diff --git a/RELEASING.md b/RELEASING.md
index f2a3e43df..65de08d07 100644
--- a/RELEASING.md
+++ b/RELEASING.md
@@ -2,11 +2,10 @@
 
 ## Daily snapshots
 
-We generate a snapshot build via the `goreleaser_snaphot` and `go_msi_snapshot` evergreen tasks,
-these tasks run on master and can be patched at any time.
+We generate a snapshot build via the `goreleaser_snaphot` evergreen task,
+this task runs on master and can be patched at any time.
 
-- **goreleaser_snaphot:** used with `goreleaser` to generate linux, mac and windows builds, the mac build will also be signed and notarized
-- **go_msi_snapshot:** used with `go-msi` to generate a Windows msi installer
+- **goreleaser_snaphot:** used with `goreleaser` to generate linux, mac and windows builds, the mac build will also be signed and notarized, and the windows msi is generated on a Windows host spawned via evergreen's `host.create`
 
 ## Stable release
 
diff --git a/build/ci/release.yml b/build/ci/release.yml
index d6767807b..d68c46b5f 100644
--- a/build/ci/release.yml
+++ b/build/ci/release.yml
@@ -3,10 +3,6 @@ variables:
       go_root: "/opt/golang/go1.26"
       go_bin: "/opt/golang/go1.26/bin"
       go_base_path: ""
-  - &go_windows_version
-      go_root: "c:\\golang\\go1.26"
-      go_bin: "c:\\golang\\go1.26/bin"
-      go_base_path: "c:"
   - &go_env
       XDG_CONFIG_HOME: ${go_base_path}${workdir}
       GO111MODULE: "on"
@@ -91,6 +87,7 @@ functions:
           <<: *go_env
           GRS_USERNAME: ${garasign_username}
           GRS_PASSWORD: ${garasign_password}
+          AUTHENTICODE_KEY_NAME: ${authenticode_key_name}
         include_expansions_in_env:
           - go_base_path
           - workdir
@@ -107,36 +104,22 @@ functions:
           - AWS_SECRET_ACCESS_KEY
           - AWS_SESSION_TOKEN
         binary: build/package/package.sh
-  "install go-msi":
-    - command: subprocess.exec
-      type: setup
+  "create-windows-host":
+    - command: host.create
       params:
-        working_dir: src/github.com/mongodb/mongodb-cli
-        command: choco install -y "go-msi" --force
-  "uninstall go-msi":
-    - command: subprocess.exec
-      type: setup
+        distro: windows-vsCurrent-small
+    - command: host.list
       params:
-        working_dir: src/github.com/mongodb/mongodb-cli
-        command: choco uninstall -y "go-msi"
-  "generate msi":
-    - command: subprocess.exec
-      type: test
+        wait: true
+        num_hosts: 1
+        path: ${workdir}/src/github.com/mongodb/mongodb-cli/build/ci/hosts.json
+    - command: shell.exec
       params:
         <<: *go_options
-        add_to_path:
-          - ${go_bin}
-          - ${go_base_path}${workdir}/bin
-          - ${go_base_path}${workdir}/src/github.com/mongodb/mongodb-cli/bin
-          - "/cygdrive/c/Program Files/go-msi"
-          - "/cygdrive/c/wixtools/bin"
-        env:
-          <<: *go_env
-          SECRET_API_KEY: ${chocolatey_api_key}
-          GRS_USERNAME: ${garasign_username}
-          GRS_PASSWORD: ${garasign_password}
-          unstable: ${unstable}
-        command: bash.exe -c build/package/generate-msi.sh
+        script: |
+          set -Eeou pipefail
+          echo "${__project_aws_ssh_key_value}" > ./build/ci/ssh_id
+          chmod 0600 ./build/ci/ssh_id
   "rename pkg":
     - command: subprocess.exec
       type: test
@@ -247,66 +230,18 @@ functions:
         working_dir: src/github.com/mongodb/mongodb-cli/build/package/docker/repo
         binary: ./docker-build.sh
 tasks:
-  - name: package_msi
-    tags: ["packaging"]
-    depends_on:
-      - name: compile
-        variant: "code_health"
-    commands:
-      - func: "install go-msi"
