diff --git a/Makefile b/Makefile
index 8545fa1f8..bb5486b46 100644
--- a/Makefile
+++ b/Makefile
@@ -39,8 +39,9 @@ SOURCES := $(shell find cmd/ pkg/ vendor/ -name '*.go')
 PLUGIN_SOURCES := $(shell ls *.go)
 INTEGRATION_SOURCES := $(shell find integration/ -name '*.go')
 
+CONTAINERD_BIN := containerd
 ifeq ($(GOOS),windows)
-	BIN_EXT := .exe
+	CONTAINERD_BIN := $(CONTAINERD_BIN).exe
 endif
 
 all: binaries
@@ -82,7 +83,7 @@ sync-vendor:
 update-vendor: sync-vendor sort-vendor ## Syncs containerd/vendor.conf -> vendor.conf and sorts vendor.conf
 	@echo "$(WHALE) $@"
 
-$(BUILD_DIR)/containerd: $(SOURCES) $(PLUGIN_SOURCES)
+$(BUILD_DIR)/$(CONTAINERD_BIN): $(SOURCES) $(PLUGIN_SOURCES)
 	@echo "$(WHALE) $@"
 	$(GO) build -o $@$(BIN_EXT) \
 		-tags '$(BUILD_TAGS)' \
@@ -117,29 +118,34 @@ clean: ## cleanup binaries
 	@echo "$(WHALE) $@"
 	@rm -rf $(BUILD_DIR)/*
 
-binaries: $(BUILD_DIR)/containerd ## build a customized containerd (same result as make containerd)
+binaries: $(BUILD_DIR)/$(CONTAINERD_BIN) ## build a customized containerd (same result as make containerd)
 	@echo "$(WHALE) $@"
 
 static-binaries: GO_LDFLAGS += -extldflags "-fno-PIC -static"
-static-binaries: $(BUILD_DIR)/containerd ## build static containerd
+static-binaries: $(BUILD_DIR)/$(CONTAINERD_BIN) ## build static containerd
 	@echo "$(WHALE) $@"
 
-containerd: $(BUILD_DIR)/containerd ## build a customized containerd with CRI plugin for testing
+containerd: $(BUILD_DIR)/$(CONTAINERD_BIN) ## build a customized containerd with CRI plugin for testing
 	@echo "$(WHALE) $@"
 
 install-containerd: containerd ## installs customized containerd to system location
 	@echo "$(WHALE) $@"
-	@install -D -m 755 $(BUILD_DIR)/containerd "$(BINDIR)/containerd"
+	@install -D -m 755 $(BUILD_DIR)/$(CONTAINERD_BIN) "$(BINDIR)/$(CONTAINERD_BIN)"
 
 install: install-containerd ## installs customized containerd to system location
 	@echo "$(WHALE) $@"
 
 uninstall: ## remove containerd from system location
 	@echo "$(WHALE) $@"
-	@rm -f "$(BINDIR)/containerd"
+	@rm -f "$(BINDIR)/$(CONTAINERD_BIN)"
 
+ifeq ($(GOOS),windows)
+$(BUILD_DIR)/$(TARBALL): static-binaries vendor.conf
+	@BUILD_DIR=$(BUILD_DIR) TARBALL=$(TARBALL) VERSION=$(VERSION) ./hack/release-windows.sh
+else
 $(BUILD_DIR)/$(TARBALL): static-binaries vendor.conf
 	@BUILD_DIR=$(BUILD_DIR) TARBALL=$(TARBALL) VERSION=$(VERSION) ./hack/release.sh
+endif
 
 release: $(BUILD_DIR)/$(TARBALL) ## build release tarball
 
diff --git a/hack/install/utils.sh b/hack/install/utils.sh
index 69a6ea51e..b06fd30f3 100755
--- a/hack/install/utils.sh
+++ b/hack/install/utils.sh
@@ -16,11 +16,12 @@
 
 source $(dirname "${BASH_SOURCE[0]}")/../utils.sh
 
-# DESTDIR is the dest path to install dependencies.
+# DESTDIR is the absolute dest path to install dependencies.
 DESTDIR=${DESTDIR:-"/"}
 # Convert to absolute path if it's relative.
 if [[ ${DESTDIR} != /* ]]; then
-  DESTDIR=${ROOT}/${DESTDIR}
+  echo "DESTDIR is not an absolute path"
+  exit 1
 fi
 
 # NOSUDO indicates not to use sudo during installation.
diff --git a/hack/install/windows/install-cni-config.sh b/hack/install/windows/install-cni-config.sh
index 395292026..a2313bc6b 100755
--- a/hack/install/windows/install-cni-config.sh
+++ b/hack/install/windows/install-cni-config.sh
@@ -74,7 +74,7 @@ bash -c 'cat >"'"${CNI_CONFIG_DIR}"'"/0-containerd-nat.conf <<EOF
         "subnet": "'$subnet'",
         "routes": [
             {
-                "gateway": "'$gateway'"
+                "GW": "'$gateway'"
             }
         ]
     },
diff --git a/hack/install/windows/install-cni.sh b/hack/install/windows/install-cni.sh
index ea0479956..bb160b4c6 100755
--- a/hack/install/windows/install-cni.sh
+++ b/hack/install/windows/install-cni.sh
@@ -22,7 +22,7 @@ source $(dirname "${BASH_SOURCE[0]}")/../utils.sh
 # WINCNI_BIN_DIR is the cni plugin directory
 WINCNI_BIN_DIR="${WINCNI_BIN_DIR:-"C:\\Program Files\\containerd\\cni\\bin"}"
 WINCNI_PKG=github.com/Microsoft/windows-container-networking
-WINCNI_VERSION=33bc4764ea3ad7c6ec58c5716370d329f5eb1266
+WINCNI_VERSION=aa10a0b31e9f72937063436454def1760b858ee2
 
