diff --git a/.github/workflows/ci-cache-warmup-platform-jobs.yml b/.github/workflows/ci-cache-warmup-platform-jobs.yml
index f623fb74a1c..a8f4ab00c67 100644
--- a/.github/workflows/ci-cache-warmup-platform-jobs.yml
+++ b/.github/workflows/ci-cache-warmup-platform-jobs.yml
@@ -50,7 +50,8 @@ jobs:
       - uses: ./.github/actions/install-node-dependencies
         with:
           native-runtime: node
-          cache-pnpm-store-lookup-only: 'true'
+          # Windows PR consumers download packages directly; retain only the build caches.
+          cache-pnpm-store: 'false'
       - name: Verify native cache is usable
         run: node config/scripts/ensure-native-runtime.mjs --check-only
 
diff --git a/.github/workflows/ci-cache-warmup-platforms.yml b/.github/workflows/ci-cache-warmup-platforms.yml
index 11a28e1b971..11b96179bbd 100644
--- a/.github/workflows/ci-cache-warmup-platforms.yml
+++ b/.github/workflows/ci-cache-warmup-platforms.yml
@@ -37,6 +37,7 @@ on:
       - 'config/scripts/space-sharing-copy.mjs'
       - 'config/patches/**'
       - 'native/windows-registry/**'
+      - 'native/windows-security/**'
       - 'native/windows-cli-launcher/**'
       - 'native/windows-agent-hook/**'
       - 'config/scripts/build-windows-cli-launcher.mjs'
diff --git a/config/scripts/ci-dependency-download-cache.test.mjs b/config/scripts/ci-dependency-download-cache.test.mjs
index a67616b7c00..7af6b9f6a1d 100644
--- a/config/scripts/ci-dependency-download-cache.test.mjs
+++ b/config/scripts/ci-dependency-download-cache.test.mjs
@@ -277,7 +277,7 @@ describe('CI dependency download caches', () => {
     }
   )
 
-  it('opts Windows server consumers out while preserving the main warmer store writer', () => {
+  it('opts Windows preparation out of download stores while retaining native caches', () => {
     const installer = './.github/actions/install-node-dependencies'
     const persistence = workflow('node-server-tests').jobs.persistence.steps.find(
       (step) => step.uses === installer
@@ -292,8 +292,8 @@ describe('CI dependency download caches', () => {
     expect(action.inputs['cache-pnpm-store'].default).toBe('true')
     expect(persistence.with['cache-pnpm-store']).toBe("${{ runner.os != 'Windows' }}")
     expect(ssh.with['cache-pnpm-store']).toBe('false')
-    expect(warmer.with['cache-pnpm-store']).toBeUndefined()
-    expect(warmer.with['cache-pnpm-store-lookup-only']).toBe('true')
+    expect(warmer.with['cache-pnpm-store']).toBe('false')
+    expect(warmer.with['native-runtime']).toBe('node')
     expect(persistence.with['cache-pnpm-store-lookup-only']).toBe('true')
     for (const job of [workflow('ci-cache-warmup').jobs.warm, platformJobs['warm-linux-arm']]) {
       const install = job.steps.find((step) => step.uses?.includes('install-node-dependencies'))
@@ -330,6 +330,7 @@ describe('CI dependency download caches', () => {
           '.github/workflows/ci-cache-warmup-platform-jobs.yml',
           '.github/actions/install-node-dependencies/**',
           '.github/actions/prepare-native-runtime/**',
+          'native/windows-security/**',
           'pnpm-lock.yaml'
         ])
       )