diff --git a/.gitattributes b/.gitattributes
index 193a4cc3..0f960ff0 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,4 +1,3 @@
-/appveyor.yml export-ignore
 /.gitattributes export-ignore
 /.github export-ignore
 *.ppm binary
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5acb1713..43ee0ccc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,8 +4,6 @@ on:
   push:
     branches:
       - '**'
-    tags-ignore:
-      - '**'
   pull_request:
   workflow_dispatch:
 
@@ -86,6 +84,108 @@ jobs:
         if: ${{github.event_name != 'pull_request'}}
         run: |
           aws s3 sync --acl public-read --delete $HOME/src/ljt.nightly/latest/files/ s3://libjpeg-turbo-pr/${{env.BRANCH}}/${{github.job}}/
+  windows:
+    runs-on: windows-2025
+    steps:
+      - name: Set global environment variables
+        shell: bash
+        run: |
+          echo "BRANCH=${GITHUB_BASE_REF:-${GITHUB_REF#refs/heads/}}" >$GITHUB_ENV
+      - name: Check out code
+        uses: actions/checkout@v4
+      - name: Set up build
+        shell: bash
+        run: |
+          set -x
+          choco install -y nsis
+          mkdir -p c:/installers
+          if [ ! -f c:/installers/nasm-2.10.01-win32.zip ]; then
+            curl -fSL -o c:/installers/nasm-2.10.01-win32.zip https://nasm.us/pub/nasm/releasebuilds/2.10.01/win32/nasm-2.10.01-win32.zip
+          fi
+          7z x c:/installers/nasm-2.10.01-win32.zip -oc:/ > c:/installers/nasm.install.log
+          if [ ! -f c:/installers/i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z ]; then
+            curl -fSL -o c:/installers/i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z https://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win32/Personal%20Builds/mingw-builds/6.4.0/threads-posix/dwarf/i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z
+          fi
+          mkdir -p "c:/Program Files (x86)/mingw-w64/i686-6.4.0-posix-dwarf-rt_v5-rev0"
+          7z x c:/installers/i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z -o"c:/Program Files (x86)/mingw-w64/i686-6.4.0-posix-dwarf-rt_v5-rev0" > c:/installers/mingw32.install.log
+          if [ ! -f c:/installers/x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z ]; then
+            curl -fSL -o c:/installers/x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z https://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win64/Personal%20Builds/mingw-builds/6.4.0/threads-posix/seh/x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z
+          fi
+          mkdir -p "c:/Program Files/mingw-w64/x86_64-6.4.0-posix-seh-rt_v5-rev0"
+          7z x c:/installers/x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z -o"c:/Program Files/mingw-w64/x86_64-6.4.0-posix-seh-rt_v5-rev0" > c:/installers/mingw64.install.log
+          if [ ! -f c:/installers/OpenJDK8U-jdk_x86-32_windows_hotspot_8u452b09.zip ]; then
+            curl -fSL -o c:/installers/OpenJDK8U-jdk_x86-32_windows_hotspot_8u452b09.zip https://github.com/adoptium/temurin8-binaries/releases/download/jdk8u452-b09/OpenJDK8U-jdk_x86-32_windows_hotspot_8u452b09.zip
+          fi
+          7z x c:/installers/OpenJDK8U-jdk_x86-32_windows_hotspot_8u452b09.zip -o$ProgramData/Oracle > c:/installers/openjdk-x86.install.log
+          mv $ProgramData/Oracle/jdk8u452-b09 $ProgramData/Oracle/Java32
+          if [ ! -f c:/installers/OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip ]; then
+            curl -fSL -o c:/installers/OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.7%2B6/OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip
+          fi
+          7z x c:/installers/OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip -o$ProgramData/Oracle > c:/installers/openjdk-arm64.install.log
+          mv $ProgramData/Oracle/jdk-21.0.7+6 $ProgramData/Oracle/JavaArm64
+          mkdir $ProgramData/Oracle/Java
+          ln -fs "$(cygpath "$JAVA_HOME_8_X64")" $ProgramData/Oracle/Java/javapath
+          git clone --depth=1 https://github.com/nathan818fr/vcvars-bash.git c:/vcvars-bash
+          c:/msys64/usr/bin/pacman --noconfirm -S zip
+          git clone --depth=1 https://github.com/libjpeg-turbo/buildscripts.git -b $BRANCH c:/buildscripts
+      - name: Configure GPG signing
+        if: ${{github.event_name != 'pull_request'}}
+        shell: bash
+        run: |
+          printf "${{secrets.GPG_KEY}}" | base64 --decode | gpg --batch --import -
+          echo "GPG_KEY_NAME=\"${{secrets.GPG_KEY_NAME}}\"" >c:/buildscripts/gpgsign
+          echo "GPG_KEY_ID=${{secrets.GPG_KEY_ID}}" >>c:/buildscripts/gpgsign
+          echo "GPG_KEY_PASS=${{secrets.GPG_KEY_PASS}}" >>c:/buildscripts/gpgsign
+      - name: Cache installers
+        uses: actions/cache@v4
+        with:
+          path: c:/installers
+          key: installers-${{github.job}}-${{env.BRANCH}}
+      - name: Build
+        shell: bash
+        run: |
+          export PATH="/c/nasm-2.10.01:/c/Program Files (x86)/NSIS/:$PATH"
+          export VSINSTALLDIR='C:\Program Files\Microsoft Visual Studio\2022\Enterprise\'
+          eval "$(c:/vcvars-bash/vcvarsall.sh amd64)"
+          echo INCLUDE=$INCLUDE
+          echo LIB=$LIB
+          echo PATH=$PATH
+          c:/buildscripts/buildljt -d $GITHUB_WORKSPACE -b /c/ljt.nightly -v
+          cmake --build . --target clean
+          mkdir win64
+          cd win64
+          c:/buildscripts/setupscripts/win64 -DCMAKE_C_FLAGS='-DWIN32 -D_WINDOWS -W4 -wd4100 -wd4127 -wd4245 -wd4324 -wd4701 -wd4702 -wd4706 -WX'
+          cd ..
