diff --git a/.aspect/cli/plugins.yaml b/.aspect/cli/plugins.yaml
index e4ca70f84..8caf54d88 100644
--- a/.aspect/cli/plugins.yaml
+++ b/.aspect/cli/plugins.yaml
@@ -1,3 +1,4 @@
-- name: plugin-aspect-buildkite
-  from: https://static.aspect.build/aspect
-  version: 5.1.2
+# Temporarily disabled as there are issues with CLI plugins on Windows CI: Error: failed to configure plugin system: unable to fetch remote plugin from https://static.aspect.build/aspect: could not move C:\Users\runneradmin\AppData\Local\aspect-cli\plugins\plugin-aspect-buildkite\5.1.2\download3103879743 to C:\Users\runneradmin\AppData\Local\aspect-cli\plugins\plugin-aspect-buildkite\5.1.2\plugin-aspect-buildkite-windows_amd64.exe: rename C:\Users\runneradmin\AppData\Local\aspect-cli\plugins\plugin-aspect-buildkite\5.1.2\download3103879743 C:\Users\runneradmin\AppData\Local\aspect-cli\plugins\plugin-aspect-buildkite\5.1.2\plugin-aspect-buildkite-windows_amd64.exe: The process cannot access the file because it is being used by another process.
+# - name: plugin-aspect-buildkite
+#   from: https://static.aspect.build/aspect
+#   version: 5.1.2
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c889ec394..ca417060a 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -47,19 +47,42 @@ jobs:
       # Will look like '["6.0.0", "5.3.2"]'
       bazelversions: ${{ toJSON(steps.*.outputs.bazelversion) }}
 
+  matrix-prep-os:
+    # Prepares the 'os' axis of the test matrix
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - id: linux
+        run: echo "os=ubuntu-latest" >> $GITHUB_OUTPUT
+      - id: macos
+        run: echo "os=macos-latest" >> $GITHUB_OUTPUT
+        # Only run on main branch (not PRs) to minimize macOS minutes (billed at 10X)
+        # https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#included-storage-and-minutes
+        if: ${{ github.ref == 'refs/heads/main' }}
+      - id: windows
+        run: echo "os=windows-latest" >> $GITHUB_OUTPUT
+        # Only run on main branch (not PRs) to minimize Windows minutes (billed at 2X)
+        # https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#included-storage-and-minutes
+        if: ${{ github.ref == 'refs/heads/main' }}
+    outputs:
+      # Will look like ["ubuntu-latest", "macos-latest"]
+      os: ${{ toJSON(steps.*.outputs.os) }}
+
   test:
     # The type of runner that the job will run on
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os }}
 
     needs:
       - matrix-prep-config
       - matrix-prep-bazelversion
+      - matrix-prep-os
 
     strategy:
       fail-fast: false
       matrix:
         config: ${{ fromJSON(needs.matrix-prep-config.outputs.configs) }}
         bazelversion: ${{ fromJSON(needs.matrix-prep-bazelversion.outputs.bazelversions) }}
+        os: ${{ fromJSON(needs.matrix-prep-os.outputs.os) }}
         folder:
           - "."
           - "e2e/bzlmod"
@@ -76,10 +99,32 @@ jobs:
           - config: rbe
             bazelversion: 5.3.2
             folder: e2e/bzlmod
+          # Don't test Windows & with RBE to minimize Windows minutes
+          - config: rbe
+            os: macos-latest
+          # Don't test Windows with Bazel 5 to minimize Windows minutes
+          - bazelversion: 5.3.2
+            os: macos-latest
+          # Don't test Windows & with RBE to minimize Windows minutes
+          - config: rbe
+            os: windows-latest
+          # Don't test Windows with Bazel 5 to minimize Windows minutes
+          - bazelversion: 5.3.2
+            os: windows-latest
+          # TODO: fix or disable the following build & test on Windows
+          # //lib/tests/coreutils:test_sha256sum FAILED in 2 out of 2 in 0.2s
+          # //lib/tests/coreutils:test_sha512sum FAILED in 2 out of 2 in 0.2s
+          # //docs:update_0_test FAILED TO BUILD
+          # //docs:update_10_test FAILED TO BUILD
+          # //docs:update_11_test FAILED TO BUILD
+          # //docs:update_12_test FAILED TO BUILD
+          # //docs:update_13_test FAILED TO BUILD
+          - folder: .
+            os: windows-latest
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      # Checks-out your repository under ${{ github.workspace }} , so your job can access it
       - uses: actions/checkout@v3
 