-      - func: "generate msi"
-        vars:
-          unstable: ${unstable}
-      - func: "uninstall go-msi"
-      - command: s3.put
-        params:
-          aws_key: ${aws_key}
-          aws_secret: ${aws_secret}
-          local_files_include_filter:
-            - src/github.com/mongodb/mongodb-cli/bin/*.exe
-            - src/github.com/mongodb/mongodb-cli/dist/*.msi
-          remote_file: ${project}/dist/${revision}_${created_at}/unsigned_
-          bucket: mongodb-mongocli-build
-          permissions: public-read
-          content_type: ${content_type|application/octet-stream}
-          display_name: unsigned
   - name: package_goreleaser
     tags: ["packaging"]
     depends_on:
       - name: compile
         variant: "code_health"
     commands:
+      - func: "create-windows-host"
       - func: "generate notices"
       - func: "install goreleaser"
       - func: "install macos notarization service"
       - func: "install gh-token"
       - func: "authenticate to ecr"
-      - command: subprocess.exec
-        type: test
-        params:
-          working_dir: src/github.com/mongodb/mongodb-cli
-          include_expansions_in_env:
-            - project
-            - revision
-            - created_at
-          env:
-            BUCKET: mongodb-mongocli-build
-            unstable: ${unstable}
-          binary: build/package/download-win-binaries.sh
-      - command: subprocess.exec
-        type: test
-        params:
-          include_expansions_in_env:
-            - unstable
-            - AWS_ACCESS_KEY_ID
-            - AWS_SECRET_ACCESS_KEY
-            - AWS_SESSION_TOKEN
-          env:
-            GRS_USERNAME: ${garasign_username}
-            GRS_PASSWORD: ${garasign_password}
-            AUTHENTICODE_KEY_NAME: ${authenticode_key_name}
-          working_dir: src/github.com/mongodb/mongodb-cli
-          binary: build/package/windows_notarize.sh
       - func: "package"
         vars:
           unstable: ${unstable}
@@ -402,15 +337,6 @@ tasks:
         vars:
           task_type: repo
 buildvariants:
-  - name: go_mongocli_msi_snapshot
-    display_name: "Packaging MongoCLI (go-msi)"
-    run_on:
-      - windows-vsCurrent-small
-    expansions:
-      <<: *go_windows_version
-      unstable: -unstable
-    tasks:
-      - name: package_msi
   - name: goreleaser_mongocli_snapshot
     display_name: "Packaging MongoCLI (goreleaser)"
     run_on:
@@ -426,9 +352,6 @@ buildvariants:
       unstable: -unstable
     tasks:
       - name: package_goreleaser
-        depends_on:
-          - name: package_msi
-            variant: "go_mongocli_msi_snapshot"
   - name: publish_mongocli_snapshot
     display_name: "Publish MongoCLI Snapshot"
     run_on:
@@ -438,15 +361,6 @@ buildvariants:
       server_version: "4.4.0-rc3"
     tasks:
       - name: push_mongocli_generate
-  - name: release_mongocli_msi
-    display_name: "Release MongoCLI (go-msi)"
-    run_on:
-      - windows-vsCurrent-small
-    git_tag_only: true
-    expansions:
-      <<: *go_windows_version
-    tasks:
-      - name: package_msi
   - name: release_mongocli_github
     display_name: "Release MongoCLI (goreleaser)"
     run_on:
@@ -460,9 +374,6 @@ buildvariants:
       package_name: "mongocli"
     tasks:
       - name: package_goreleaser
-        depends_on:
-          - name: package_msi
-            variant: release_mongocli_msi
   - name: release_mongocli_publish
     display_name: "Publish MongoCLI Generator"
     run_on:
diff --git a/build/package/.goreleaser.yml b/build/package/.goreleaser.yml
index 86b47125d..d4b230add 100644
--- a/build/package/.goreleaser.yml
