diff --git a/.github/workflows/native.yml b/.github/workflows/native.yml
index 6752bb6..f81e758 100644
--- a/.github/workflows/native.yml
+++ b/.github/workflows/native.yml
@@ -20,6 +20,6 @@ concurrency:
 jobs:
   native:
     # The same dnix commit as pubspec.yaml and flake.lock.
-    uses: cypherstack/dnix/.github/workflows/native.yml@e91763ef25d084b3a5cf271a0cfee69159b1f779
+    uses: cypherstack/dnix/.github/workflows/native.yml@2fd2ed73b9037fe11436f2cde832d7e28d672fa9
     with:
       macos-runner: xcode-27
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1ed0d66..da2ca45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,12 +1,17 @@
 ## Unreleased
 
+* Update dnix to support native Windows source and development builds through
+  WSL2, including the `wsl_distribution` user define and fixes for paths
+  containing percent escapes. Source builds still verify the existing
+  native-library hashes.
 * **Breaking change:** the native library now comes from
   [dnix](https://github.com/cypherstack/dnix). By default the build hook
   downloads the library of the release `dnix.lock` names and verifies its
   SHA-256; with the `build` user define set to `source` it builds the same
-  library with Nix, on Linux or an Apple Silicon Mac. The `native_build`,
-  `prebuilt_manifest_url` and `prebuilt_manifest_sha256` user defines are
-  no longer read: pinning this package's commit pins its libraries.
+  library with Nix, on Linux, an Apple Silicon Mac, or Windows via WSL2. The
+  `native_build`, `prebuilt_manifest_url` and `prebuilt_manifest_sha256` user
+  defines are no longer read: pinning this package's commit pins its
+  libraries.
 * Every change is built on four hosts, which must produce the bytes
   `dnix.lock` records; the default branch publishes the release it names.
 * A Linux arm64 library, which before could only be built from source.
diff --git a/README.md b/README.md
index b4c6554..42d87e0 100644
--- a/README.md
+++ b/README.md
@@ -23,13 +23,20 @@ hooks:
   verifies it against the hash recorded there. A mismatch is an error, never
   a fallback. Downloads are cached by hash and need public HTTPS.
 - `source` builds the library with Nix, the same build CI uses, and verifies
-  it against the same hash. Needs Nix on Linux or an Apple Silicon Mac; the
-  Apple targets need Xcode 27.0. OpenSSL is compiled from source inside that
-  build.
+  it against the same hash. Needs Nix on Linux, an Apple Silicon Mac,
+  or inside WSL2 on Windows; the Apple targets need Xcode 27.0. OpenSSL is
+  compiled from source inside that build.
 - `dev` builds with Nix but skips the Xcode pin and the hash check, for
   working on the Rust code. The hook notices a `.dnix-build` file from its
   next run on, so touch `dnix.json` after creating it.
 
+On Windows, install Nix in WSL2 and run Dart or Flutter from Windows.
+`source` and `dev` invoke `wsl.exe` using the default distribution. To
+select another distribution, add `wsl_distribution: Ubuntu-24.04` beside
+`build` in the package's user defines. Apple targets still require macOS.
+See [dnix's Windows setup](https://github.com/cypherstack/dnix/blob/main/doc/configuration.md#windows-source-builds)
+for installation and checkout requirements.
+
 Only dynamic libraries are provided, without sanitizers:
 
 | Platform | Targets | Minimum |
@@ -56,9 +63,10 @@ default branch. Nothing is committed by CI, and old releases stay.
 
 Anyone can rebuild one platform with Nix and compare:
 `dart tool/verify_release.dart linux` (or android, windows, macos, ios, or a
-target triple), on Windows inside WSL2 for the non-Apple platforms. The build
-comes from the shared [dnix](https://github.com/cypherstack/dnix) package,
-whose documentation explains how the bytes stay identical across hosts.
+target triple). Native Windows Dart invokes Nix inside WSL2 for non-Apple
+targets. The build comes from the shared
+[dnix](https://github.com/cypherstack/dnix) package, whose documentation
+explains how the bytes stay identical across hosts.
 
 ## Tests
 
diff --git a/example/pubspec.lock b/example/pubspec.lock
index 884dfba..df2a882 100644
--- a/example/pubspec.lock
+++ b/example/pubspec.lock
@@ -69,8 +69,8 @@ packages:
     dependency: transitive
     description:
       path: "."
-      ref: e91763ef25d084b3a5cf271a0cfee69159b1f779
-      resolved-ref: e91763ef25d084b3a5cf271a0cfee69159b1f779
+      ref: 2fd2ed73b9037fe11436f2cde832d7e28d672fa9
+      resolved-ref: 2fd2ed73b9037fe11436f2cde832d7e28d672fa9
       url: "https://github.com/cypherstack/dnix.git"
     source: git
     version: "0.1.0"
diff --git a/flake.lock b/flake.lock
index 928b931..1ee1e89 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         "zig-overlay": "zig-overlay"
       },
       "locked": {
-        "lastModified": 1793124403,
-        "narHash": "sha256-Nf8+4VKQWYAE7telMnxGa2no18Yu4BemMZJ2PCeG+II=",
+        "lastModified": 1793993169,
+        "narHash": "sha256-grByG+r58zmR3EdqYdNVJXiOO5u1nSfa3TTgd/VIp68=",
         "owner": "cypherstack",
         "repo": "dnix",
-        "rev": "e91763ef25d084b3a5cf271a0cfee69159b1f779",
+        "rev": "2fd2ed73b9037fe11436f2cde832d7e28d672fa9",
         "type": "github"
       },
       "original": {
diff --git a/pubspec.yaml b/pubspec.yaml
index 1416dc7..d8a061e 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -17,7 +17,7 @@ dependencies:
   dnix:
     git:
       url: https://github.com/cypherstack/dnix.git
-      ref: e91763ef25d084b3a5cf271a0cfee69159b1f779
+      ref: 2fd2ed73b9037fe11436f2cde832d7e28d672fa9
 
 
 dev_dependencies: