diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f135355..03430e2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -323,6 +323,22 @@ jobs:
       - name: Build
         run: cmake --build build
 
+      # The zip ships the .exe alone, and this runner has the Redistributable, so only the imports can tell.
+      - name: Assert the binary needs no Visual C++ Redistributable (Windows)
+        if: runner.os == 'Windows'
+        run: |
+          dumpbin -nologo -dependents build/sendspin-cli.exe >imports.txt
+          cat imports.txt
+          if grep -Eiq '^[[:space:]]*(msvcp|vcruntime|concrt)[0-9a-z_]*\.dll' imports.txt; then
+            echo '::error::sendspin-cli.exe imports a Visual C++ Redistributable DLL, which a clean Windows install does not have'
+            exit 1
+          fi
+          grep -Eiq '^[[:space:]]*kernel32\.dll' imports.txt || {
+            echo '::error::dumpbin listed no imports at all, so the check above proved nothing'
+            exit 1
+          }
+          rm -f imports.txt
+
       # Read the target architecture off the linked binary, which covers every dependency, before running the suite.
       - name: Assert the binary is built for the architecture this leg claims
         if: matrix.arm32
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 86b5ae4..eaafeef 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -18,6 +18,11 @@ set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 set(CMAKE_CXX_EXTENSIONS OFF)
 
+# Static CRT for every target, so the Windows .exe runs without the Visual C++ Redistributable.
+if(NOT DEFINED CMAKE_MSVC_RUNTIME_LIBRARY)
+    set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+endif()
+
 if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
     set(CMAKE_BUILD_TYPE Release CACHE STRING "Build type" FORCE)
 endif()
@@ -475,8 +480,6 @@ if(SENDSPIN_CLI_BUILD_TESTS)
     )
     set(INSTALL_GTEST OFF CACHE BOOL "Install GoogleTest alongside our own targets")
     set(BUILD_GMOCK OFF CACHE BOOL "Build GoogleMock")
-    # The CRT the rest of the build links (/MD), not GoogleTest's own /MT default.
-    set(gtest_force_shared_crt ON CACHE BOOL "Use the shared CRT for GoogleTest")
     FetchContent_MakeAvailable(googletest)
     if(CMAKE_CXX_COMPILER_FRONTEND_VARIANT STREQUAL "MSVC")
         # GoogleTest builds itself with /WX, which newer clang-cl warnings break.