diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index e35f589876..1d0b6d83db 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -31,7 +31,6 @@ jobs:
           - platform: arm64
             setenv: amd64_arm64
     env:
-      VCPKG_DEFAULT_TRIPLET: ${{ matrix.platform }}-windows-static
       BUILD_NUMBER: ${{ github.run_number }}
     steps:
       - name: Checkout
@@ -73,8 +72,10 @@ jobs:
           echo "VCPKG_INSTALLED=$installed" >> $env:GITHUB_ENV
           C:\vcpkg\vcpkg install `
             --overlay-ports=${{ github.workspace }}/win32/ports `
+            --triplet ${{ matrix.platform }}-windows-static `
             --x-feature=zlib `
             --x-feature=openpace `
+            --x-feature=tests `
             --x-manifest-root ${{ github.workspace }}/win32 `
             --x-install-root $installed
       - name: Install WIX
@@ -83,6 +84,11 @@ jobs:
         run: |
           $vsPath = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
           & "$vsPath\VC\Auxiliary\Build\vcvarsall.bat" ${{ matrix.setenv }} "&&" nmake /nologo /f Makefile.mak opensc.msi
+      - name: Test OpenSC
+        if: matrix.configuration == 'Release' && matrix.platform != 'arm64'
+        run: |
+          $vsPath = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -property installationPath
+          & "$vsPath\VC\Auxiliary\Build\vcvarsall.bat" ${{ matrix.setenv }} "&&" nmake /nologo /f Makefile.mak check
       - name: Archive artifacts
         id: upload-unsigned-artifact
         uses: actions/upload-artifact@v7
diff --git a/Makefile.mak b/Makefile.mak
index 0b4f486322..4948e513f3 100644
--- a/Makefile.mak
+++ b/Makefile.mak
@@ -5,5 +5,8 @@ default: all
 opensc.msi: all
 	cd win32 && $(MAKE) /nologo /f Makefile.mak opensc.msi && cd ..
 
+check: all
+	cd src\tests\unittests && $(MAKE) /nologo /f Makefile.mak check && cd ..\..\..
+
 all clean::
 	@for %%i in ( $(SUBDIRS) ) do ( cd %%i && $(MAKE) /nologo /f Makefile.mak $@ && cd ..)
diff --git a/src/Makefile.mak b/src/Makefile.mak
index 8dee619666..8b0917d6d5 100644
--- a/src/Makefile.mak
+++ b/src/Makefile.mak
@@ -16,7 +16,7 @@ SUBDIRS = $(SUBDIRS) smm
 !ENDIF
 
 !IF "$(TESTS_DEF)" == "/DENABLE_TESTS"
-SUBDIRS = $(SUBDIRS) tests
+SUBDIRS = $(SUBDIRS) tests\unittests
 !ENDIF
 
 all::
diff --git a/src/tests/unittests/Makefile.mak b/src/tests/unittests/Makefile.mak
index 998a55bc33..e4fa54fd6b 100644
--- a/src/tests/unittests/Makefile.mak
+++ b/src/tests/unittests/Makefile.mak
@@ -1,22 +1,48 @@
 TOPDIR = ..\..\..
 
-TARGETS = asn1 compression pkcs15filter check_macro_reference_loop \
-	strip_pkcs1_2_padding base64 parse_pkcs11_uri
+default: all
 
-OBJECTS = asn1.obj \
-	compression.obj \
-	pkcs15-emulator-filter.obj \
-	check_macro_reference_loop.obj \
-	strip_pkcs1_2_padding.obj \
-	parse_pkcs11_uri.obj \
-	$(TOPDIR)\win32\versioninfo.res
+!INCLUDE $(TOPDIR)\win32\Make.rules.mak
+
+TARGETS = asn1.exe base64.exe check_macro_reference_loop.exe decode_ecdsa_signature.exe \
+	hextobin.exe openpgp-tool.exe parse_pkcs11_uri.exe pkcs15-emulator-filter.exe \
+	simpletlv.exe strip_pkcs1_2_padding.exe
+
+!IF "$(ZLIB_DEF)" == "/DENABLE_ZLIB"
+TARGETS = $(TARGETS) compression.exe
+!ENDIF
+
+!IF "$(OPENSSL_DEF)" == "/DENABLE_OPENSSL"
+TARGETS = $(TARGETS) sm.exe
+!ENDIF
+
+LIBS = $(TOPDIR)\src\libopensc\opensc_a.lib \
+	   $(TOPDIR)\src\pkcs15init\pkcs15init.lib \
+	   $(TOPDIR)\src\scconf\scconf.lib \
+	   $(TOPDIR)\src\common\common.lib \
+	   $(TOPDIR)\src\common\libscdl.lib \
+	   $(TOPDIR)\src\ui\strings.lib \
+	   $(TOPDIR)\src\ui\notify.lib \
+	   $(TOPDIR)\src\sm\libsmiso.lib \
+	   $(TOPDIR)\src\sm\libsmeac.lib
+EXTRA_LIBS = $(CMOCKA_LIB) $(OPENPACE_LIB) $(OPENSSL_LIB) $(ZLIB_LIB) \
+	gdi32.lib Shell32.lib user32.lib advapi32.lib ws2_32.lib shlwapi.lib
 
