diff --git a/.build.yml b/.build.yml
index c9cbfa0..6144d65 100644
--- a/.build.yml
+++ b/.build.yml
@@ -5,7 +5,7 @@ packages:
   - qemu-user-static
   - binfmt-support
   - moreutils
-  - wine-binfmt
+  - wine64
 sources:
   - https://git.sr.ht/~motiejus/bazel-zig-cc
 environment:
diff --git a/ci/test b/ci/test
index 1ba6285..269510d 100755
--- a/ci/test
+++ b/ci/test
@@ -1,13 +1,4 @@
 #!/bin/bash
-set -euo pipefail
+set -xeuo pipefail
 
 bazel test ...
-
-# Windows tests
-# Unfortunately wine-binfmt breaks within the bazel sandbox, so we disable it
-# to run this test.
-bazel test //test/c:winver_windows_amd64 \
-    --spawn_strategy=standalone
-# There is no no easy way to run windows_arm64 binaries on Linux, so we just
-# cross compile one for testing.
-bazel build //test/c:winver_windows_arm64
diff --git a/rules/platform.bzl b/rules/platform.bzl
index aabb328..d179cc4 100644
--- a/rules/platform.bzl
+++ b/rules/platform.bzl
@@ -1,3 +1,10 @@
+def _vars_script(env, run_under, cmd):
+    ret = ["#!/bin/sh"]
+    for k, v in env.items():
+        ret += ['export {}="{}"'.format(k, v)]
+    ret += ['exec {} {} "$@"'.format(run_under, cmd)]
+    return "\n".join(ret) + "\n"  # trailing newline is easier on the eyes
+
 def _platform_transition_impl(settings, attr):
     _ignore = settings
     return {
@@ -17,16 +24,18 @@ def _platform_binary_impl(ctx):
 
     executable = None
     if source_info.files_to_run and source_info.files_to_run.executable:
+        command = _vars_script(ctx.attr.env, ctx.attr.run_under, source_info.files_to_run.executable.short_path)
         executable = ctx.actions.declare_file("{}_{}".format(ctx.file.src.basename, ctx.attr.platform))
-        ctx.actions.run_shell(
-            command = "cp {} {}".format(source_info.files_to_run.executable.path, executable.path),
-            inputs = [source_info.files_to_run.executable],
-            outputs = [executable],
+        ctx.actions.write(
+            output = executable,
+            content = command,
+            is_executable = True,
         )
 
     return [DefaultInfo(
-        files = depset(ctx.files.src),
         executable = executable,
+        files = depset([executable]),
+        runfiles = ctx.runfiles(files = ctx.files.src),
     )]
 
 _attrs = {
@@ -38,6 +47,12 @@ _attrs = {
     "platform": attr.string(
         doc = "The platform to build the target for.",
     ),
+    "run_under": attr.string(
+        doc = "wrapper executable",
+    ),
+    "env": attr.string_dict(
+        doc = "Environment variables for the test",
+    ),
     "_allowlist_function_transition": attr.label(
         default = "@bazel_tools//tools/allowlists/function_transition_allowlist",
     ),
diff --git a/test/c/BUILD b/test/c/BUILD
index 698c798..c5e6748 100644
--- a/test/c/BUILD
+++ b/test/c/BUILD
@@ -1,4 +1,4 @@
-load("@bazel-zig-cc//rules:platform.bzl", "platform_binary", "platform_test")
+load("@bazel-zig-cc//rules:platform.bzl", "platform_binary")
 
