diff --git a/.github/workflows/cpp.yml b/.github/workflows/cpp.yml
index 21bf615c2ff4..782a23991589 100644
--- a/.github/workflows/cpp.yml
+++ b/.github/workflows/cpp.yml
@@ -303,6 +303,10 @@ jobs:
     if: ${{ !contains(github.event.pull_request.title, 'WIP') }}
     name: AMD64 Windows 2022 AVX2 C++
     uses: ./.github/workflows/cpp_windows.yml
+    permissions:
+      actions: read
+      contents: read
+      packages: write
     with:
       arch: x64
       os: windows-2022
diff --git a/.github/workflows/cpp_extra.yml b/.github/workflows/cpp_extra.yml
index 8f3590b7d08c..40e354a878dd 100644
--- a/.github/workflows/cpp_extra.yml
+++ b/.github/workflows/cpp_extra.yml
@@ -194,6 +194,10 @@ jobs:
     if: needs.check-enabled.outputs.is_enabled == 'true'
     name: ARM64 Windows 11 MSVC
     uses: ./.github/workflows/cpp_windows.yml
+    permissions:
+      actions: read
+      contents: read
+      packages: write
     with:
       arch: arm64
       os: windows-11-arm
diff --git a/.github/workflows/cpp_windows.yml b/.github/workflows/cpp_windows.yml
index 315ad66cb747..a47b9a81c8fd 100644
--- a/.github/workflows/cpp_windows.yml
+++ b/.github/workflows/cpp_windows.yml
@@ -40,17 +40,23 @@ permissions:
 jobs:
   windows:
     runs-on: ${{ inputs.os }}
-    timeout-minutes: 60
+    timeout-minutes: 240
+    permissions:
+      actions: read
+      contents: read
+      packages: write
     env:
       ARROW_AZURE: ON
-      ARROW_BOOST_USE_SHARED: OFF
+      ARROW_BOOST_USE_SHARED: ON
       ARROW_BUILD_BENCHMARKS: ON
       ARROW_BUILD_SHARED: ON
       ARROW_BUILD_STATIC: OFF
       ARROW_BUILD_TESTS: ON
       ARROW_DATASET: ON
+      ARROW_DEPENDENCY_SOURCE: VCPKG
       ARROW_FILESYSTEM: ON
-      ARROW_FLIGHT: OFF
+      ARROW_FLIGHT: ON
+      ARROW_FLIGHT_SQL: ON
       ARROW_HDFS: ON
       ARROW_HOME: /usr
       ARROW_JEMALLOC: OFF
@@ -68,13 +74,16 @@ jobs:
       ARROW_WITH_SNAPPY: ON
       ARROW_WITH_ZLIB: ON
       ARROW_WITH_ZSTD: ON
-      BOOST_SOURCE: BUNDLED
+      # The Azure SDK isn't in cpp/vcpkg.json.
+      Azure_SOURCE: BUNDLED
       CMAKE_CXX_STANDARD: "20"
       CMAKE_GENERATOR: Ninja
       CMAKE_INSTALL_PREFIX: /usr
       # ccache does not support PDB files (https://github.com/ccache/ccache/issues/1040)
       CMAKE_MSVC_DEBUG_INFORMATION_FORMAT: Embedded
       CMAKE_UNITY_BUILD: ON
+      VCPKG_BINARY_SOURCES: 'clear;nugettimeout,1800;nuget,GitHub,readwrite'
+      VCPKG_DEFAULT_TRIPLET: ${{ inputs.arch }}-windows
     steps:
       - name: Disable Crash Dialogs
         run: |
@@ -115,6 +124,37 @@ jobs:
         with:
           path: ${{ steps.ccache-info.outputs.cache-dir }}
           key: cpp-ccache-windows-${{ inputs.arch }}
+      - name: Install vcpkg
+        shell: bash
+        run: |
+          ci/scripts/install_vcpkg.sh vcpkg
+          VCPKG_ROOT=$(cygpath --windows "$(pwd)/vcpkg")
+          echo "${VCPKG_ROOT}" >> "${GITHUB_PATH}"
+          echo "VCPKG_ROOT=${VCPKG_ROOT}" >> "${GITHUB_ENV}"
+          # We use manifest mode with builtin-baseline. vcpkg resolves
+          # ports from its versions database in manifest mode, so local
+          # changes by ports.patch are ignored unless the patched ports
+          # are used as overlay ports.
+          vcpkg_ports_dir=$(cygpath --mixed "$(pwd)/vcpkg/ports")
+          overlay_ports=()
+          for port in $(sed -n -E 's,^diff --git a/ports/([^/]+)/.*,\1,p' \
+                          ci/vcpkg/ports.patch | sort -u); do
+            overlay_ports+=("${vcpkg_ports_dir}/${port}")
+          done
+          echo "VCPKG_OVERLAY_PORTS=$(IFS=';'; echo "${overlay_ports[*]}")" >> "${GITHUB_ENV}"
+      - name: Setup NuGet credentials for vcpkg caching
+        shell: bash
+        run: |
+          $(vcpkg fetch nuget | tail -n 1) \
+            sources add \
+            -source "https://nuget.pkg.github.com/$GITHUB_REPOSITORY_OWNER/index.json" \
+            -storepasswordincleartext \
+            -name "GitHub" \
+            -username "$GITHUB_REPOSITORY_OWNER" \
+            -password "${{ secrets.GITHUB_TOKEN }}"
+          $(vcpkg fetch nuget | tail -n 1) \
+            setapikey "${{ secrets.GITHUB_TOKEN }}" \
+            -source "https://nuget.pkg.github.com/$GITHUB_REPOSITORY_OWNER/index.json"
       - name: Find Visual Studio
         shell: pwsh
         run: |
@@ -124,7 +164,9 @@ jobs:
         env:
           VCVARS_ARCH: ${{ inputs.arch }}
         run: |
+          set VCPKG_ROOT_KEEP=%VCPKG_ROOT%
           call "%VS_INSTALL_PATH%\VC\Auxiliary\Build\vcvarsall.bat" %VCVARS_ARCH% || exit /b 1
+          set VCPKG_ROOT=%VCPKG_ROOT_KEEP%
           bash -c "ci/scripts/cpp_build.sh $(pwd) $(pwd)/build"
       - name: Save ccache
         if: ${{ !cancelled() }}
@@ -139,7 +181,10 @@ jobs:
           VCVARS_ARCH: ${{ inputs.arch }}
           MSYS2_LOCATION: ${{ steps.setup-msys2.outputs.msys2-location }}
         run: |
+          set VCPKG_ROOT_KEEP=%VCPKG_ROOT%
           call "%VS_INSTALL_PATH%\VC\Auxiliary\Build\vcvarsall.bat" %VCVARS_ARCH% || exit /b 1
+          # Convert VCPKG Windows path to MSYS path
+          for /f "usebackq delims=" %%I in (`bash -c "cygpath -u \"$VCPKG_ROOT_KEEP\""` ) do set VCPKG_ROOT=%%I
           # For ORC
           set TZDIR=%MSYS2_LOCATION%\usr\share\zoneinfo
           bash -c "ci/scripts/cpp_test.sh $(pwd) $(pwd)/build"
diff --git a/cpp/src/arrow/flight/flight_benchmark.cc b/cpp/src/arrow/flight/flight_benchmark.cc
index aa6e16820efb..0614d8c1b3f1 100644
--- a/cpp/src/arrow/flight/flight_benchmark.cc
+++ b/cpp/src/arrow/flight/flight_benchmark.cc
@@ -114,11 +114,13 @@ struct PerformanceStats {
   }
 