 all: $(TARGETS)
 
-!INCLUDE $(TOPDIR)\win32\Make.rules.mak
+$(TARGETS): $(LIBS)
 
-$(TARGETS): $(OBJECTS) $(LIBS)
+openpgp-tool.exe: $(TOPDIR)\src\tools\openpgp-tool-helpers.obj
+	cl $(COPTS) $(CMOCKA_CFLAGS) /c $*.c
+	link $(LINKFLAGS) /out:$@ $*.obj $(TOPDIR)\src\tools\openpgp-tool-helpers.obj $(LIBS) $(EXTRA_LIBS)
+
+sm.exe: $(TOPDIR)\src\sm\libsm.lib
+	cl $(COPTS) $(CMOCKA_CFLAGS) /c $*.c
+	link $(LINKFLAGS) /out:$@ $*.obj $(TOPDIR)\src\sm\libsm.lib $(LIBS) $(EXTRA_LIBS)
 
 .c.exe:
-	cl $(COPTS) /c $<
-	link $(LINKFLAGS) /out:$@ $*.obj $(OBJECTS) $(LIBS)
+	cl $(COPTS) $(CMOCKA_CFLAGS) /c $<
+	link $(LINKFLAGS) /out:$@ $*.obj $(LIBS) $(EXTRA_LIBS)
+
+check: all
+	@for %i in ( $(TARGETS) ) do @( echo Running %i && %i || exit 1 )
diff --git a/src/tests/unittests/asn1.c b/src/tests/unittests/asn1.c
index dc8dccd4e0..00d5648afa 100644
--- a/src/tests/unittests/asn1.c
+++ b/src/tests/unittests/asn1.c
@@ -160,7 +160,7 @@ TORTURE_INTEGER(min2, "\x80\x00", -32768)
 
 #if INT_MAX == 2147483647
 TORTURE_INTEGER(max4, "\x7F\xFF\xFF\xFF", 2147483647)
-TORTURE_INTEGER(min4, "\x80\x00\x00\x00", -2147483648)
+TORTURE_INTEGER(min4, "\x80\x00\x00\x00", INT_MIN)
 #else
 TORTURE_INTEGER_ERROR(max4, "\x7F\xFF\xFF\xFF", SC_ERROR_NOT_SUPPORTED)
 TORTURE_INTEGER_ERROR(min4, "\x80\x00\x00\x00", SC_ERROR_NOT_SUPPORTED)
@@ -267,7 +267,7 @@ static void torture_asn1_decode_entry_octet_string_empty(void **state)
 {
 	sc_context_t *ctx = *state;
 	/* Skipped the Tag and Length (0x04, 0x00) */
-	const u8 octet_string[0] = {};
+	const u8 octet_string[1] = {0};
 	struct sc_asn1_entry asn1_struct[2] = {
 		{ "direct",     SC_ASN1_OCTET_STRING, SC_ASN1_CTX | SC_ASN1_CONS, SC_ASN1_ALLOC, NULL, NULL },
 		{ NULL, 0, 0, 0, NULL, NULL }
diff --git a/src/tests/unittests/openpgp-tool.c b/src/tests/unittests/openpgp-tool.c
index 9b944f7eee..329e3d8f55 100644
--- a/src/tests/unittests/openpgp-tool.c
+++ b/src/tests/unittests/openpgp-tool.c
@@ -56,17 +56,24 @@ static void torture_prettify_algorithm(void **state)
 }
 