+++ b/build/package/.goreleaser.yml
@@ -28,13 +28,16 @@ builds:
         - cmd: ./build/package/mac_notarize.sh
           output: true
   - <<: *build_defaults
-    builder: prebuilt
     id: windows
     goos: [windows]
     goarch: [amd64]
     goamd64: [v1]
-    prebuilt:
-      path: ./bin/mongocli.exe
+    hooks:
+      post:
+        - cmd: ./build/package/windows_notarize.sh
+          output: true
+        - cmd: ./build/package/windows_build_msi.sh
+          output: true
 gomod: # https://goreleaser.com/customization/verifiable_builds/
   # Proxy a module from proxy.golang.org, making the builds verifiable.
   # This will only be effective if running against a tag. Snapshots will ignore
diff --git a/build/package/download-win-binaries.sh b/build/package/download-win-binaries.sh
deleted file mode 100755
index e4c732627..000000000
--- a/build/package/download-win-binaries.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2021 MongoDB Inc
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -Eeou pipefail
-
-export project
-export revision
-export created_at
-
-VERSION_GIT="$(git tag --list "mongocli/v*" --sort=taggerdate | tail -1 | cut -d "v" -f 2)"
-VERSION_NAME="$VERSION_GIT"
-if [[ "${unstable-}" == "-unstable" ]]; then
-	VERSION_NAME="$VERSION_GIT-next"
-fi
-
-PACKAGE_NAME="mongocli_${VERSION_NAME}_windows_x86_64.msi"
-BINARY_NAME="mongocli.exe"
-
-PACKAGE_URL=https://${BUCKET}.s3.amazonaws.com/${project}/dist/${revision}_${created_at}/unsigned_${PACKAGE_NAME}
-BINARY_URL=https://${BUCKET}.s3.amazonaws.com/${project}/dist/${revision}_${created_at}/unsigned_${BINARY_NAME}
-
-pushd bin
-
-echo "downloading $PACKAGE_URL into $PWD/$PACKAGE_NAME"
-curl "$PACKAGE_URL" --output "${PACKAGE_NAME}"
-
-echo "downloading $BINARY_URL into $PWD/$BINARY_NAME"
-curl "$BINARY_URL" --output "${BINARY_NAME}"
diff --git a/build/package/generate-msi.sh b/build/package/generate-msi.sh
deleted file mode 100755
index 499958e89..000000000
--- a/build/package/generate-msi.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env bash
-# Copyright 2020 MongoDB Inc
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-set -Eeou pipefail
-
-GOCACHE="$(cygpath --mixed "${workdir:?}\.gocache")"
-CGO_ENABLED=0
-export GOCACHE
-export CGO_ENABLED
-
-go-msi check-env
-
-VERSION_GIT="$(git tag --list "mongocli/v*" --sort=taggerdate | tail -1 | cut -d "v" -f 2)"
-VERSION_NAME="$VERSION_GIT"
-if [[ "${unstable-}" == "-unstable" ]]; then
-	VERSION_NAME="$VERSION_GIT-next"
-fi
-
-COMMIT=$(git log -n1 --format=format:"%H")
-
-SOURCE_FILES=./cmd/mongocli
-PACKAGE_NAME=mongocli_${VERSION_NAME}_windows_x86_64.msi
-OUTPUT=./bin/mongocli.exe
-LINKER_FLAGS="-s -w -X github.com/mongodb/mongodb-cli/mongocli/v2/internal/version.Version=${VERSION_GIT} -X github.com/mongodb/mongodb-cli/mongocli/v2/internal/version.GitCommit=${COMMIT}"
-WIX_MANIFEST_FILE="./build/package/wix/mongocli.json"
-
-env GOOS=windows GOARCH=amd64 go build \
-	-ldflags "${LINKER_FLAGS}" -o ${OUTPUT} "${SOURCE_FILES}"
-
-go-msi make --path "${WIX_MANIFEST_FILE}" --msi "dist/${PACKAGE_NAME}" --version "${VERSION_GIT}"
diff --git a/build/package/msi/generate-msi.sh b/build/package/msi/generate-msi.sh
new file mode 100755
index 000000000..d0b196109
--- /dev/null
+++ b/build/package/msi/generate-msi.sh
@@ -0,0 +1,31 @@
+#!/usr/bin/env bash
+# Copyright 2020 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+GOROOT="$(cygpath --unix "c:\\golang\\go1.24")"
+PATH="${PATH}:$(cygpath --unix "c:\\golang\\go1.24\\bin"):$(cygpath --unix "c:\\Program Files\\go-msi"):$(cygpath --unix "c:\\wixtools\\bin")"
+GOCACHE="$(cygpath --unix "c:\\Users\\Administrator\\.cache")"
+CGO_ENABLED=0
+
