diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 6efc410..a6697f0 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -103,10 +103,15 @@ jobs:
           - "3.10"
           - "3.11"
           - "3.12"
-        os: [ubuntu-20.04, macos-11]
+        os: [ubuntu-latest, macos-latest, windows-latest]
         exclude:
-          - os: macos-11
+          - os: macos-latest
+            python-version: "3.7"
+          - os: macos-latest
             python-version: "pypy-3.10"
+        include:
+          - python-version: "3.7"
+            os: macos-12
 
     steps:
       - name: checkout
@@ -121,15 +126,32 @@ jobs:
       # to save the cache. So it must come before the thing we want to use
       # the cache.
       ###
-      - name: Get pip cache dir
-        id: pip-cache
+      - name: Get pip cache dir (default)
+        id: pip-cache-default
+        if: ${{ !startsWith(runner.os, 'Windows') }}
         run: |
           echo "dir=$(pip cache dir)" >>$GITHUB_OUTPUT
 
-      - name: pip cache
+      - name: Get pip cache dir (Windows)
+        id: pip-cache-windows
+        if: ${{ startsWith(runner.os, 'Windows') }}
+        run: |
+          echo "dir=$(pip cache dir)" >> $Env:GITHUB_OUTPUT
+
+      - name: pip cache (default)
         uses: actions/cache@v4
+        if: ${{ !startsWith(runner.os, 'Windows') }}
         with:
-          path: ${{ steps.pip-cache.outputs.dir }}
+          path: ${{ steps.pip-cache-default.outputs.dir }}
+          key: ${{ runner.os }}-pip-${{ matrix.python-version }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: pip cache (Windows)
+        uses: actions/cache@v4
+        if: ${{ startsWith(runner.os, 'Windows') }}
+        with:
+          path: ${{ steps.pip-cache-windows.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ matrix.python-version }}
           restore-keys: |
             ${{ runner.os }}-pip-
@@ -137,7 +159,7 @@ jobs:
       - name: Install Build Dependencies
         run: |
           pip install -U pip
-          pip install -U setuptools wheel twine cffi
+          pip install -U setuptools wheel twine
           pip install -U zope.proxy
 
       - name: Build zope.security (macOS x86_64, Python 3.8+)
@@ -242,10 +264,15 @@ jobs:
           - "3.10"
           - "3.11"
           - "3.12"
-        os: [ubuntu-20.04, macos-11]
+        os: [ubuntu-latest, macos-latest, windows-latest]
         exclude:
-          - os: macos-11
+          - os: macos-latest
+            python-version: "3.7"
+          - os: macos-latest
             python-version: "pypy-3.10"
+        include:
+          - python-version: "3.7"
+            os: macos-12
 
     steps:
       - name: checkout
@@ -260,15 +287,32 @@ jobs:
       # to save the cache. So it must come before the thing we want to use
       # the cache.
       ###
-      - name: Get pip cache dir
-        id: pip-cache
+      - name: Get pip cache dir (default)
+        id: pip-cache-default
+        if: ${{ !startsWith(runner.os, 'Windows') }}
         run: |
           echo "dir=$(pip cache dir)" >>$GITHUB_OUTPUT
 
-      - name: pip cache
+      - name: Get pip cache dir (Windows)
+        id: pip-cache-windows
+        if: ${{ startsWith(runner.os, 'Windows') }}
+        run: |
+          echo "dir=$(pip cache dir)" >> $Env:GITHUB_OUTPUT
+
+      - name: pip cache (default)
         uses: actions/cache@v4
+        if: ${{ !startsWith(runner.os, 'Windows') }}
         with:
-          path: ${{ steps.pip-cache.outputs.dir }}
+          path: ${{ steps.pip-cache-default.outputs.dir }}
+          key: ${{ runner.os }}-pip-${{ matrix.python-version }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: pip cache (Windows)
+        uses: actions/cache@v4
+        if: ${{ startsWith(runner.os, 'Windows') }}
+        with:
+          path: ${{ steps.pip-cache-windows.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ matrix.python-version }}
           restore-keys: |
             ${{ runner.os }}-pip-
@@ -295,7 +339,9 @@ jobs:
       - name: Run tests without C extensions
         run:
           # coverage makes PyPy run about 3x slower!
-          PURE_PYTHON=1 python -m coverage run -p -m zope.testrunner --test-path=src --auto-color --auto-progress
+          python -m coverage run -p -m zope.testrunner --test-path=src --auto-color --auto-progress
+        env:
+          PURE_PYTHON: 1
       - name: Report Coverage
         run: |
           coverage combine
@@ -309,7 +355,7 @@ jobs:
 