       - name: Mount bazel caches
@@ -92,6 +137,7 @@ jobs:
           restore-keys: bazel-cache-
 
       - name: Configure Bazel version
+        if: ${{ matrix.os != 'windows-latest' }}
         working-directory: ${{ matrix.folder }}
         # Overwrite the .bazelversion instead of using USE_BAZEL_VERSION so that Bazelisk
         # still bootstraps Aspect CLI from configuration in .bazeliskrc. Aspect CLI will
@@ -103,6 +149,21 @@ jobs:
           echo "${{ matrix.bazelversion }}" > .bazelversion
           if [ ${BAZEL_VERSION::1} != "6" ]; then rm -f .aspect/bazelrc/bazel6.bazelrc; fi
 
+      - name: Configure Bazel version (Windows)
+        if: ${{ matrix.os == 'windows-latest' }}
+        working-directory: ${{ matrix.folder }}
+        # Overwrite the .bazelversion instead of using USE_BAZEL_VERSION so that Bazelisk
+        # still bootstraps Aspect CLI from configuration in .bazeliskrc. Aspect CLI will
+        # then use .bazelversion to determine which Bazel version to use.
+        # Also delete the .aspect/bazelrc/bazel6.bazelrc file if we are not testing
+        # against Bazel 6 which has a try-import in the root .bazelrc for local development.
+        run: |
+          echo "${{ matrix.bazelversion }}" > .bazelversion
+          $BAZEL_MAJOR_VERSION = "${{ matrix.bazelversion }}".substring(0, 1)
+          if ($BAZEL_MAJOR_VERSION -ne "6") {
+            rm -Force .aspect/bazelrc/bazel6.bazelrc
+          }
+
       - name: Write engflow credentials
         if: ${{ matrix.config == 'rbe' }}
         working-directory: ${{ matrix.folder }}
@@ -116,19 +177,30 @@ jobs:
           ENGFLOW_PRIVATE_KEY: ${{ secrets.ENGFLOW_PRIVATE_KEY }}
 
       - name: bazel test //...
+        if: ${{ matrix.os != 'windows-latest' }}
         working-directory: ${{ matrix.folder }}
         run: |
           BAZEL_VERSION=${{ matrix.bazelversion }}
-          bazel --bazelrc=$GITHUB_WORKSPACE/.aspect/bazelrc/ci.bazelrc \
-            --bazelrc=$GITHUB_WORKSPACE/.github/workflows/ci.bazelrc \
-            --bazelrc=$GITHUB_WORKSPACE/.aspect/bazelrc/bazel${BAZEL_VERSION::1}.bazelrc \
+          bazel --bazelrc=${{ github.workspace }}/.aspect/bazelrc/ci.bazelrc \
+            --bazelrc=${{ github.workspace }}/.github/workflows/ci.bazelrc \
+            --bazelrc=${{ github.workspace }}/.aspect/bazelrc/bazel${BAZEL_VERSION::1}.bazelrc \
             --bazelrc=.bazelrc \
             test --config=${{ matrix.config }} //...
         env:
           # Bazelisk will download bazel to here
           XDG_CACHE_HOME: ~/.cache/bazel-repo
 
+      - name: bazel test //... (Windows)
+        if: ${{ matrix.os == 'windows-latest' }}
+        working-directory: ${{ matrix.folder }}
+        run: |
+          $BAZEL_MAJOR_VERSION = "${{ matrix.bazelversion }}".substring(0, 1)
+          bazel --bazelrc=${{ github.workspace }}/.aspect/bazelrc/ci.bazelrc --bazelrc=${{ github.workspace }}/.github/workflows/ci.bazelrc --bazelrc=${{ github.workspace }}/.aspect/bazelrc/bazel$BAZEL_MAJOR_VERSION.bazelrc --bazelrc=.bazelrc test --config=${{ matrix.config }} //...
+        env:
+          # Bazelisk will download bazel to here
+          XDG_CACHE_HOME: ~/.cache/bazel-repo
+
       - name: integration tests
-        if: ${{ matrix.folder == '.' }}
+        if: ${{ matrix.folder == '.' && matrix.os != 'windows-latest' }}
         # Find all shell scripts within e2e, echo the filename, execute, fail on error
         run: find e2e/*.sh -maxdepth 1 -type f -exec sh -c 'echo "\n\n------------------------------- $0 -------------------------------" && "$0" || kill $PPID' \{\} \;