diff --git a/rust/windows-client/src-tauri/src/main.rs b/rust/windows-client/src-tauri/src/main.rs
index 3ea0c9ce0..00ef7f3b3 100755
--- a/rust/windows-client/src-tauri/src/main.rs
+++ b/rust/windows-client/src-tauri/src/main.rs
@@ -29,6 +29,8 @@ mod local_webserver;
 // Relies on some types from Tauri
 #[cfg(target_os = "windows")]
 mod settings;
+#[cfg(target_os = "windows")]
+mod wintun_install;
 
 /// Prevents a problem where changing the args to `gui::run` breaks static analysis on non-Windows targets, where the gui is stubbed out
 #[allow(dead_code)]
diff --git a/rust/windows-client/src-tauri/src/wintun_install.rs b/rust/windows-client/src-tauri/src/wintun_install.rs
new file mode 100755
index 000000000..f07322f60
--- /dev/null
+++ b/rust/windows-client/src-tauri/src/wintun_install.rs
@@ -0,0 +1,28 @@
+//! "Installs" wintun.dll at runtime by copying it into whatever folder the exe is in
+
+pub(crate) struct _DllBytes {
+    /// Bytes embedded in the client with `include_bytes`
+    bytes: &'static [u8],
+    /// Expected SHA256 hash
+    expected_sha256: &'static str,
+}
+
+/// Returns the platform-specific bytes of wintun.dll, or None if we don't support the compiled platform.
+pub(crate) fn _get_dll_bytes() -> Option<_DllBytes> {
+    _get_platform_dll_bytes()
+}
+
+#[cfg(target_arch = "x86_64")]
+fn _get_platform_dll_bytes() -> Option<_DllBytes> {
+    // SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
+    Some(_DllBytes {
+        bytes: include_bytes!("../../wintun/bin/amd64/wintun.dll"),
+        expected_sha256: "e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce",
+    })
+}
+
+#[cfg(target_arch = "aarch64")]
+fn _get_platform_dll_bytes() -> Option<&'static [u8]> {
+    // wintun supports aarch64 but it's not in the Firezone repo yet
+    None
+}