diff --git a/.changeset/registry-verification-windows.md b/.changeset/registry-verification-windows.md
new file mode 100644
index 0000000000..82aafb6474
--- /dev/null
+++ b/.changeset/registry-verification-windows.md
@@ -0,0 +1,5 @@
+---
+"@emdash-cms/registry-verification": patch
+---
+
+Fixes site builds on Windows failing when the plugin registry verifier is imported.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76e6ef78bf..e548459064 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -135,6 +135,9 @@ jobs:
       # leave them unbuilt and their tests would fail to resolve workspace
       # links to dist/.
       - run: pnpm run --filter emdash... --filter "@emdash-cms/aggregator" --filter "@emdash-cms/labeler" --filter "@emdash-cms/plugin-cli" --filter "@emdash-cms/registry-*" --filter "@emdash-cms/plugin-types" build
+      - name: Check registry-verification package
+        if: matrix.shardIndex == 1
+        run: pnpm --filter @emdash-cms/registry-verification test:package
       - run: pnpm --filter emdash exec vitest run --shard=${{ matrix.shardIndex }}/${{ matrix.shardTotal }}
         env:
           EMDASH_TEST_PG: postgres://postgres:test@localhost:5432/emdash_test
diff --git a/apps/release-action/dist/index.js b/apps/release-action/dist/index.js
index 4ced05bfd7..39d2f9e2d6 100644
--- a/apps/release-action/dist/index.js
+++ b/apps/release-action/dist/index.js
@@ -8161,7 +8161,7 @@ function createGzipDecoder() {
 //#endregion
 //#region ../../packages/registry-verification/dist/index.js
 var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __require = /* @__PURE__ */ createRequire("file:///emdash-registry-verification.js");
+var __require = /* @__PURE__ */ createRequire("file:///C:/emdash-registry-verification.js");
 const DEFAULT_FETCH_LIMITS = {
 	headerTimeoutMs: 1e4,
 	totalTimeoutMs: 3e4,
diff --git a/packages/registry-verification/scripts/check-packed-output.mjs b/packages/registry-verification/scripts/check-packed-output.mjs
index 7360cf58e3..e91ffd1883 100644
--- a/packages/registry-verification/scripts/check-packed-output.mjs
+++ b/packages/registry-verification/scripts/check-packed-output.mjs
@@ -1,9 +1,12 @@
+import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 import { createReadStream } from "node:fs";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
+import { createRequire } from "node:module";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { pipeline } from "node:stream/promises";
+import { fileURLToPath } from "node:url";
 import { createGunzip } from "node:zlib";
 
 import { unpackTar } from "modern-tar/fs";
@@ -42,6 +45,17 @@ try {
 	if (publishedOutput.includes("createRequire(import.meta.url)")) {
 		throw new Error("Packed verifier output cannot be safely rebundled");
 	}
+	const requireUrl = publishedOutput.match(/createRequire\("([^"\n]+)"\)/)?.[1];
+	if (!requireUrl) {
+		throw new Error("Packed verifier output is missing the CJS interop shim");
+	}
+	// Check both path conventions regardless of the platform running this test.
+	fileURLToPath(requireUrl, { windows: true });
+	fileURLToPath(requireUrl, { windows: false });
+	const require = createRequire(requireUrl);
+	assert.equal(typeof require("crypto").createHash, "function");
+	assert.equal(typeof require("util").promisify, "function");
+
 	if (
 		publishedBundleOutput.includes("createRequire") ||
 		publishedBundleOutput.includes("@sigstore") ||
diff --git a/packages/registry-verification/tsdown.config.ts b/packages/registry-verification/tsdown.config.ts
index 4db5fe2093..a5b51b989b 100644
--- a/packages/registry-verification/tsdown.config.ts
+++ b/packages/registry-verification/tsdown.config.ts
@@ -2,12 +2,13 @@ import { defineConfig } from "tsdown";
 
 // Consumers rebundle this artifact, where import.meta.url may no longer name a file.
 // The generated require only resolves Node builtins, so a stable absolute base is sufficient.
+// A drive letter keeps the synthetic URL valid on Windows.
 const rebundleSafeRequire = {
 	name: "rebundle-safe-require",
 	renderChunk(code: string) {
 		return code.replace(
 			"createRequire(import.meta.url)",
-			'createRequire("file:///emdash-registry-verification.js")',
+			'createRequire("file:///C:/emdash-registry-verification.js")',
 		);
 	},
 };