+export GOROOT PATH GOCACHE CGO_ENABLED
+
+choco install -y "go-msi" --force
+
+go-msi make --path "wix.json" --msi "out.msi" --version "$(cat version.txt)"
+
+choco uninstall -y "go-msi" --force
+
+rm -rf "$GOCACHE"
diff --git a/build/package/wix/mongocli.json b/build/package/msi/wix.json
similarity index 100%
rename from build/package/wix/mongocli.json
rename to build/package/msi/wix.json
diff --git a/build/package/windows_build_msi.sh b/build/package/windows_build_msi.sh
new file mode 100755
index 000000000..bd8221649
--- /dev/null
+++ b/build/package/windows_build_msi.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# Copyright 2020 MongoDB Inc
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -Eeou pipefail
+
+keyfile="${keyfile:-./build/ci/ssh_id}"
+user="${user:-Administrator}"
+hostsfile="${hostsfile:-./build/ci/hosts.json}"
+
+VERSION_GIT="$(git tag --list "mongocli/v*" --sort=taggerdate | tail -1 | cut -d "v" -f 2)"
+VERSION_NAME="$VERSION_GIT"
+if [[ "${unstable-}" == "-unstable" ]]; then
+	VERSION_NAME="$VERSION_GIT-next"
+fi
+
+echo "Packaging $PWD/build/package/msi.zip"
+mkdir -p ./build/package/msi/bin
+cp ./dist/windows_windows_amd64_v1/bin/mongocli.exe ./build/package/msi/bin/mongocli.exe
+cp ./LICENSE ./build/package/msi/LICENSE
+echo "$VERSION_GIT" > ./build/package/msi/version.txt
+cd ./build/package
+zip -r msi.zip msi
+rm -rf ./msi/version.txt ./msi/bin/mongocli.exe ./msi/LICENSE
+cd ../..
+
+echo "Waiting for the Windows host to become available..."
+build/ci/ssh-ready.sh -u "$user" -i "$keyfile" -h "$hostsfile"
+host=$(jq -r '.[0].dns_name' "$hostsfile")
+
+echo "Uploading $PWD/build/package/msi.zip to ${user}@${host}:/cygdrive/c/Users/Administrator/msi.zip"
+scp -i "$keyfile" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "${PWD}/build/package/msi.zip" "${user}@${host}:/cygdrive/c/Users/Administrator/msi.zip"
+rm -rf ./build/package/msi.zip
+
+echo "Building MSI on ${user}@${host}..."
+ssh -i "$keyfile" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "${user}@${host}" "echo 'extracting msi.zip to /cygdrive/c/Users/Administrator/msi';
+unzip -o '/cygdrive/c/Users/Administrator/msi.zip' -d '/cygdrive/c/Users/Administrator';
+rm -rf '/cygdrive/c/Users/Administrator/msi.zip';
+echo 'running generate-msi.sh in /cygdrive/c/Users/Administrator/msi';
+cd '/cygdrive/c/Users/Administrator/msi';
+./generate-msi.sh;
+"
+
+MSI_FILE="${PWD}/bin/mongocli_${VERSION_NAME}_windows_x86_64.msi"
+
+echo "Downloading from ${user}@${host}:/cygdrive/c/Users/Administrator/msi/out.msi to ${MSI_FILE}"
+scp -i "$keyfile" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no "${user}@${host}:/cygdrive/c/Users/Administrator/msi/out.msi" "${MSI_FILE}"
+chmod 644 "${MSI_FILE}"
+
+echo "Cleaning up ${user}@${host}:/cygdrive/c/Users/Administrator/msi"
+ssh -i "$keyfile" -o ConnectTimeout=10 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -tt "${user}@${host}" "rm -rf '/cygdrive/c/Users/Administrator/msi'"
+
+echo "Notarizing ${MSI_FILE}"
+"$(dirname "${BASH_SOURCE[0]}")/ecr-login.sh"
+
+echo "GRS_CONFIG_USER1_USERNAME=${GRS_USERNAME}" > .env
+echo "GRS_CONFIG_USER1_PASSWORD=${GRS_PASSWORD}" >> .env
+
+echo "signing $MSI_FILE"
+podman run \
+	--env-file=.env \
+	--rm \
+	-v "$(pwd):$(pwd)" \
+	-w "$(pwd)" \
+	901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-jsign \
+	/bin/bash -c "jsign --tsaurl http://timestamp.digicert.com -a ${AUTHENTICODE_KEY_NAME} \"$MSI_FILE\""
+
+rm .env
diff --git a/build/package/windows_notarize.sh b/build/package/windows_notarize.sh
index 82ccc561f..bc3a0a77e 100755
--- a/build/package/windows_notarize.sh
+++ b/build/package/windows_notarize.sh
@@ -16,16 +16,9 @@
 