 const struct expectation expectations_date[] = {
-    { "\x01\x02\x03", 3, NULL },
-    { "\x12\x34\x56\x78", 4, "1979-09-05 22:51:36" },
-    { "\x7f\xff\xff\xff", 4, "2038-01-19 03:14:07" },
-    /* XXX: probably not a feature */
-    { "\x80\x00\x00\x00", 4, "1901-12-13 20:45:52" },
-    { NULL, 0, NULL }
+		{"\x01\x02\x03",	 3, NULL			},
+		{"\x12\x34\x56\x78", 4, "1979-09-05 22:51:36"},
+		{"\x7f\xff\xff\xff", 4, "2038-01-19 03:14:07"},
+		{NULL,	       0, NULL		      }
+};
+
+/* Timestamps are unsigned 32-bit, dates past 2038 need 64-bit time_t */
+const struct expectation expectations_date_2038[] = {
+		{"\x80\x00\x00\x00", 4, "2038-01-19 03:14:08"},
+		{"\xff\xff\xff\xff", 4, "2106-02-07 06:28:15"},
+		{NULL,	       0, NULL		      }
 };
 
 static void torture_prettify_date(void **state)
 {
 	torture_prettify(state, expectations_date, prettify_date);
+	if (sizeof(time_t) > 4)
+		torture_prettify(state, expectations_date_2038, prettify_date);
 }
 
 const struct expectation expectations_version[] = {
diff --git a/src/tools/openpgp-tool-helpers.c b/src/tools/openpgp-tool-helpers.c
index 35c2ef9e97..f93d645c14 100644
--- a/src/tools/openpgp-tool-helpers.c
+++ b/src/tools/openpgp-tool-helpers.c
@@ -72,7 +72,7 @@ char *prettify_algorithm(const u8 *data, size_t length)
 char *prettify_date(const u8 *data, size_t length)
 {
 	if (data != NULL && length == 4) {
-		time_t time = (time_t) (data[0] << 24 | data[1] << 16 | data[2] << 8 | data[3]);
+		time_t time = (time_t)((unsigned long)data[0] << 24 | data[1] << 16 | data[2] << 8 | data[3]);
 		struct tm tm;
 		static char result[64];	/* large enough */
 
diff --git a/win32/Make.rules.mak b/win32/Make.rules.mak
index e6c75efc33..945f4b5472 100644
--- a/win32/Make.rules.mak
+++ b/win32/Make.rules.mak
@@ -28,7 +28,8 @@ WIX_INCL_DIR = "/I$(WIX_PACKAGES)/wixtoolset.dutil/$(WIX_VERSION)/build/native/i
 WIX_LIBS = "$(WIX_PACKAGES)/wixtoolset.dutil/$(WIX_VERSION)/build/native/v14/$(PLATFORM)/dutil.lib" \
 	"$(WIX_PACKAGES)/wixtoolset.wcautil/$(WIX_VERSION)/build/native/v14/$(PLATFORM)/wcautil.lib"
 
-# We do not build tests on windows
+# Unit tests need cmocka (detected automatically from vcpkg), otherwise set
+# TESTS_DEF, CMOCKA_CFLAGS (include directory preceded by "/I") and CMOCKA_LIB
 #TESTS_DEF = /DENABLE_TESTS
 
 #Include support for Secure Messaging
@@ -48,17 +49,16 @@ BUILD_TYPE = MT
 # If vcpkg is configured, automatically detect and enable installed dependencies
 !IF "$(VCPKG_INSTALLED)" != ""
 !IF "$(VCPKG_DEFAULT_TRIPLET)" == ""
-VCPKG_DEFAULT_TRIPLET = x64-windows-static
+VCPKG_DEFAULT_TRIPLET = $(PLATFORM)-windows-static
 !ENDIF
 VCPKG_DIR = $(VCPKG_INSTALLED)\$(VCPKG_DEFAULT_TRIPLET)
 !IF EXIST("$(VCPKG_DIR)\lib\libcrypto.lib")
 OPENSSL_DEF = /DENABLE_OPENSSL
 OPENSSL_DIR = $(VCPKG_DIR)
 OPENSSL_LIB = $(VCPKG_DIR)\lib\libcrypto.lib
-OPENSSL_EXTRA_CFLAGS = /DOPENSSL_SECURE_MALLOC_SIZE=65536
 !ENDIF
 !IF EXIST("$(VCPKG_DIR)\lib\zs.lib")
-ZLIBSTATIC_DEF = /DENABLE_ZLIB_STATIC
+ZLIB_DEF = /DENABLE_ZLIB
 ZLIB_INCL_DIR = /I$(VCPKG_DIR)\include
 ZLIB_LIB = $(VCPKG_DIR)\lib\zs.lib
 !ENDIF
@@ -67,6 +67,11 @@ OPENPACE_DEF = /DENABLE_OPENPACE
 OPENPACE_INCL_DIR = /I$(VCPKG_DIR)\include
 OPENPACE_LIB = $(VCPKG_DIR)\lib\eac.lib
 !ENDIF
+!IF EXIST("$(VCPKG_DIR)\lib\cmocka.lib")
+TESTS_DEF = /DENABLE_TESTS
+CMOCKA_CFLAGS = /I$(VCPKG_DIR)\include /DCMOCKA_STATIC
+CMOCKA_LIB = $(VCPKG_DIR)\lib\cmocka.lib
+!ENDIF
 !ENDIF
 
