diff --git a/src/gateway/test-helpers.mocks.ts b/src/gateway/test-helpers.mocks.ts
index 8f356417e..1f17e63be 100644
--- a/src/gateway/test-helpers.mocks.ts
+++ b/src/gateway/test-helpers.mocks.ts
@@ -69,10 +69,7 @@ const hoisted = vi.hoisted(() => ({
 }));
 
 const testConfigRoot = {
-  value: path.join(
-    os.tmpdir(),
-    `clawdbot-gateway-test-${process.pid}-${crypto.randomUUID()}`,
-  ),
+  value: path.join(os.tmpdir(), `clawdbot-gateway-test-${process.pid}-${crypto.randomUUID()}`),
 };
 
 export const setTestConfigRoot = (root: string) => {
diff --git a/src/infra/bridge/server.enables-keepalive-sockets.test.ts b/src/infra/bridge/server.enables-keepalive-sockets.test.ts
index 7dd71e1c2..0155bb000 100644
--- a/src/infra/bridge/server.enables-keepalive-sockets.test.ts
+++ b/src/infra/bridge/server.enables-keepalive-sockets.test.ts
@@ -57,6 +57,7 @@ async function waitForSocketConnect(socket: net.Socket) {
 
 describe("node bridge server", () => {
   let baseDir = "";
+  const pairingTimeoutMs = process.platform === "win32" ? 8000 : 3000;
 
   const pickNonLoopbackIPv4 = () => {
     const ifaces = os.networkInterfaces();
@@ -174,7 +175,7 @@ describe("node bridge server", () => {
         const list = await listNodePairing(baseDir);
         return list.pending.find((p) => p.nodeId === "n2");
       },
-      { timeoutMs: 3000 },
+      { timeoutMs: pairingTimeoutMs },
     );
     expect(pending).toBeTruthy();
     if (!pending) throw new Error("expected a pending request");
@@ -220,7 +221,7 @@ describe("node bridge server", () => {
     await waitForSocketConnect(socket);
     sendLine(socket, { type: "pair-request", nodeId: "n3", platform: "ios" });
 
-    await pollUntil(async () => requested, { timeoutMs: 3000 });
+    await pollUntil(async () => requested, { timeoutMs: pairingTimeoutMs });
 
     expect(requested?.nodeId).toBe("n3");
     expect(typeof requested?.requestId).toBe("string");
@@ -257,7 +258,7 @@ describe("node bridge server", () => {
         const list = await listNodePairing(baseDir);
         return list.pending.find((p) => p.nodeId === "n3-rpc");
       },
-      { timeoutMs: 3000 },
+      { timeoutMs: pairingTimeoutMs },
     );
     expect(pending).toBeTruthy();
     if (!pending) throw new Error("expected a pending request");
@@ -353,7 +354,7 @@ describe("node bridge server", () => {
         const list = await listNodePairing(baseDir);
         return list.pending.find((p) => p.nodeId === "n4");
       },
-      { timeoutMs: 3000 },
+      { timeoutMs: pairingTimeoutMs },
     );
     expect(pending).toBeTruthy();
     if (!pending) throw new Error("expected a pending request");
@@ -385,7 +386,7 @@ describe("node bridge server", () => {
     expect(line3.type).toBe("hello-ok");
 
     await pollUntil(async () => (lastAuthed?.nodeId === "n4" ? lastAuthed : null), {
-      timeoutMs: 3000,
+      timeoutMs: pairingTimeoutMs,
     });
 
     expect(lastAuthed?.nodeId).toBe("n4");
diff --git a/src/security/fix.test.ts b/src/security/fix.test.ts
index 0c9588ba3..06ea0fc34 100644
--- a/src/security/fix.test.ts
+++ b/src/security/fix.test.ts
@@ -6,6 +6,16 @@ import { describe, expect, it } from "vitest";
 
 import { fixSecurityFootguns } from "./fix.js";
 
+const isWindows = process.platform === "win32";
+
+const expectPerms = (actual: number, expected: number) => {
+  if (isWindows) {
+    expect([expected, 0o666, 0o777]).toContain(actual);
+    return;
+  }
+  expect(actual).toBe(expected);
+};
+
 describe("security fix", () => {
   it("tightens groupPolicy + filesystem perms", async () => {
     const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "clawdbot-security-fix-"));
@@ -63,10 +73,10 @@ describe("security fix", () => {
     );
 
     const stateMode = (await fs.stat(stateDir)).mode & 0o777;
-    expect(stateMode).toBe(0o700);
+    expectPerms(stateMode, 0o700);
 
     const configMode = (await fs.stat(configPath)).mode & 0o777;
-    expect(configMode).toBe(0o600);
+    expectPerms(configMode, 0o600);
 
     const parsed = JSON.parse(await fs.readFile(configPath, "utf-8")) as Record<string, unknown>;
     const channels = parsed.channels as Record<string, Record<string, unknown>>;
@@ -192,9 +202,9 @@ describe("security fix", () => {
     expect(res.ok).toBe(false);
 
     const stateMode = (await fs.stat(stateDir)).mode & 0o777;
-    expect(stateMode).toBe(0o700);
+    expectPerms(stateMode, 0o700);
 
     const configMode = (await fs.stat(configPath)).mode & 0o777;
-    expect(configMode).toBe(0o600);
+    expectPerms(configMode, 0o600);
   });
 });