diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 38cf690198..ebbcbd9410 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -254,7 +254,7 @@ elseif (MULTI_THREAD)
     set(CMAKE_CXX_FLAGS_RELWITHDEBINFO "/MT ${CMAKE_CXX_FLAGS_RELWITHDEBINFO}")
 endif ()
 
-if ("${CMAKE_SYSTEM_NAME}" MATCHES "Emscripten")
+if("${CMAKE_SYSTEM_NAME}" MATCHES "Emscripten")
   include_directories(${GMP_INSTALL_PREFIX}/include)
   set(GMP_LIBRARIES "${GMP_INSTALL_PREFIX}/lib/libgmp.a")
 else()
@@ -291,6 +291,9 @@ if(${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
   set(LEANC_STATIC_LINKER_FLAGS "-lleancpp -lInit -lStd -lLean")
 elseif(${CMAKE_SYSTEM_NAME} MATCHES "Emscripten")
   set(LEANC_STATIC_LINKER_FLAGS "-lleancpp -lInit -lStd -lLean -lnodefs.js")
+elseif(${CMAKE_SYSTEM_NAME} MATCHES "Windows")
+  # `-pie` defaulting is not consistent on Linux distributions, so let's default to off
+  set(LEANC_STATIC_LINKER_FLAGS "-no-pie -Wl,--start-group -lleancpp -lInit -lStd -lLean -Wl,--end-group -lbcrypt")
 else()
   # `-pie` defaulting is not consistent on Linux distributions, so let's default to off
   set(LEANC_STATIC_LINKER_FLAGS "-no-pie -Wl,--start-group -lleancpp -lInit -lStd -lLean -Wl,--end-group")
diff --git a/src/runtime/io.cpp b/src/runtime/io.cpp
index 8aa32f7035..a405775bb5 100644
--- a/src/runtime/io.cpp
+++ b/src/runtime/io.cpp
@@ -7,6 +7,7 @@ Authors: Leonardo de Moura, Sebastian Ullrich
 #if defined(LEAN_WINDOWS)
 #include <windows.h>
 #include <io.h>
+#include <ntdef.h>
 #include <bcrypt.h>
 #elif defined(__APPLE__)
 #include <mach-o/dyld.h>
@@ -405,14 +406,14 @@ extern "C" obj_res lean_io_get_random_bytes (size_t nbytes, obj_arg /* w */) {
     while (remain > 0) {
 #if defined(LEAN_WINDOWS)
         // Prevent ULONG (32-bit) overflow
-        size_t read_sz = std::min(remain, std::numeric_limits<uint32_t>::max());
+        size_t read_sz = std::min(remain, static_cast<size_t>(std::numeric_limits<uint32_t>::max()));
         NTSTATUS status = BCryptGenRandom(
             NULL,
             lean_sarray_cptr(res),
             static_cast<ULONG>(read_sz),
             BCRYPT_USE_SYSTEM_PREFERRED_RNG
         );
-        if (status != STATUS_SUCCESS) {
+        if (!NT_SUCCESS(status)) {
             dec_ref(res);
             return io_result_mk_error("BCryptGenRandom failed");
         }