 cc_binary(
     name = "which_libc",
@@ -13,7 +13,9 @@ cc_binary(
         platform_binary(
             name = "which_libc_{}".format(name),
             src = "which_libc",
+            env = {"QEMU_LD_PREFIX": "/usr/aarch64-linux-gnu"} if is_arm64 else {},
             platform = platform,
+            run_under = "qemu-aarch64-static" if is_arm64 else "",
         ),
         sh_test(
             name = "test_libc_{}".format(name),
@@ -25,34 +27,12 @@ cc_binary(
             },
         ),
     )
-    for name, platform, want in [
-        ("linux_amd64_musl", "//libc_aware/platform:linux_amd64_musl", "non-glibc"),
-        ("linux_amd64_gnu.2.19", "//libc_aware/platform:linux_amd64_gnu.2.19", "glibc_2.19"),
-        ("linux_amd64_gnu.2.28", "//libc_aware/platform:linux_amd64_gnu.2.28", "glibc_2.28"),
-        ("linux_amd64_gnu.2.31", "//libc_aware/platform:linux_amd64_gnu.2.31", "glibc_2.31"),
-        ("linux_amd64", "//platform:linux_amd64", "glibc_2.19"),
-        ("linux_arm64", "//platform:linux_arm64", "glibc_2.28"),
+    for name, platform, want, is_arm64 in [
+        ("linux_amd64_musl", "//libc_aware/platform:linux_amd64_musl", "non-glibc", False),
+        ("linux_amd64_gnu.2.19", "//libc_aware/platform:linux_amd64_gnu.2.19", "glibc_2.19", False),
+        ("linux_amd64_gnu.2.28", "//libc_aware/platform:linux_amd64_gnu.2.28", "glibc_2.28", False),
+        ("linux_amd64_gnu.2.31", "//libc_aware/platform:linux_amd64_gnu.2.31", "glibc_2.31", False),
+        ("linux_amd64", "//platform:linux_amd64", "glibc_2.19", False),
+        ("linux_arm64", "//platform:linux_arm64", "glibc_2.28", True),
     ]
 ]
-
-cc_binary(
-    name = "winver",
-    srcs = ["main_winver.c"],
-    target_compatible_with = [
-        "@platforms//os:windows",
-    ],
-)
-
-platform_test(
-    name = "winver_windows_amd64",
-    src = "winver",
-    platform = "//platform:windows_amd64",
-    tags = ["manual"],
-)
-
-platform_binary(
-    name = "winver_windows_arm64",
-    src = "winver",
-    platform = "//platform:windows_arm64",
-    tags = ["manual"],
-)
diff --git a/test/c/test.sh b/test/c/test.sh
index d5331ff..ee67dd3 100755
--- a/test/c/test.sh
+++ b/test/c/test.sh
@@ -1,10 +1,11 @@
-#/bin/bash
+#!/bin/bash
 
 set -euo pipefail
 
+# shellcheck disable=SC2153
 want=$WANT
+# shellcheck disable=SC2153
 binary=$BINARY
-
 got=$($binary)
 
 if [[ "$got" != "$want" ]]; then
diff --git a/test/cgo/BUILD b/test/cgo/BUILD
index 1e11a22..a65c350 100644
--- a/test/cgo/BUILD
+++ b/test/cgo/BUILD
@@ -41,12 +41,14 @@ go_binary(
     platform_test(
         name = "cgo_test_{}".format(name),
         src = "cgo_test",
+        env = {"QEMU_LD_PREFIX": "/usr/aarch64-linux-gnu"} if is_arm64 else {},
         platform = platform,
+        run_under = "qemu-aarch64-static" if is_arm64 else "",
     )
-    for name, platform in [
-        ("linux_amd64_musl", "//libc_aware/platform:linux_amd64_musl"),
-        ("linux_amd64_gnu.2.19", "//libc_aware/platform:linux_amd64_gnu.2.19"),
-        ("linux_arm64_musl", "//libc_aware/platform:linux_arm64_musl"),
-        ("linux_arm64_gnu.2.28", "//libc_aware/platform:linux_arm64_gnu.2.28"),
+    for name, platform, is_arm64 in [
+        ("linux_amd64_musl", "//libc_aware/platform:linux_amd64_musl", False),
+        ("linux_amd64_gnu.2.19", "//libc_aware/platform:linux_amd64_gnu.2.19", False),
+        ("linux_arm64_musl", "//libc_aware/platform:linux_arm64_musl", True),
+        ("linux_arm64_gnu.2.28", "//libc_aware/platform:linux_arm64_gnu.2.28", True),
     ]
 ]
diff --git a/test/windows/BUILD b/test/windows/BUILD
new file mode 100644
index 0000000..cb8d17a
--- /dev/null
+++ b/test/windows/BUILD
@@ -0,0 +1,21 @@
+load("@bazel-zig-cc//rules:platform.bzl", "platform_binary", "platform_test")
+
+cc_binary(
+    name = "winver",
+    srcs = ["main.c"],
+    tags = ["manual"],
+)
+
+platform_test(
+    name = "winver_windows_amd64",
+    src = "winver",
+    platform = "//platform:windows_amd64",
+    run_under = "wine64-stable",
+    tags = ["no-sandbox"],
+)
+
+platform_binary(
+    name = "winver_windows_arm64",
+    src = "winver",
+    platform = "//platform:windows_arm64",
+)
diff --git a/test/c/main_winver.c b/test/windows/main.c
similarity index 100%
rename from test/c/main_winver.c
rename to test/windows/main.c