diff --git a/.github/workflows/ansible-test-windows.yml b/.github/workflows/ansible-test-windows.yml
index 34b12011..9bd44493 100644
--- a/.github/workflows/ansible-test-windows.yml
+++ b/.github/workflows/ansible-test-windows.yml
@@ -43,7 +43,7 @@ jobs:
 
   integration:
     runs-on: ${{ matrix.os }}
-    name: I (Ⓐ${{ matrix.ansible }}+win-2022|grp${{ matrix.group }})
+    name: I (Ⓐ${{ matrix.ansible }}+win-2025|grp${{ matrix.group }})
     # Historically ~17m avg, ~21m max; guard against hung WSL/SQL Server setup
     timeout-minutes: 45
     continue-on-error: ${{ matrix.ansible == 'devel' }}
@@ -51,7 +51,7 @@ jobs:
       fail-fast: false
       matrix:
         os:
-          - windows-2022
+          - windows-2025
         wsl:
           - Ubuntu-24.04
         ansible:
@@ -98,19 +98,11 @@ jobs:
       - name: Set up the runner for PowerShell remoting
         shell: powershell
         run: |
-          $sb = [ScriptBlock]::Create((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/38e50c9f819a045ea4d40068f83e78adbfaf2e68/examples/scripts/ConfigureRemotingForAnsible.ps1'))
+          # Pinned to a commit in the current home of this script; latest version at
+          # https://github.com/ansible/ansible-documentation/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1
+          $sb = [ScriptBlock]::Create((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible-documentation/b8cf495929aa200a11abc7468d1fb6cd9c0e1613/examples/scripts/ConfigureRemotingForAnsible.ps1'))
           & $sb -Verbose -ForceNewSSLCert 4>&1
 
-      - name: Enable winrm
-        shell: powershell
-        run: |
-          winrm quickconfig -force
-
-      - name: Why is MongoDB running? Disable it.
-        shell: powershell
-        run: |
-          Get-Service -Name MongoDB | Where-Object Status -eq 'Running' | Stop-Service -Force
-
       - name: Add a hosts entry  # zizmor: ignore[misfeature] -- Windows-specific cmd required for hosts file modification
         shell: cmd
         run: echo 127.0.0.1 sqlserver >> "%WinDir%\System32\Drivers\etc\hosts"
@@ -121,11 +113,21 @@ jobs:
           update: "false"
           use-cache: "true"
           wsl-version: 1
-          additional-packages: |
-            git
-            ${{ matrix.python }}
-            python3-pip
-            openssh-client
+
+      # archive.ubuntu.com/security.ubuntu.com occasionally serve a Packages file that doesn't
+      # match the just-fetched InRelease hash (mirror mid-sync). Retrying almost always succeeds,
+      # so do our own apt-get here instead of relying on setup-wsl's one-shot additional-packages.
+      - name: Install WSL packages (with retry)  # zizmor: ignore[template-injection] -- matrix.python is a controlled enum value (python3)
+        run: |
+          echo 'Acquire::Retries "3";' | sudo tee /etc/apt/apt.conf.d/80-retries > /dev/null
+          for attempt in 1 2 3; do
+            if sudo apt-get update && sudo apt-get install -y git ${{ matrix.python }} python3-pip openssh-client; then
+              exit 0
+            fi
+            echo "apt-get failed (attempt $attempt), retrying..."
+            sleep 10
+          done
+          exit 1
 
       - name: Get Linux workspace path
         shell: pwsh