   // ns -> us
-  uint64_t max_latency() const { return latencies.Max() / 1000; }
+  uint64_t max_latency() const { return static_cast<uint64_t>(latencies.Max() / 1000); }
 
-  uint64_t mean_latency() const { return latencies.Mean() / 1000; }
+  uint64_t mean_latency() const { return static_cast<uint64_t>(latencies.Mean() / 1000); }
 
-  uint64_t quantile_latency(double q) const { return latencies.Quantile(q) / 1000; }
+  uint64_t quantile_latency(double q) const {
+    return static_cast<uint64_t>(latencies.Quantile(q) / 1000);
+  }
 };
 
 Status WaitForReady(FlightClient* client, const FlightCallOptions& call_options) {
@@ -282,7 +284,8 @@ Status DoSinglePerfRun(FlightClient* client, const FlightClientOptions client_op
   // Plan the query
   FlightDescriptor descriptor;
   descriptor.type = FlightDescriptor::CMD;
-  perf.SerializeToString(&descriptor.cmd);
+  ARROW_RETURN_IF(!perf.SerializeToString(&descriptor.cmd),
+                  Status::Invalid("Failed to serialize the performance request"));
 
   ARROW_ASSIGN_OR_RAISE(auto plan, client->GetFlightInfo(call_options, descriptor));
 
@@ -307,7 +310,8 @@ Status DoSinglePerfRun(FlightClient* client, const FlightClientOptions client_op
     }
 
     perf::Token token;
-    token.ParseFromString(endpoint.ticket.ticket);
+    ARROW_RETURN_IF(!token.ParseFromString(endpoint.ticket.ticket),
+                    Status::Invalid("Failed to parse the performance ticket"));
 
     const auto& result = test_loop(data_client, call_options, token, endpoint, stats);
     if (result.ok()) {
diff --git a/cpp/src/arrow/flight/transport/grpc/customize_grpc.h b/cpp/src/arrow/flight/transport/grpc/customize_grpc.h
index 4a64e4e07214..b43b0ed65fd3 100644
--- a/cpp/src/arrow/flight/transport/grpc/customize_grpc.h
+++ b/cpp/src/arrow/flight/transport/grpc/customize_grpc.h
@@ -44,14 +44,16 @@
 //  - Abseil built *without* NDEBUG (a Debug vcpkg/system build): it has the
 //    strong out-of-line Dtor. Emitting our own copy is then a duplicate
 //    definition, which a *static* Abseil turns into LNK2005 (GH-49585). With a
-//    shared Abseil it is harmless, since the definitions live in separate
-//    images.
+//    shared Abseil it links, but our inline Dtor is empty: it skips
+//    Mutex::ForgetDeadlockInfo(), so a debug Abseil keeps stale nodes for
+//    destroyed mutexes in its deadlock graph. A new mutex created at the same
+//    address then inherits the old lock ordering and Abseil reports a bogus
+//    "Potential Mutex deadlock".
 //
-// So restrict the hack to the cases where it cannot produce a duplicate:
-// anything that is not MSVC-linking-static-Abseil. On MSVC, Abseil's CMake puts
-// ABSL_CONSUME_DLL in the INTERFACE compile definitions of its targets, so its
-// presence tells us we are consuming the DLL rather than the static library.
-#  if !defined(_MSC_VER) || defined(ABSL_CONSUME_DLL)
+// On MSVC the hack is not needed anyway: an Abseil DLL (ABSL_BUILD_DLL) always
+// exports Mutex::Dtor, and a static Abseil must not get a duplicate. So only
+// apply the hack on other platforms.
+#  if !defined(_MSC_VER)
 #    ifndef NDEBUG
 #      define ARROW_NO_NDEBUG
 #      define NDEBUG