diff --git a/.gitattributes b/.gitattributes
index 923ad11d..77a87065 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -15,3 +15,7 @@ pkg/portaudio/pa_src/** linguist-vendored
 # core.autocrlf — the default on Windows, including the CI runners — rewrites
 # them to CRLF and every frame mismatches.
 cmd/lk/testdata/vrt/*.txt text eol=lf
+
+# The same holds for the testscript scripts: their expected stdout and stderr
+# are compared byte for byte against lk's LF output.
+cmd/lk/testdata/script/*.txtar text eol=lf
diff --git a/cmd/lk/script_test.go b/cmd/lk/script_test.go
index dc77cfca..0eac672c 100644
--- a/cmd/lk/script_test.go
+++ b/cmd/lk/script_test.go
@@ -62,7 +62,6 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
-	"runtime"
 	"slices"
 	"strconv"
 	"strings"
@@ -80,14 +79,6 @@ func TestMain(m *testing.M) {
 }
 
 func TestScripts(t *testing.T) {
-	if runtime.GOOS == "windows" {
-		// Three things stop the scripts on Windows: Go reports mode 0666 for
-		// every file there, so config.LoadOrCreate warns on each run that the
-		// config file should be 0600; testscript sets the home directory
-		// through USERPROFILE, which setupScript doesn't; and a Windows
-		// checkout writes the .txtar files with CRLF endings.
-		t.Skip("lk warns about the config file's permissions on every Windows run, and the scripts need USERPROFILE and LF checkouts")
-	}
 	testscript.Run(t, testscript.Params{
 		Dir:   filepath.Join("testdata", "script"),
 		Setup: setupScript,
@@ -107,6 +98,7 @@ type fakeCloudKey struct{}
 func setupScript(env *testscript.Env) error {
 	home := filepath.Join(env.WorkDir, "home")
 	env.Setenv("HOME", home)
+	env.Setenv("USERPROFILE", home) // the home directory on Windows
 	// lk warns about a config file anyone else can read, and txtar files are
 	// written 0644.
 	err := os.Chmod(filepath.Join(home, ".livekit", "cli-config.yaml"), 0o600)
diff --git a/cmd/lk/testdata/script/config-permissions-warning.txtar b/cmd/lk/testdata/script/config-permissions-warning.txtar
new file mode 100644
index 00000000..32e1515e
--- /dev/null
+++ b/cmd/lk/testdata/script/config-permissions-warning.txtar
@@ -0,0 +1,14 @@
+# A config file others can read gets a warning, since it holds API secrets,
+# except on Windows, where file modes don't say who can read it.
+chmod 0644 home/.livekit/cli-config.yaml
+exec lk project list
+[!windows] stderr 'should have permissions 600'
+[windows] ! stderr 'should have permissions'
+
+-- home/.livekit/cli-config.yaml --
+projects:
+  - name: one
+    project_id: p_1
+    url: ws://one.test
+    api_key: APIone
+    api_secret: secretone
diff --git a/pkg/config/config.go b/pkg/config/config.go
index 8e54ceea..2b3d8951 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -19,6 +19,7 @@ import (
 	"fmt"
 	"os"
 	"path"
+	"runtime"
 	"strings"
 	"time"
 
@@ -332,9 +333,11 @@ func LoadOrCreate() (*CLIConfig, error) {
 		return c, nil
 	} else if err != nil {
 		return nil, err
-	} else if s.Mode().Perm()&0077 != 0 {
+	} else if runtime.GOOS != "windows" && s.Mode().Perm()&0077 != 0 {
 		// because this file contains private keys, warn that
-		// only the owner should have permission to access it
+		// only the owner should have permission to access it. Go reports
+		// 0666 for every writable file on Windows (0444 if read-only), so
+		// the mode says nothing there.
 		util.Warnf("WARNING: config file %s should have permissions %o", configPath, 0600)
 	}