diff --git a/crypto/CMakeLists.txt b/crypto/CMakeLists.txt
index c7f3c22f4c3..9c5e63628a7 100644
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -607,6 +607,15 @@ function(build_libcrypto)
   endif()
   if(WIN32)
     target_link_libraries(${arg_NAME} PUBLIC ws2_32)
+    # MinGW (non-Clang) builds target Windows 7 (see the top-level
+    # CMakeLists.txt, which adds -D_WIN32_WINNT=_WIN32_WINNT_WIN7), so
+    # `crypto/rand_extra/windows.c` compiles under the AWSLC_WINDOWS_7_COMPAT
+    # branch and calls BCryptGenRandom from bcrypt.dll. On MSVC this is
+    # handled by `#pragma comment(lib, "bcrypt.lib")` in that file, but
+    # MinGW ignores that pragma so we need to add the link explicitly.
+    if(MINGW)
+      target_link_libraries(${arg_NAME} PUBLIC bcrypt)
+    endif()
   endif()
 
   if(AWSLC_LINK_THREADS)
diff --git a/crypto/rand_extra/windows.c b/crypto/rand_extra/windows.c
index 91bd66469dc..cdbb0826a19 100644
--- a/crypto/rand_extra/windows.c
+++ b/crypto/rand_extra/windows.c
@@ -16,7 +16,10 @@ OPENSSL_MSVC_PRAGMA(warning(push, 3))
 #include <windows.h>
 
 // ProcessPrng (from `bcryptprimitives.dll`) is only available on Windows 8+.
-#if !defined(__MINGW32__) && defined(_WIN32_WINNT) && _WIN32_WINNT <= _WIN32_WINNT_WIN7
+// Fall back to BCryptGenRandom when targeting Windows 7 or earlier. This applies
+// to both MSVC and MinGW-w64 toolchains; MinGW-w64 ships `bcrypt.h` and can link
+// against `libbcrypt.a` / `bcrypt.dll`.
+#if defined(_WIN32_WINNT) && _WIN32_WINNT <= _WIN32_WINNT_WIN7
 #define AWSLC_WINDOWS_7_COMPAT
 #endif