   coveralls_finish:
     needs: test
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
     - name: Coveralls Finished
       uses: AndreMiras/coveralls-python-action@develop
@@ -322,7 +368,7 @@ jobs:
     strategy:
       matrix:
         python-version: ["3.9"]
-        os: [ubuntu-20.04]
+        os: [ubuntu-latest]
 
     steps:
       - name: checkout
@@ -337,15 +383,32 @@ jobs:
       # to save the cache. So it must come before the thing we want to use
       # the cache.
       ###
-      - name: Get pip cache dir
-        id: pip-cache
+      - name: Get pip cache dir (default)
+        id: pip-cache-default
+        if: ${{ !startsWith(runner.os, 'Windows') }}
         run: |
           echo "dir=$(pip cache dir)" >>$GITHUB_OUTPUT
 
-      - name: pip cache
+      - name: Get pip cache dir (Windows)
+        id: pip-cache-windows
+        if: ${{ startsWith(runner.os, 'Windows') }}
+        run: |
+          echo "dir=$(pip cache dir)" >> $Env:GITHUB_OUTPUT
+
+      - name: pip cache (default)
+        uses: actions/cache@v4
+        if: ${{ !startsWith(runner.os, 'Windows') }}
+        with:
+          path: ${{ steps.pip-cache-default.outputs.dir }}
+          key: ${{ runner.os }}-pip-${{ matrix.python-version }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: pip cache (Windows)
         uses: actions/cache@v4
+        if: ${{ startsWith(runner.os, 'Windows') }}
         with:
-          path: ${{ steps.pip-cache.outputs.dir }}
+          path: ${{ steps.pip-cache-windows.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ matrix.python-version }}
           restore-keys: |
             ${{ runner.os }}-pip-
@@ -373,7 +436,7 @@ jobs:
     strategy:
       matrix:
         python-version: ["3.9"]
-        os: [ubuntu-20.04]
+        os: [ubuntu-latest]
 
     steps:
       - name: checkout
@@ -388,15 +451,32 @@ jobs:
       # to save the cache. So it must come before the thing we want to use
       # the cache.
       ###
-      - name: Get pip cache dir
-        id: pip-cache
+      - name: Get pip cache dir (default)
+        id: pip-cache-default
+        if: ${{ !startsWith(runner.os, 'Windows') }}
         run: |
           echo "dir=$(pip cache dir)" >>$GITHUB_OUTPUT
 
-      - name: pip cache
+      - name: Get pip cache dir (Windows)
+        id: pip-cache-windows
+        if: ${{ startsWith(runner.os, 'Windows') }}
+        run: |
+          echo "dir=$(pip cache dir)" >> $Env:GITHUB_OUTPUT
+
+      - name: pip cache (default)
         uses: actions/cache@v4
+        if: ${{ !startsWith(runner.os, 'Windows') }}
         with:
-          path: ${{ steps.pip-cache.outputs.dir }}
+          path: ${{ steps.pip-cache-default.outputs.dir }}
+          key: ${{ runner.os }}-pip-${{ matrix.python-version }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: pip cache (Windows)
+        uses: actions/cache@v4
+        if: ${{ startsWith(runner.os, 'Windows') }}
+        with:
+          path: ${{ steps.pip-cache-windows.outputs.dir }}
           key: ${{ runner.os }}-pip-${{ matrix.python-version }}
           restore-keys: |
             ${{ runner.os }}-pip-
@@ -420,7 +500,7 @@ jobs:
           # python -m pylint --limit-inference-results=1 --rcfile=.pylintrc zope.security -f parseable -r n
 
