diff --git a/.bazelrc b/.bazelrc
index 0e80f22bf7..b27a5fcc48 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -86,6 +86,12 @@ common:ci-windows --config=ci-bazel
 common:ci-windows --build_metadata=TAG_os=windows
 common:ci-windows --repo_contents_cache=D:/a/.cache/bazel-repo-contents-cache
 common:ci-windows --repository_cache=D:/a/.cache/bazel-repo-cache
+# llvm-mingw in the gnullvm toolchain does not ship libssp_nonshared, so the
+# default stack protector flags from rules_cc break C/C++ build scripts such as
+# aws-lc-sys. Override them for this Windows CI path until the toolchain setup
+# is fixed more centrally.
+common:ci-windows --copt=-fno-stack-protector
+common:ci-windows --host_copt=-fno-stack-protector
 
 # We prefer to run the build actions entirely remotely so we can dial up the concurrency.
 # We have platform-specific tests, so we want to execute the tests on all platforms using the strongest sandboxing available on each platform.
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index 16887afef0..cd0843bd54 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -170,6 +170,15 @@ jobs:
             # canary and release workflows should build `third_party/v8`.
             -//third_party/v8:all
           )
+          if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
+            # `code-mode` and `v8-poc` still pull the `v8` crate transitively even
+            # when `//third_party/v8:all` is excluded, so keep them out of the
+            # Windows stabilization loop for now.
+            bazel_targets+=(
+              -//codex-rs/code-mode:all
+              -//codex-rs/v8-poc:all
+            )
+          fi
 
           if [[ "${RUNNER_OS:-}" != "Windows" ]]; then
             # Bazel test sandboxes on macOS may resolve an older Homebrew `node`