+          ninja
+          c:/msys64/usr/bin/zip -j c:/ljt.nightly/files/libjpeg-turbo-installers.zip c:/ljt.nightly/files/libjpeg-turbo-*.exe
+      - name: Configure AWS
+        if: ${{github.event_name != 'pull_request'}}
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          aws-access-key-id: ${{secrets.AWS_ACCESS_KEY_ID}}
+          aws-secret-access-key: ${{secrets.AWS_SECRET_ACCESS_KEY}}
+          aws-region: ${{secrets.AWS_REGION}}
+      - name: Deploy
+        if: ${{github.event_name != 'pull_request'}}
+        shell: bash
+        run: |
+          aws s3 sync --acl public-read --delete c:/ljt.nightly/files s3://libjpeg-turbo-pr/${{env.BRANCH}}/${{github.job}}/
+      - name: Upload unsigned artifact
+        if: ${{github.event_name == 'push' && contains(github.ref, 'refs/tags/')}}
+        id: upload-unsigned-artifact
+        uses: actions/upload-artifact@v4
+        with:
+          path: c:/ljt.nightly/files/libjpeg-turbo-installers.zip
+      - name: Sign artifact
+        if: ${{github.event_name == 'push' && contains(github.ref, 'refs/tags/')}}
+        uses: signpath/github-action-submit-signing-request@v1.1
+        with:
+          api-token: ${{secrets.SIGNPATH_API_TOKEN}}
+          organization-id: 3bc964ce-257b-4362-829f-1df1f087f5a0
+          project-slug: libjpeg-turbo
+          signing-policy-slug: release-signing
+          github-artifact-id: ${{steps.upload-unsigned-artifact.outputs.artifact-id}}
+          wait-for-completion: true
   linux-asan-ubsan:
     runs-on: ubuntu-latest
     steps:
diff --git a/appveyor.yml b/appveyor.yml
deleted file mode 100644
index 9cc9c073..00000000
--- a/appveyor.yml
+++ /dev/null
@@ -1,123 +0,0 @@
-image: Visual Studio 2022
-
-install:
-  - cmd: >-
-      if not exist c:\installers mkdir c:\installers
-
-      mkdir c:\temp
-
-      if not exist c:\installers\nasm-2.10.01-win32.zip curl -fSL -o c:\installers\nasm-2.10.01-win32.zip https://nasm.us/pub/nasm/releasebuilds/2.10.01/win32/nasm-2.10.01-win32.zip
-
-      7z x c:\installers\nasm-2.10.01-win32.zip -oc:\ > c:\installers\nasm.install.log
-
-      if not exist c:\installers\i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z curl -fSL -o c:\installers\i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z "https://sourceforge.net/projects/mingw-w64/files/Toolchains%%20targetting%%20Win32/Personal%%20Builds/mingw-builds/6.4.0/threads-posix/dwarf/i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z"
-
-      md "c:\Program Files (x86)\mingw-w64\i686-6.4.0-posix-dwarf-rt_v5-rev0"
-
-      7z x c:\installers\i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z -o"c:\Program Files (x86)\mingw-w64\i686-6.4.0-posix-dwarf-rt_v5-rev0" > c:\installers\mingw32.install.log
-
-      if not exist c:\installers\x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z curl -fSL -o c:\installers\x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z "https://sourceforge.net/projects/mingw-w64/files/Toolchains%%20targetting%%20Win64/Personal%%20Builds/mingw-builds/6.4.0/threads-posix/seh/x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z"
-
-      md "c:\Program Files\mingw-w64\x86_64-6.4.0-posix-seh-rt_v5-rev0"
-
-      7z x c:\installers\x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z -o"c:\Program Files\mingw-w64\x86_64-6.4.0-posix-seh-rt_v5-rev0" > c:\installers\mingw64.install.log