   manylinux:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     # We use a regular Python matrix entry to share as much code as possible.
     strategy:
@@ -441,15 +521,32 @@ jobs:
       # to save the cache. So it must come before the thing we want to use
       # the cache.
       ###
-      - name: Get pip cache dir
-        id: pip-cache
+      - name: Get pip cache dir (default)
+        id: pip-cache-default
+        if: ${{ !startsWith(runner.os, 'Windows') }}
         run: |
           echo "dir=$(pip cache dir)" >>$GITHUB_OUTPUT
 
-      - name: pip cache
+      - name: Get pip cache dir (Windows)
+        id: pip-cache-windows
+        if: ${{ startsWith(runner.os, 'Windows') }}
+        run: |
+          echo "dir=$(pip cache dir)" >> $Env:GITHUB_OUTPUT
+
+      - name: pip cache (default)
+        uses: actions/cache@v4
+        if: ${{ !startsWith(runner.os, 'Windows') }}
+        with:
+          path: ${{ steps.pip-cache-default.outputs.dir }}
+          key: ${{ runner.os }}-pip_manylinux-${{ matrix.image }}-${{ matrix.python-version }}
+          restore-keys: |
+            ${{ runner.os }}-pip-
+
+      - name: pip cache (Windows)
         uses: actions/cache@v4
+        if: ${{ startsWith(runner.os, 'Windows') }}
         with:
-          path: ${{ steps.pip-cache.outputs.dir }}
+          path: ${{ steps.pip-cache-windows.outputs.dir }}
           key: ${{ runner.os }}-pip_manylinux-${{ matrix.image }}-${{ matrix.python-version }}
           restore-keys: |
             ${{ runner.os }}-pip-
@@ -487,7 +584,7 @@ jobs:
           path: wheelhouse/*whl
           name: manylinux_${{ matrix.image }}_wheels.zip
       - name: Restore pip cache permissions
-        run: sudo chown -R $(whoami) ${{ steps.pip-cache.outputs.dir }}
+        run: sudo chown -R $(whoami) ${{ steps.pip-cache-default.outputs.dir }}
       - name: Publish package to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         if: >
diff --git a/.meta.toml b/.meta.toml
index 029b1eb..eacb9bf 100644
--- a/.meta.toml
+++ b/.meta.toml
@@ -2,11 +2,11 @@
 # https://github.com/zopefoundation/meta/tree/master/config/c-code
 [meta]
 template = "c-code"
-commit-id = "1351c95d"
+commit-id = "fbf8c395"
 
 [python]
 with-appveyor = true
-with-windows = false
+with-windows = true
 with-pypy = true
 with-future-python = false
 with-docs = true
@@ -63,13 +63,3 @@ additional-config = [
 additional-build-dependencies = [
     "zope.proxy",
     ]
-
-[appveyor]
-global-env-vars = [
-    "# Currently the builds use @mgedmin's Appveyor account.  The PyPI token belongs",
-    "# to zope.wheelbuilder, which is managed by @mgedmin and @dataflake.",
-    "TWINE_USERNAME: __token__",
-    "TWINE_PASSWORD:",
-    "  secure: aoZC/+rvJKg8B5GMGIxd1YDPcIbo2kSsckCbQ6o8fhIRqSyuhX1iLm21hgDEkq2ePuyQ7+cWnNvXGactxjzA4iUS5GCOuF/E6YTvS3nGcuoQuH607wn2hngzz1p4Z+5ClFPx27vZiRAFgBoTbIo8XODHC9qFYluZ68eiwxFOiCuXK9ONEjMn8LjoaNSPJYyJO3Wr8W5oLeYG+wGcNGuYVXEk5/LSDg5n17ujpL7qsVTdVNjTwgmtnv191n2ip1Sgh1O5Xm9eG7VDZSxr/xNMpw==",
-    "ZOPE_INTERFACE_STRICT_IRO: 1",
-    ]
diff --git a/CHANGES.rst b/CHANGES.rst
index f913d28..ccb30ab 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -5,7 +5,7 @@
 6.3 (unreleased)
 ----------------
 
-- Nothing changed yet.
+- Build windows wheels on GHA.
 
