diff --git a/.github/workflows/pack-upload.yml b/.github/workflows/pack-upload.yml
index 4369ad3c65..cb3b6301d2 100644
--- a/.github/workflows/pack-upload.yml
+++ b/.github/workflows/pack-upload.yml
@@ -104,3 +104,26 @@ jobs:
           pwd
           yarn oclif upload tarballs
           ./scripts/upload/deb
+
+  pack-and-upload-windows:
+    runs-on: ubuntu-latest
+    env:
+      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: lts/*
+          cache: yarn
+      - name: Set up Homebrew
+        id: set-up-homebrew
+        uses: Homebrew/actions/setup-homebrew@41775cf0c82ef066f1eb39cea1bd74697ca5b735
+      - name: Install NSIS
+        run: brew install nsis
+      - name: yarn install
+        run: yarn --immutable --network-timeout 1000000
+      - name: pack windows installer
+        run: yarn pack:win
+      - name: upload windows installer
+        run: yarn upload:win
diff --git a/.github/workflows/promote.yml b/.github/workflows/promote.yml
index 9d75182bfe..9cf9d64b84 100644
--- a/.github/workflows/promote.yml
+++ b/.github/workflows/promote.yml
@@ -60,6 +60,7 @@ jobs:
         run: |
           SHA=$(npm view heroku@${{ inputs.version }} --json | jq -r '.gitHead[0:7]')
           yarn oclif promote --deb --xz --root="./packages/cli" --sha="$SHA" --indexes --version=${{ inputs.version }} --channel=${{ fromJSON(inputs.isStableRelease) && 'stable' || env.prerelease-channel }}
+          yarn oclif promote --win --xz --root="./packages/cli" --sha="$SHA" --indexes --version=${{ inputs.version }} --channel=${{ fromJson(inputs.isStableRelease) && 'stable' || env.prerelease-channel }}
         shell: bash
       - name: promote Linux install scripts
         run: node ./scripts/postrelease/install_scripts.js
diff --git a/packages/cli/package.json b/packages/cli/package.json
index e1187ea1b9..910c5d554b 100644
--- a/packages/cli/package.json
+++ b/packages/cli/package.json
@@ -323,20 +323,25 @@
       "heroku-sudo": "@heroku/sudo",
       "heroku-webhooks": null,
       "sudo": "@heroku/sudo"
+    },
+    "windows": {
+      "name": "Heroku CLI"
     }
   },
   "repository": "heroku/cli",
   "scripts": {
-    "lint": "eslint . --ext .ts --config ../../.eslintrc --ignore-path ../../.eslintignore-lib",
     "build": "rm -rf lib && tsc",
+    "lint": "eslint . --ext .ts --config ../../.eslintrc --ignore-path ../../.eslintignore-lib",
+    "pack:win": "oclif pack:win --defender-exclusion hidden",
     "postpublish": "rm -f oclif.manifest.json",
+    "posttest": "yarn lint",
     "prepack": "yarn run build && oclif manifest",
     "pretest": "tsc -p test --noEmit && cd ../.. && yarn build",
-    "test": "yarn pretest && nyc mocha --forbid-only \"test/**/*.unit.test.ts\" && yarn posttest",
     "test:acceptance": "yarn pretest && mocha --forbid-only \"test/**/*.acceptance.test.ts\" && node ./bin/bats-test-runner",
     "test:integration": "yarn pretest && mocha --forbid-only \"test/**/*.integration.test.ts\"",
     "test:smoke": "yarn pretest && mocha --forbid-only \"test/**/smoke.acceptance.test.ts\"",
-    "posttest": "yarn lint",
+    "test": "yarn pretest && nyc mocha --forbid-only \"test/**/*.unit.test.ts\" && yarn posttest",
+    "upload:win": "oclif upload:win",
     "version": "oclif readme --multi && git add README.md ../../docs"
   },
   "types": "lib/index.d.ts"