diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 66db8228b9..9cfb45cc33 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -65,6 +65,12 @@ jobs:
         Remove-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
         choco install openssh --pre
 
+    # Windows builds need OpenSSL to fully support Git+SSH
+    - name: Setup openssl [windows]
+      if: ${{ matrix.os == 'windows-latest' }}
+      run: |
+        choco install openssl
+
     - name: Install Rust
       uses: dtolnay/rust-toolchain@1482605bfc5719782e1267fd0c0cc350fe7646b8
       with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4ae03aa2f0..bd75b71858 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * The default template alias `builtin_log_root(change_id: ChangeId, commit_id: CommitId)` was replaced by `format_root_commit(root: Commit)`.
 
+* When targeting Windows, libssh2 will use OpenSSL rather than wincng. This fixes
+  interacting with Git+SSH hosts using ED25519 keys, but Windows developers will
+  need to provide OpenSSL at build time.
+
 ### New features
 
 * The list of conflicted paths is printed whenever the working copy changes.
@@ -64,6 +68,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   literals. This means that `snapshot.max-new-file-size="1"` and
   `snapshot.max-new-file-size=1` are now equivalent.
 
+* ED25519 host keys are now supported correctly when connecting to Git+SSH hosts
+  on Windows.
+
 ## [0.16.0] - 2024-04-03
 
 ### Deprecations
diff --git a/Cargo.lock b/Cargo.lock
index 9583441d98..39f019fcd4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1744,6 +1744,7 @@ dependencies = [
  "insta",
  "itertools 0.12.1",
  "jj-lib-proc-macros",
+ "libssh2-sys",
  "maplit",
  "num_cpus",
  "once_cell",
diff --git a/Cargo.toml b/Cargo.toml
index f4119936d9..83e8125825 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,6 +60,7 @@ indoc = "2.0.4"
 insta = { version = "1.38.0", features = ["filters"] }
 itertools = "0.12.1"
 libc = { version = "0.2.153" }
+libssh2-sys = { version = "0.3.0", features = ["openssl-on-win32"] }
 maplit = "1.0.2"
 minus = { version = "5.6.1", features = ["dynamic_output", "search"] }
 num_cpus = "1.16.0"
diff --git a/docs/windows.md b/docs/windows.md
index 5c55c434e7..25d3ac79d4 100644
--- a/docs/windows.md
+++ b/docs/windows.md
@@ -92,4 +92,20 @@ Mode. If those conditions are not satisfied, `jj` will materialize symlinks as
 ordinary files.
 
 For colocated repositories, Git support must also be enabled using the
-`git config` option `core.symlinks=true`.
\ No newline at end of file
+`git config` option `core.symlinks=true`.
+
+## Building jj on Windows
+
+By default, `jj` will build with `libssh2` using OpenSSL as its cryptography
+backend. This is because libssh2's wincng backend does not support the ED25519
+algorithm, preventing Git+SSH remotes using ED25519 keys from working.
+
+The easiest way to provide this is to install it via [vcpkg].
+
+```bash
+VCPKG_ROOT=path/to/your/vcpkg_installation
+vcpkg install --triplet=x64-windows-static-md openssl
+cargo build --release
+```
+
+[vcpkg]: https://vcpkg.io/
diff --git a/lib/Cargo.toml b/lib/Cargo.toml
index d7a68f6a13..f84f366f24 100644
--- a/lib/Cargo.toml
+++ b/lib/Cargo.toml
@@ -49,6 +49,7 @@ hex = { workspace = true }
 ignore = { workspace = true }
 itertools = { workspace = true }
 jj-lib-proc-macros = { workspace = true }
+libssh2-sys = { workspace = true }
 maplit = { workspace = true }
 once_cell = { workspace = true }
 pest = { workspace = true }