 
 6.2 (2023-10-05)
diff --git a/MANIFEST.in b/MANIFEST.in
index 2071494..e78cca3 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -5,7 +5,6 @@ include *.rst
 include *.txt
 include buildout.cfg
 include tox.ini
-include appveyor.yml
 include .coveragerc
 
 recursive-include docs *.py
diff --git a/README.rst b/README.rst
index c8a9203..2fe3b48 100644
--- a/README.rst
+++ b/README.rst
@@ -28,3 +28,4 @@ The Security framework provides a generic mechanism to implement security
 policies on Python objects.
 
 Documentation is available at https://zopesecurity.readthedocs.io/
+
diff --git a/appveyor.yml b/appveyor.yml
deleted file mode 100644
index 753d222..0000000
--- a/appveyor.yml
+++ /dev/null
@@ -1,49 +0,0 @@
-# Generated from:
-# https://github.com/zopefoundation/meta/tree/master/config/c-code
-environment:
-  # Currently the builds use @mgedmin's Appveyor account.  The PyPI token belongs
-  # to zope.wheelbuilder, which is managed by @mgedmin and @dataflake.
-  TWINE_USERNAME: __token__
-  TWINE_PASSWORD:
-    secure: aoZC/+rvJKg8B5GMGIxd1YDPcIbo2kSsckCbQ6o8fhIRqSyuhX1iLm21hgDEkq2ePuyQ7+cWnNvXGactxjzA4iUS5GCOuF/E6YTvS3nGcuoQuH607wn2hngzz1p4Z+5ClFPx27vZiRAFgBoTbIo8XODHC9qFYluZ68eiwxFOiCuXK9ONEjMn8LjoaNSPJYyJO3Wr8W5oLeYG+wGcNGuYVXEk5/LSDg5n17ujpL7qsVTdVNjTwgmtnv191n2ip1Sgh1O5Xm9eG7VDZSxr/xNMpw==
-  ZOPE_INTERFACE_STRICT_IRO: 1
-
-  matrix:
-    - python: 37-x64
-    - python: 38-x64
-    - python: 39-x64
-    - python: 310-x64
-    - python: 311-x64
-    - python: 312-x64
-
-install:
-  - "SET PYTHONVERSION=%PYTHON%"
-  - "SET PATH=C:\\Python%PYTHON%;c:\\Python%PYTHON%\\scripts;%PATH%"
-  - ps: |
-      $env:PYTHON = "C:\\Python${env:PYTHON}"
-      if (-not (Test-Path $env:PYTHON)) {
-        curl -o install_python.ps1 https://raw.githubusercontent.com/matthew-brett/multibuild/11a389d78892cf90addac8f69433d5e22bfa422a/install_python.ps1
-        .\install_python.ps1
-      }
-  - ps: if (-not (Test-Path $env:PYTHON)) { throw "No $env:PYTHON" }
-  - echo "C:\Program Files\Microsoft SDKs\Windows\v7.1\Bin\SetEnv.cmd" /x64 > "C:\Program Files (x86)\Microsoft Visual Studio 10.0\VC\bin\amd64\vcvars64.bat"
-  - python -m pip install -U pip
-  - pip install -U setuptools wheel
-  - pip install -U -e .[test]
-
-matrix:
-  fast_finish: true
-
-build_script:
-  - python -W ignore setup.py -q bdist_wheel
-
-test_script:
-  - zope-testrunner --test-path=src
-artifacts:
-  - path: 'dist\*.whl'
-    name: wheel
-
-deploy_script:
-  - ps: if ($env:APPVEYOR_REPO_TAG -eq $TRUE) { pip install twine; twine upload --skip-existing dist\*.whl }
-
-deploy: on