diff --git a/.github/workflows/portability.yml b/.github/workflows/portability.yml
index ebf511c2..38f0e91c 100644
--- a/.github/workflows/portability.yml
+++ b/.github/workflows/portability.yml
@@ -64,9 +64,14 @@ jobs:
           cmake --install build --prefix "$PWD/install"
           cmake -S tests/consumer -B consumer -G Ninja -DCMAKE_PREFIX_PATH="$PWD/install"
           cmake --build consumer
-          export PATH="$PWD/install/bin:$PATH"
-          ./consumer/consumer_static.exe
-          ./consumer/consumer_shared.exe
+      - name: Run installed consumers without toolchain DLLs
+        shell: pwsh
+        run: |
+          $env:PATH = "$env:GITHUB_WORKSPACE\install\bin;$env:SystemRoot\System32;$env:SystemRoot"
+          & ./consumer/consumer_static.exe
+          if ($LASTEXITCODE -ne 0) { throw "Static consumer failed: $LASTEXITCODE" }
+          & ./consumer/consumer_shared.exe
+          if ($LASTEXITCODE -ne 0) { throw "Shared consumer failed: $LASTEXITCODE" }
 
   freebsd:
     runs-on: ubuntu-latest
diff --git a/README.md b/README.md
index d7327e61..234467d9 100644
--- a/README.md
+++ b/README.md
@@ -119,12 +119,10 @@ validation limits are tracked in [docs/modernization.md](docs/modernization.md).
 
 ### Debian & Ubuntu
 
-#### Install from repository (not recommended)
+#### Distribution packages
 
-Shadowsocks-libev is available in the official repository for following distributions:
-
-* Debian 8 or higher, including oldoldstable (jessie), old stable (stretch), stable (buster), testing (bullseye) and unstable (sid)
-* Ubuntu 16.10 or higher
+Package availability and versions depend on the distribution release; packaged
+versions can differ from this source branch.
 
 ```bash
 sudo apt update
@@ -133,17 +131,15 @@ sudo apt install shadowsocks-libev
 
 #### Build deb package from source
 
-You can build shadowsocks-libev and all its dependencies by script:
+Install the build dependencies listed in `debian/control`, then build the
+packages from this checkout:
 
 ```bash
-mkdir -p ~/build-area/
-cp ./scripts/build_deb.sh ~/build-area/
-cd ~/build-area
-./build_deb.sh
+dpkg-buildpackage -b -us -uc
 ```
 
-For older systems, building `.deb` packages is not supported.
-Please try to build and install directly from source. See the [Linux](#linux) section below.
+Debian packaging explicitly uses system libraries. For a bundled build without
+library development packages, use the [CMake instructions](#build-from-source-cmake).
 
 #### Configure and start the service
 
@@ -161,19 +157,10 @@ sudo systemctl start shadowsocks-libev      # for systemd
 
 ### Fedora & RHEL
 
-Supported distributions:
-
-* Recent Fedora versions (until EOL)
-* RHEL 6, 7 and derivatives (including CentOS, Scientific Linux)
-
-#### Build from source with centos
-
-If you are using CentOS 7, you need to install these prerequirements to build from source code:
-
-```bash
-yum install epel-release -y
-yum install gcc gettext autoconf libtool automake make pcre-devel asciidoc xmlto c-ares-devel libev-devel libsodium-devel mbedtls-devel -y
-```
+Use the bundled CMake build above with a C11 compiler, CMake 3.20+ and Make
+or Ninja. Older distribution toolchains may need upgrading. Autotools, gettext
+and separately installed crypto/event/DNS development libraries are not required
+for bundled mode.
 
 ### Archlinux & Manjaro
 
diff --git a/cmake/ProjectOptions.cmake b/cmake/ProjectOptions.cmake
index 9642802e..cb160b7e 100644
--- a/cmake/ProjectOptions.cmake
+++ b/cmake/ProjectOptions.cmake
@@ -9,6 +9,14 @@ function(ss_project_options target)
     target_include_directories(${target} BEFORE PRIVATE ${MBEDTLS_INCLUDE_DIRS})
     if(WIN32)
         target_compile_definitions(${target} PRIVATE WIN32_LEAN_AND_MEAN __USE_MINGW_ANSI_STDIO=1)
+        # MinGW can otherwise pull in libwinpthread/libgcc from the toolchain,
+        # even when all explicitly selected dependencies are static archives.
+        get_target_property(ss_target_type ${target} TYPE)
+        # Zig already supplies its own runtime for DLLs; its -static switch
+        # changes the output kind instead of just selecting static libraries.
+        if(NOT ss_target_type STREQUAL "SHARED_LIBRARY" OR CMAKE_C_COMPILER_ID STREQUAL "GNU")
+            target_link_options(${target} PRIVATE -static)
+        endif()
     endif()
     if(MSVC)
         target_compile_options(${target} PRIVATE /W4)
diff --git a/cmake/shadowsocks-libev-config.cmake.in b/cmake/shadowsocks-libev-config.cmake.in
index ba519595..6708b8fe 100644
--- a/cmake/shadowsocks-libev-config.cmake.in
+++ b/cmake/shadowsocks-libev-config.cmake.in
@@ -20,6 +20,9 @@ if(@SS_BUILD_STATIC_LIBRARY@ AND NOT TARGET shadowsocks::static)
         IMPORTED_LOCATION "@PACKAGE_CMAKE_INSTALL_LIBDIR@/@SS_STATIC_FILENAME@"
         INTERFACE_INCLUDE_DIRECTORIES "@PACKAGE_CMAKE_INSTALL_INCLUDEDIR@")
     include("${CMAKE_CURRENT_LIST_DIR}/shadowsocks-private.cmake")
+    if(WIN32)
+        set_property(TARGET shadowsocks::static PROPERTY INTERFACE_LINK_OPTIONS -static)
+    endif()
 endif()
 if(NOT TARGET shadowsocks::shadowsocks)
     if(TARGET shadowsocks::shared)
diff --git a/tests/interop.py b/tests/interop.py
index 39a413b3..102963d0 100644
--- a/tests/interop.py
+++ b/tests/interop.py
@@ -182,7 +182,7 @@ def main():
         if os.name != "nt":
             parser.error("--isolate-windows-runtime requires Windows")
         environment = os.environ.copy()
-        system_root = environment["SystemRoot"]
+        system_root = os.environ["SYSTEMROOT"]
         environment["PATH"] = os.pathsep.join((system_root, os.path.join(system_root, "System32")))
     binary_dir = Path(args.bin).resolve()
     suffix = ".exe" if os.name == "nt" else ""