diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index f2dfc16..a1b33b2 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -27,6 +27,9 @@ jobs:
   windows-test:
     runs-on: docker
     steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
       - name: Install sshpass
         run: |
           apt-get update -qq
@@ -72,6 +75,25 @@ jobs:
           echo "$out"
           echo "$out" | grep -q "^CLEAN" || { echo "marker from previous run survived — revert is broken"; exit 1; }
 
+      - name: Copy tests into VM
+        env:
+          SSHPASS: ${{ secrets.WINDOWS_SSH_PASSWORD }}
+        run: |
+          sshpass -e ssh -o StrictHostKeyChecking=no \
+            -p "$WIN_PORT" "$WIN_USER@$WIN_HOST" \
+            "if not exist C:\\ci mkdir C:\\ci"
+          sshpass -e scp -o StrictHostKeyChecking=no \
+            -P "$WIN_PORT" -r tests \
+            "$WIN_USER@$WIN_HOST:C:/ci/"
+
+      - name: Run PowerShell tests on Windows
+        env:
+          SSHPASS: ${{ secrets.WINDOWS_SSH_PASSWORD }}
+        run: |
+          sshpass -e ssh -o StrictHostKeyChecking=no \
+            -p "$WIN_PORT" "$WIN_USER@$WIN_HOST" \
+            "powershell -NoProfile -ExecutionPolicy Bypass -File C:\\ci\\tests\\run-tests.ps1"
+
       - name: Drop marker file (would persist without revert)
         env:
           SSHPASS: ${{ secrets.WINDOWS_SSH_PASSWORD }}
diff --git a/tests/run-tests.ps1 b/tests/run-tests.ps1
new file mode 100644
index 0000000..11a0f81
--- /dev/null
+++ b/tests/run-tests.ps1
@@ -0,0 +1,30 @@
+$ErrorActionPreference = 'Stop'
+$script:failed = 0
+
+function Assert-True($cond, $msg) {
+    if ($cond) { Write-Host "PASS: $msg" }
+    else { Write-Host "FAIL: $msg"; $script:failed++ }
+}
+
+Write-Host "=== environment ==="
+Write-Host "host=$env:COMPUTERNAME user=$env:USERNAME"
+Write-Host "ps=$($PSVersionTable.PSVersion)"
+
+Write-Host "=== tests ==="
+Assert-True ($PSVersionTable.PSVersion.Major -ge 5) "PowerShell major >= 5"
+Assert-True ((Get-CimInstance Win32_OperatingSystem).Caption -match 'Windows') "OS reports as Windows"
+Assert-True ((2 + 2) -eq 4) "arithmetic sanity"
+Assert-True ($env:USERNAME -eq 'edr') "running as edr"
+
+$tmp = Join-Path $env:TEMP "ci-write-test.txt"
+"hello $(Get-Date -Format o)" | Out-File -Encoding ascii $tmp
+Assert-True (Test-Path $tmp) "wrote file under TEMP"
+Assert-True ((Get-Content $tmp) -match 'hello') "read file content back"
+Remove-Item $tmp -Force
+
+if ($failed -gt 0) {
+    Write-Host "$failed test(s) failed"
+    exit 1
+}
+Write-Host "all tests passed"
+exit 0