diff --git a/plain-dev/plain/dev/mkcert.py b/plain-dev/plain/dev/mkcert.py
index 3c99913bb5..76bbe9ff48 100644
--- a/plain-dev/plain/dev/mkcert.py
+++ b/plain-dev/plain/dev/mkcert.py
@@ -27,7 +27,8 @@ def setup_mkcert(self, *, force_reinstall: bool = False) -> None:
         # mkcert not found system-wide, download to the machine-level cache
         install_path = PLAIN_CACHE_PATH / "mkcert"
         install_path.mkdir(parents=True, exist_ok=True)
-        binary_path = install_path / "mkcert"
+        binary_name = "mkcert.exe" if platform.system() == "Windows" else "mkcert"
+        binary_path = install_path / binary_name
 
         if force_reinstall and binary_path.exists():
             click.secho("Removing existing mkcert binary...", bold=True)
diff --git a/plain-dev/tests/public/test_mkcert.py b/plain-dev/tests/public/test_mkcert.py
new file mode 100644
index 0000000000..575cf76626
--- /dev/null
+++ b/plain-dev/tests/public/test_mkcert.py
@@ -0,0 +1,23 @@
+import platform
+
+from plain.dev.mkcert import MkcertManager
+
+
+def test_windows_binary_gets_exe_extension(tmp_path, monkeypatch):
+    """On Windows, the downloaded mkcert binary must be named with a .exe
+    extension, or CreateProcess can't launch it via subprocess.run."""
+    monkeypatch.setattr("plain.dev.mkcert.PLAIN_CACHE_PATH", tmp_path)
+    monkeypatch.setattr(platform, "system", lambda: "Windows")
+    monkeypatch.setattr("plain.dev.mkcert.shutil.which", lambda name: None)
+
+    def fake_download(self, dest):
+        dest.write_bytes(b"fake binary")
+
+    monkeypatch.setattr(MkcertManager, "_download_mkcert", fake_download)
+    monkeypatch.setattr(MkcertManager, "install_ca", lambda self: None)
+    monkeypatch.setattr(MkcertManager, "_ca_files_exist", lambda self: True)
+
+    manager = MkcertManager()
+    manager.setup_mkcert()
+
+    assert manager.mkcert_bin.endswith(".exe")