diff --git a/changelog.d/gsta-217-fixturegit-status.md b/changelog.d/gsta-217-fixturegit-status.md
index bb1bc02d1..5670ac788 100644
--- a/changelog.d/gsta-217-fixturegit-status.md
+++ b/changelog.d/gsta-217-fixturegit-status.md
@@ -1,4 +1,4 @@
-**A CSO hardening test now fails at the Git step that broke instead of passing without testing anything.** `fixtureGit` in `test/cso-git-hardening.test.ts` threw only on a non-zero exit status. When Git was killed by its 30-second timeout or could not start, `spawnSync` returned a `null` status, and the helper treated that as success. If that happened to the `git replace` step, the test that checks a security snapshot ignores replaced history would pass without a replacement in place. The helper now throws on a spawn error or any status other than 0, and the message names the Git arguments, the status and the signal.
+**A CSO hardening test now fails at the Git step that broke instead of passing without testing anything.** `fixtureGit` in `test/cso-git-hardening.test.ts` threw only on a non-zero exit status. When Git was killed by its 30-second timeout or could not start, `spawnSync` returned a `null` status, and the helper treated that as success. If that happened to the `git replace` step, the test that checks a security snapshot ignores replaced history would pass without a replacement in place. The helper now throws on a spawn error or any status other than 0, and the message names the Git arguments, the status and the signal. The stricter helper showed that the file's warm-up step had been calling `/usr/bin/git` on Windows, where it doesn't exist, on every run. It was passing only because the error was swallowed. Every test in the file already skips on Windows, so the warm-up now skips there too.
 
 ### Tests
-- `test/cso-git-hardening.test.ts`: `fixtureGit` throws on `result.error` or `status !== 0` (#3476).
+- `test/cso-git-hardening.test.ts`: `fixtureGit` throws on `result.error` or `status !== 0` (#3476), and the `beforeAll` warm-up returns early on Windows (Windows Free Tests run 41236157469 failed in it with `ENOENT … uv_spawn '/usr/bin/git'` once the error stopped being swallowed).
diff --git a/test/cso-git-hardening.test.ts b/test/cso-git-hardening.test.ts
index 5bf3f1657..99021e7d4 100644
--- a/test/cso-git-hardening.test.ts
+++ b/test/cso-git-hardening.test.ts
@@ -25,7 +25,9 @@ function seedRepo(repo:string,home:string){
   return git;
 }
 // The first /usr/bin/git spawns on a cold macOS runner can eat a test's whole 5 s budget before the code under test runs; pay them once here.
+// Every test below skips on Windows, which has no /usr/bin/git, so the warm-up does too.
 beforeAll(()=>{
+  if(process.platform==='win32')return;
   const warm=fs.realpathSync(fs.mkdtempSync(path.join(os.tmpdir(),'cso-git-hardening-warm-')));
   try{seedRepo(path.join(warm,'repo'),warm);}finally{fs.rmSync(warm,{recursive:true,force:true});}
 },{timeout:30_000});