@gmail.com>
---
 bazel/foreign_cc/luajit_win.patch | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/bazel/foreign_cc/luajit_win.patch b/bazel/foreign_cc/luajit_win.patch
index 6907431d4e5df..bba8b0d19b0ba 100644
--- a/bazel/foreign_cc/luajit_win.patch
+++ b/bazel/foreign_cc/luajit_win.patch
@@ -1,6 +1,6 @@
 diff --git a/luajit_build_win.sh b/luajit_build_win.sh
 new file mode 100755
-index 00000000..a493e7e0
+index 00000000..c6267893
 --- /dev/null
 +++ b/luajit_build_win.sh
 @@ -0,0 +1,38 @@
@@ -35,10 +35,29 @@ index 00000000..a493e7e0
 +./msvcbuild.bat static
 +
 +mkdir -p "$PREFIX/lib"
-+cp lua51.lib vc140.pdb "$PREFIX/lib"
++cp lua51.lib "$PREFIX/lib"
 +mkdir -p "$PREFIX/include/luajit-2.1"
 +for header in lauxlib.h luaconf.h lua.h lua.hpp luajit.h lualib.h; do
 +    cp "$header" "$PREFIX/include/luajit-2.1"
 +done
 +mkdir -p "$PREFIX/bin"
 +cp luajit.exe "$PREFIX/bin"
+diff --git a/src/msvcbuild.bat b/src/msvcbuild.bat
+index d6aed170..42604601 100644
+--- a/src/msvcbuild.bat
++++ b/src/msvcbuild.bat
+@@ -18,9 +18,11 @@
+ @rem Add more debug flags here, e.g. DEBUGCFLAGS=/DLUA_USE_ASSERT
+ @set DEBUGCFLAGS=
+ @set LJCOMPILE=cl /nologo /c /O2 /W3 /D_CRT_SECURE_NO_DEPRECATE /D_CRT_STDIO_INLINE=__declspec(dllexport)__inline
+-@set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MD
+-@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MDd 
+-@set LJCOMPILETARGET=/Zi
++@rem Use MT to match flags set by bazel for static build
++@set LJDYNBUILD=/DLUA_BUILD_AS_DLL /MT
++@set LJDYNBUILD_DEBUG=/DLUA_BUILD_AS_DLL /MTd 
++@rem Avoid incremental link which doesn't work with bazel's deletion of intermediate files
++@set LJCOMPILETARGET=/Z7
+ @set LJLINKTYPE=/DEBUG /RELEASE
+ @set LJLINKTYPE_DEBUG=/DEBUG
+ @set LJLINKTARGET=/OPT:REF /OPT:ICF /INCREMENTAL:NO