 # If you want support for OpenSSL (needed for pkcs15-init tool, software hashing in PKCS#11 library and verification):
@@ -89,46 +94,35 @@ OPENSSL_INCL_DIR = /I$(OPENSSL_DIR)\include
 OPENSSL_LIB = $(OPENSSL_DIR)\lib\VC\$(PLATFORM)\$(BUILD_TYPE)\libcrypto_static.lib
 !ENDIF
 OPENSSL_LIB = $(OPENSSL_LIB) user32.lib advapi32.lib crypt32.lib ws2_32.lib
+OPENSSL_EXTRA_CFLAGS = /DOPENSSL_SECURE_MALLOC_SIZE=65536
 
 PROGRAMS_OPENSSL = cryptoflex-tool.exe pkcs15-init.exe netkey-tool.exe piv-tool.exe \
 	westcos-tool.exe sc-hsm-tool.exe dnie-tool.exe gids-tool.exe lteid-tool.exe
 OPENSC_FEATURES = $(OPENSC_FEATURES) openssl
-WIXFLAGS = -d OpenSSL="$(OPENSSL_DIR)" $(WIXFLAGS)
+WIXFLAGS = -d OpenSSL $(WIXFLAGS)
 !ENDIF
 
 
 # If you want support for zlib (Used for PIV and actalis):
-# - Download zlib-dll and
-# - uncomment the line starting with ZLIB_DEF 
-# - set the ZLIB_INCL_DIR below to the zlib include lib proceeded by "/I"
-# - set the ZLIB_LIB  below to your zlib lib file
+# - uncomment the line starting with ZLIB_DEF
+# - download zlib-dll to C:\zlib-dll (zlib1.dll is added to the installer)
+# - or set ZLIB_INCL_DIR (include directory preceded by "/I") and ZLIB_LIB for a static zlib
 #ZLIB_DEF = /DENABLE_ZLIB
-!IF "$(ZLIBSTATIC_DEF)" == "/DENABLE_ZLIB_STATIC"
-ZLIB_DEF = /DENABLE_ZLIB
-!IF "$(ZLIB_INCL_DIR)" == ""
-ZLIB_INCL_DIR = /IC:\zlib
-!ENDIF
+!IF "$(ZLIB_DEF)" == "/DENABLE_ZLIB"
 !IF "$(ZLIB_LIB)" == ""
-ZLIB_LIB = C:\zlib\zlib.lib
-!ENDIF
-OPENSC_FEATURES = $(OPENSC_FEATURES) zlib
-!ELSEIF "$(ZLIB_DEF)" == "/DENABLE_ZLIB"
-!IF "$(ZLIB_INCL_DIR)" == ""
 ZLIB_INCL_DIR = /IC:\zlib-dll\include
-!ENDIF
-!IF "$(ZLIB_LIB)" == ""
 ZLIB_LIB = C:\zlib-dll\lib\zdll.lib
+WIXFLAGS = -d zlib="C:\zlib-dll" $(WIXFLAGS)
 !ENDIF
 OPENSC_FEATURES = $(OPENSC_FEATURES) zlib
-WIXFLAGS = -d zlib="C:\zlib-dll" $(WIXFLAGS)
 !ENDIF
 