 set -Eeou pipefail
 
-VERSION_GIT="$(git tag --list "mongocli/v*" --sort=taggerdate | tail -1 | cut -d "v" -f 2)"
-VERSION_NAME="$VERSION_GIT"
-if [[ "${unstable-}" == "-unstable" ]]; then
-	VERSION_NAME="$VERSION_GIT-next"
-fi
-
-EXE_FILE="bin/mongocli.exe"
-MSI_FILE="bin/mongocli_${VERSION_NAME}_windows_x86_64.msi"
+EXE_FILE="dist/windows_windows_amd64_v1/bin/mongocli.exe"
 
-if [[ -f "$EXE_FILE" && -f "$MSI_FILE" ]]; then
+if [[ -f "$EXE_FILE" ]]; then
 	"$(dirname "${BASH_SOURCE[0]}")/ecr-login.sh"
 
 	echo "GRS_CONFIG_USER1_USERNAME=${GRS_USERNAME}" > .env
@@ -39,15 +32,6 @@ if [[ -f "$EXE_FILE" && -f "$MSI_FILE" ]]; then
 		-w "$(pwd)" \
 		901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-jsign \
 		/bin/bash -c "jsign --tsaurl http://timestamp.digicert.com -a ${AUTHENTICODE_KEY_NAME} \"$EXE_FILE\""
-	
-	echo "signing $MSI_FILE"
-	podman run \
-		--env-file=.env \
-		--rm \
-		-v "$(pwd):$(pwd)" \
-		-w "$(pwd)" \
-		901841024863.dkr.ecr.us-east-1.amazonaws.com/release-infrastructure/garasign-jsign \
-		/bin/bash -c "jsign --tsaurl http://timestamp.digicert.com -a ${AUTHENTICODE_KEY_NAME} \"$MSI_FILE\""
-	
+
 	rm .env
 fi