diff --git a/rust/windows-client/src-tauri/Cargo.toml b/rust/windows-client/src-tauri/Cargo.toml
index 2a4002cc9..5c9babd0e 100755
--- a/rust/windows-client/src-tauri/Cargo.toml
+++ b/rust/windows-client/src-tauri/Cargo.toml
@@ -6,6 +6,7 @@ description = "Firezone Windows Client"
 edition = "2021"
 
 [build-dependencies]
+anyhow = { version = "1.0" }
 tauri-build = { version = "1.5", features = [] }
 
 [dependencies]
diff --git a/rust/windows-client/src-tauri/build.rs b/rust/windows-client/src-tauri/build.rs
index d860e1e6a..32bd8a79f 100755
--- a/rust/windows-client/src-tauri/build.rs
+++ b/rust/windows-client/src-tauri/build.rs
@@ -1,3 +1,18 @@
-fn main() {
-    tauri_build::build()
+fn main() -> anyhow::Result<()> {
+    let win = tauri_build::WindowsAttributes::new().app_manifest(WINDOWS_MANIFEST);
+    let attr = tauri_build::Attributes::new().windows_attributes(win);
+    tauri_build::try_build(attr)?;
+    Ok(())
 }
+
+// If we ask for admin privilege in the manifest, we can't run in Cygwin,
+// which makes debugging hard on my dev system.
+// So always ask for it in Release, which is simpler for users, and in Release
+// mode we run as a GUI so we lose stdout/stderr anyway.
+// If you need admin privileges for debugging, you can right-click the debug exe.
+
+#[cfg(debug_assertions)]
+const WINDOWS_MANIFEST: &str = include_str!("firezone-windows-client-debug.manifest");
+
+#[cfg(not(debug_assertions))]
+const WINDOWS_MANIFEST: &str = include_str!("firezone-windows-client-release.manifest");
diff --git a/rust/windows-client/src-tauri/firezone-windows-client-debug.manifest b/rust/windows-client/src-tauri/firezone-windows-client-debug.manifest
new file mode 100755
index 000000000..1f5498f0b
--- /dev/null
+++ b/rust/windows-client/src-tauri/firezone-windows-client-debug.manifest
@@ -0,0 +1,14 @@
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+    <dependency>
+        <dependentAssembly>
+            <assemblyIdentity
+            type="win32"
+            name="Microsoft.Windows.Common-Controls"
+            version="6.0.0.0"
+            processorArchitecture="*"
+            publicKeyToken="6595b64144ccf1df"
+            language="*"
+            />
+        </dependentAssembly>
+    </dependency>
+</assembly>
diff --git a/rust/windows-client/src-tauri/firezone-windows-client-release.manifest b/rust/windows-client/src-tauri/firezone-windows-client-release.manifest
new file mode 100755
index 000000000..317a9094c
--- /dev/null
+++ b/rust/windows-client/src-tauri/firezone-windows-client-release.manifest
@@ -0,0 +1,22 @@
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+    <dependency>
+        <dependentAssembly>
+            <assemblyIdentity
+            type="win32"
+            name="Microsoft.Windows.Common-Controls"
+            version="6.0.0.0"
+            processorArchitecture="*"
+            publicKeyToken="6595b64144ccf1df"
+            language="*"
+            />
+        </dependentAssembly>
+    </dependency>
+    <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
+        <security>
+            <requestedPrivileges>
+                <!-- Ask Windows to always run us with admin privilege -->
+                <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
+            </requestedPrivileges>
+        </security>
+    </trustInfo>
+</assembly>