-
-      set PATH=c:\nasm-2.10.01;c:\Program Files (x86)\NSIS;c:\msys64\usr\bin;%PATH%
-
-      "C:\Program Files\Microsoft Visual Studio\2022\Community\VC\Auxiliary\Build\vcvarsall.bat" amd64
-
-      if not exist c:\installers\OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip curl -fSL -o c:\installers\OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip https://github.com/adoptium/temurin21-binaries/releases/download/jdk-21.0.7%%2B6/OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip
-
-      7z x c:\installers\OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip -o%ProgramData%\Oracle > c:\installers\openjdk-arm64.install.log
-
-      move "%ProgramData%\Oracle\jdk-21.0.7+6" %ProgramData%\Oracle\JavaArm64
-
-      set INCLUDE
-
-      set LIB
-
-      set PATH
-
-      set MSYSTEM=MINGW32
-
-      bash -c "pacman --noconfirm -S zip"
-
-      mklink /d %ProgramData%\Oracle\Java32 "c:\Program Files (x86)\Java\jdk1.8.0"
-
-      mklink /d %ProgramData%\Oracle\Java\javapath "c:\Program Files\Java\jdk1.8.0"
-
-      git clone --depth=1 https://github.com/libjpeg-turbo/buildscripts.git -b %APPVEYOR_REPO_BRANCH% c:/buildscripts
-
-cache:
-  - c:\installers\nasm-2.10.01-win32.zip -> appveyor.yml
-  - c:\installers\i686-6.4.0-release-posix-dwarf-rt_v5-rev0.7z -> appveyor.yml
-  - c:\installers\x86_64-6.4.0-release-posix-seh-rt_v5-rev0.7z -> appveyor.yml
-  - c:\installers\OpenJDK21U-jdk_aarch64_windows_hotspot_21.0.7_6.zip -> appveyor.yml
-
-build_script:
-  - cmd: >-
-      for /f %%i in ('"cygpath %CD%"') do set MINGWPATH=%%i
-
-      bash c:/buildscripts/buildljt -d %MINGWPATH% -b /c/ljt.nightly -v
-
-      cmake --build . --target clean
-
-      md win64
-
-      cd win64
-
-      bash c:/buildscripts/setupscripts/win64 -DCMAKE_C_FLAGS='-DWIN32 -D_WINDOWS -W4 -wd4100 -wd4127 -wd4245 -wd4324 -wd4701 -wd4702 -wd4706 -WX'
-
-      cd ..
-
-      ninja
-
-      move c:\ljt.nightly\files\*.tar.gz .
-
-      move c:\ljt.nightly\files\*.exe .
-
-      move c:\ljt.nightly\files\*.html .
-
-      move c:\ljt.nightly\log-windows.txt .
-
-      zip libjpeg-turbo-installers.zip libjpeg-turbo-*.exe
-
-artifacts:
-  - path: '*.tar.gz'
-    name: Source tarball
-
-  - path: '*-gcc*.exe'
-    name: SDK for MinGW
-
-  - path: '*-vc*.exe'
-    name: SDK for Visual C++
-
-  - path: '*.zip'
-    name: All libjpeg-turbo installers
-
-  - path: 'log-windows.txt'
-    name: Build log
-
-  - path: 'index.html'
-    name: MD5 checksums
-
-test: off
-
-deploy:
-  - provider: Webhook
-    url: https://app.signpath.io/API/v1/3bc964ce-257b-4362-829f-1df1f087f5a0/Integrations/AppVeyor?ProjectSlug=libjpeg-turbo&SigningPolicySlug=release-signing
-    authorization:
-      secure: rrx5wnu5VWQqrFZJv75WdPc1H5gyYqp7cV/xVhsx1TnVR7VyUaVEiCYm/64Fcx1zmEPHGyEBrlrbjuRHgDjURA==
-    on:
-      appveyor_repo_tag: true
-  - provider: S3
-    access_key_id:
-      secure: Z74OYogQ6bNV/I+6b5ZEXig74+6MW2WLER0v/bPM/uk=
-    secret_access_key:
-      secure: cyGZhHVCFwZ9jgf5lXoW69mVtECmqwx3eLo61ha8ueWbMYlHho7lwDXwVvxOFiCa
-    bucket: libjpeg-turbo-pr
-    region:
-      secure: qSElYBgBRcEUf88M6Osthw==
-    folder: $(APPVEYOR_REPO_BRANCH)/windows
-    set_public: true
-    remove_files: true