diff --git a/builder/cc_builder.rs b/builder/cc_builder.rs
index 81b6918a965..c0c1864d148 100644
--- a/builder/cc_builder.rs
+++ b/builder/cc_builder.rs
@@ -412,14 +412,24 @@ impl CcBuilder {
                 "_STL_EXTRA_DISABLED_WARNINGS",
                 "4774 4987",
             ));
+        }
+
+        // Target Windows 7 (0x0601 == _WIN32_WINNT_WIN7) for any win7 target triple.
+        if target().contains("-win7-windows-") {
+            build_options.push(BuildOption::define("_WIN32_WINNT", "0x0601"));
+            emit_warning(format!(
+                "Setting _WIN32_WINNT to _WIN32_WINNT_WIN7 for {} target",
+                target()
+            ));
 
-            if target().ends_with("-win7-windows-msvc") {
-                // 0x0601 is the value of `_WIN32_WINNT_WIN7`
-                build_options.push(BuildOption::define("_WIN32_WINNT", "0x0601"));
-                emit_warning(format!(
-                    "Setting _WIN32_WINNT to _WIN32_WINNT_WIN7 for {} target",
-                    target()
-                ));
+            // Additional workaround for MinGW: the upstream C source
+            // (crypto/rand_extra/windows.c) gates the Win7 compat path
+            // (BCryptGenRandom) with `!defined(__MINGW32__)`, which prevents MinGW
+            // from using it even when `_WIN32_WINNT` targets Win7. We define
+            // AWSLC_WINDOWS_7_COMPAT directly to bypass that guard until the
+            // upstream fix lands: https://github.com/aws/aws-lc/pull/3239
+            if !is_like_msvc {
+                build_options.push(BuildOption::define("AWSLC_WINDOWS_7_COMPAT", ""));
             }
         }
     }
diff --git a/builder/cmake_builder.rs b/builder/cmake_builder.rs
index c0d8d4b2d0b..98b9da91e53 100644
--- a/builder/cmake_builder.rs
+++ b/builder/cmake_builder.rs
@@ -7,7 +7,7 @@ use crate::{
     allow_prebuilt_nasm, cargo_env, effective_target, emit_warning, execute_command,
     get_crate_cflags, is_crt_static, is_fips_build, is_no_asm, is_no_pregenerated_src,
     optional_env, optional_env_optional_crate_target, sanitizer, set_env, set_env_for_target,
-    should_build_jitter_entropy, target_arch, target_env, target_os, test_clang_cl_command,
+    should_build_jitter_entropy, target, target_arch, target_env, target_os, test_clang_cl_command,
     test_nasm_command, use_prebuilt_nasm, OutputLibType,
 };
 use std::collections::HashMap;
@@ -403,6 +403,14 @@ impl CmakeBuilder {
                 cmake_cfg.define("CMAKE_SYSTEM_PROCESSOR", arch);
             }
         }
+
+        // Workaround for win7-windows-gnu targets: the upstream C source gates the
+        // Win7 compat path with `!defined(__MINGW32__)`. CMakeLists.txt already sets
+        // _WIN32_WINNT for MinGW, but we must force AWSLC_WINDOWS_7_COMPAT until the
+        // upstream fix lands: https://github.com/aws/aws-lc/pull/3239
+        if target().contains("-win7-windows-gnu") {
+            cmake_cfg.cflag("-DAWSLC_WINDOWS_7_COMPAT");
+        }
     }
 
     /// Returns the architecture argument for `vcvarsall.bat`.
diff --git a/builder/main.rs b/builder/main.rs
index 41615db2c05..d3cb7f74deb 100644
--- a/builder/main.rs
+++ b/builder/main.rs
@@ -1066,6 +1066,14 @@ fn main() {
     );
     builder.build().unwrap();
 
+    // MinGW win7 targets use the BCryptGenRandom path (AWSLC_WINDOWS_7_COMPAT),
+    // which requires linking against bcrypt. MinGW ignores the MSVC
+    // `#pragma comment(lib, "bcrypt.lib")` in the source, so we link explicitly.
+    // See: https://github.com/aws/aws-lc/pull/3239
+    if target().contains("-win7-windows-gnu") {
+        println!("cargo:rustc-link-lib=bcrypt");
+    }
+
     println!(
         "cargo:include={}",
         setup_include_paths(&out_dir(), &manifest_dir).display()