 
 # If you want support for EAC:
 # - Download OpenPACE and
-# - uncomment the line starting with OPENPACE_DEF 
+# - uncomment the line starting with OPENPACE_DEF
 # - set the OPENPACE_INCL_DIR below to the OpenPACE include directory preceded by "/I"
-# - set the OPENPACE_LIB  below to your OpenPACE lib file
+# - set the OPENPACE_LIB below to your OpenPACE lib file
 #OPENPACE_DEF= /DENABLE_OPENPACE
 !IF "$(OPENPACE_DEF)" == "/DENABLE_OPENPACE"
 !IF "$(OPENPACE_DIR)" == ""
@@ -144,12 +138,15 @@ OPENPACE_LIB = $(OPENPACE_DIR)\src\libeac.lib
 # Build only when OpenPACE and OpenSSL are available
 PROGRAMS_OPENPACE = npa-tool.exe
 !ENDIF
-WIXFLAGS = -d OpenPACE="$(OPENPACE_DIR)" $(WIXFLAGS)
+WIXFLAGS = -d OpenPACE $(WIXFLAGS)
 !ENDIF
 
 
 # Used for MiniDriver
-CPDK_INCL_DIR = "/IC:\Program Files (x86)\Windows Kits\10\Cryptographic Provider Development Kit\Include"
+!IF "$(WINDOWSSDKDIR)" == ""
+WINDOWSSDKDIR = C:\Program Files (x86)\Windows Kits\10
+!ENDIF
+CPDK_INCL_DIR = "/I$(WINDOWSSDKDIR)\Cryptographic Provider Development Kit\Include"
 
 DEFS = /DWINVER=0x0601 /D_WIN32_WINNT=0x0601 /DWIN32_LEAN_AND_MEAN /DOPENSC_FEATURES="\"$(OPENSC_FEATURES)\"" \
 	/DPACKAGE_NAME="\"$(PRODUCT_NAME)\"" /DPACKAGE_VERSION="\"$(PRODUCT_VERSION)\"" \
@@ -158,11 +155,11 @@ DEFS = /DWINVER=0x0601 /D_WIN32_WINNT=0x0601 /DWIN32_LEAN_AND_MEAN /DOPENSC_FEAT
 	/DOPENSC_SCM_REVISION="\"$(PACKAGE_SCM_REVISION)\"" \
 	/DOPENSC_VS_FF_COMPANY_NAME="\"$(VS_FF_LEGAL_COMPANY_NAME)\"" /DOPENSC_VS_FF_PRODUCT_NAME="\"$(VS_FF_PRODUCT_NAME)\"" \
 	/DOPENSC_VS_FF_LEGAL_COPYRIGHT="\"$(VS_FF_LEGAL_COPYRIGHT)\"" /DOPENSC_VS_FF_COMMENTS="\"$(VS_FF_COMMENTS)\""
-COPTS = /nologo /Zi /GS /W3 /WX /D_CRT_SECURE_NO_DEPRECATE /D_CRT_NONSTDC_NO_WARNINGS /DHAVE_CONFIG_H \
+COPTS = /nologo /utf-8 /Zi /GS /W3 /WX /D_CRT_SECURE_NO_DEPRECATE /D_CRT_NONSTDC_NO_WARNINGS /DHAVE_CONFIG_H \
 	$(DEFS) $(DEBUG_DEF) $(OPENPACE_DEF) $(OPENSSL_DEF) $(ZLIB_DEF) $(MINIDRIVER_DEF) $(SM_DEF) $(TESTS_DEF) $(OPENSSL_EXTRA_CFLAGS) \
 	/I$(TOPDIR)\win32 /I$(TOPDIR)\src $(OPENPACE_INCL_DIR) $(OPENSSL_INCL_DIR) $(ZLIB_INCL_DIR) $(CPDK_INCL_DIR)
 LINKFLAGS = /nologo /INCREMENTAL:NO /NXCOMPAT /DYNAMICBASE /DEBUG /NODEFAULTLIB:MSVCRT /NODEFAULTLIB:MSVCRTD /MANIFEST:embed
-LIBFLAGS =  /nologo
+LIBFLAGS = /nologo
 
 !IF "$(DEBUG_DEF)" == "/DDEBUG"
 LINKFLAGS = $(LINKFLAGS) /NODEFAULTLIB:LIBCMT
diff --git a/win32/vcpkg.json b/win32/vcpkg.json
index 7257f2c299..006995e5b4 100644
--- a/win32/vcpkg.json
+++ b/win32/vcpkg.json
@@ -11,6 +11,10 @@
     "openpace": {
       "description": "EAC/PACE support via OpenPACE",
       "dependencies": ["openpace"]
+    },
+    "tests": {
+      "description": "Unit tests",
+      "dependencies": ["cmocka"]
     }
   },
   "builtin-baseline": "e182cb4dd2df2ab02f66a1aabd5f35bbdc9522c7"