 # Create a temporary GOPATH for cni installation.
 GOPATH="$(mktemp -d /tmp/cri-install-cni.XXXX)"
@@ -30,8 +30,10 @@ GOPATH="$(mktemp -d /tmp/cri-install-cni.XXXX)"
 # Install cni
 checkout_repo "${WINCNI_PKG}" "${WINCNI_VERSION}" "${WINCNI_PKG}"
 cd "${GOPATH}/src/${WINCNI_PKG}"
-go build "${WINCNI_PKG}/plugins/nat"
-install -D -m 755 "nat.exe" "${WINCNI_BIN_DIR}/nat.exe"
+make all
+install -D -m 755 "out/nat.exe" "${WINCNI_BIN_DIR}/nat.exe"
+install -D -m 755 "out/sdnbridge.exe" "${WINCNI_BIN_DIR}/sdnbridge.exe"
+install -D -m 755 "out/sdnoverlay.exe" "${WINCNI_BIN_DIR}/sdnoverlay.exe"
 
 # Clean the tmp GOPATH dir.
 rm -rf "${GOPATH}"
diff --git a/hack/install/windows/install-hcsshim.sh b/hack/install/windows/install-hcsshim.sh
index b3d2b04c8..c5e0a6633 100755
--- a/hack/install/windows/install-hcsshim.sh
+++ b/hack/install/windows/install-hcsshim.sh
@@ -30,7 +30,7 @@ from-vendor HCSSHIM "${HCSSHIM_PKG}"
 checkout_repo "${HCSSHIM_PKG}" "${HCSSHIM_VERSION}" "${HCSSHIM_REPO}"
 cd "${GOPATH}/src/${HCSSHIM_PKG}"
 go build "${HCSSHIM_PKG}/cmd/containerd-shim-runhcs-v1"
-install -D -m 755 containerd-shim-runhcs-v1 "${HCSSHIM_DIR}"/containerd-shim-runhcs-v1
+install -D -m 755 containerd-shim-runhcs-v1.exe "${HCSSHIM_DIR}"/containerd-shim-runhcs-v1.exe
 
 # Clean the tmp GOPATH dir. Use sudo because runc build generates
 # some privileged files.
diff --git a/hack/release-windows.sh b/hack/release-windows.sh
new file mode 100755
index 000000000..de292d5e3
--- /dev/null
+++ b/hack/release-windows.sh
@@ -0,0 +1,75 @@
+#!/bin/bash
+
+# Copyright The containerd Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+source $(dirname "${BASH_SOURCE[0]}")/utils.sh
+cd ${ROOT}
+
+umask 0022
+
+# BUILD_DIR is the directory to generate release tar.
+# TARBALL is the name of the release tar.
+BUILD_DIR=${BUILD_DIR:-"_output"}
+# Convert to absolute path if it's relative.
+if [[ ${BUILD_DIR} != /* ]]; then
+  BUILD_DIR=${ROOT}/${BUILD_DIR}
+fi
+TARBALL=${TARBALL:-"cri-containerd.tar.gz"}
+# INCLUDE_CNI indicates whether to install CNI. By default don't
+# include CNI in release tarball.
+INCLUDE_CNI=${INCLUDE_CNI:-false}
+# CUSTOM_CONTAINERD indicates whether to install customized containerd
+# for CI test.
+CUSTOM_CONTAINERD=${CUSTOM_CONTAINERD:-false}
+
+destdir=${BUILD_DIR}/release-stage
+
+if [[ -z "${VERSION}" ]]; then
+  echo "VERSION is not set"
+  exit 1
+fi
+
+# Remove release-stage directory to avoid including old files.
+rm -rf ${destdir}
+
+# Install dependencies into release stage.
+# Install hcsshim
+HCSSHIM_DIR=${destdir} ./hack/install/windows/install-hcsshim.sh
+
+if ${INCLUDE_CNI}; then
+  # Install cni
+  NOSUDO=true WINCNI_BIN_DIR=${destdir}/cni ./hack/install/windows/install-cni.sh
+fi
+
+# Build containerd from source
+NOSUDO=true CONTAINERD_DIR=${destdir} ./hack/install/install-containerd.sh
+# Containerd makefile always installs into a "bin" directory.
+mv "${destdir}"/bin/* "${destdir}"
+rm -rf "${destdir}/bin"
+
+if ${CUSTOM_CONTAINERD}; then
+  make install -e BINDIR=${destdir}
+fi
+
+# Create release tar
+tarball=${BUILD_DIR}/${TARBALL}
+tar -zcvf ${tarball} -C ${destdir} . --owner=0 --group=0
+checksum=$(sha256 ${tarball})
+echo "sha256sum: ${checksum} ${tarball}"
+echo ${checksum} > ${tarball}.sha256
diff --git a/hack/release.sh b/hack/release.sh
index 6c07a686f..fe99652aa 100755
--- a/hack/release.sh
+++ b/hack/release.sh
@@ -26,6 +26,10 @@ umask 0022
 # BUILD_DIR is the directory to generate release tar.
 # TARBALL is the name of the release tar.
 BUILD_DIR=${BUILD_DIR:-"_output"}
+# Convert to absolute path if it's relative.
+if [[ ${BUILD_DIR} != /* ]]; then
+  BUILD_DIR=${ROOT}/${BUILD_DIR}
+fi
 TARBALL=${TARBALL:-"cri-containerd.tar.gz"}
 # INCLUDE_CNI indicates whether to install CNI. By default don't
 # include CNI in release tarball.