diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
index 8c391c1..87b834c 100644
--- a/.github/workflows/ci-main.yml
+++ b/.github/workflows/ci-main.yml
@@ -122,16 +122,23 @@ jobs:
           git clone --depth 1 --branch 2026.04.27 https://github.com/microsoft/vcpkg.git "%VCPKG_ROOT%"
           call "%VCPKG_ROOT%\bootstrap-vcpkg.bat" -disableMetrics
 
-      - name: Cache vcpkg binary packages
-        uses: actions/cache@v5
+      # actions/cache@v5's combined restore+save runs save as a post-step
+      # that is skipped when the job fails. Splitting into restore + save
+      # lets the cache be persisted even when later steps (build/test)
+      # fail, so a single broken commit doesn't strand the cache for every
+      # subsequent main-branch run.
+      - name: Restore vcpkg binary packages
+        id: vcpkg-cache
+        uses: actions/cache/restore@v5
         with:
           path: ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
           key: vcpkg-windows-v1-2026.04.27-x64-windows-glib
           restore-keys: |
             vcpkg-windows-v1-2026.04.27-x64-windows-
 
-      - name: Cache vcpkg installed tree
-        uses: actions/cache@v5
+      - name: Restore vcpkg installed tree
+        id: vcpkg-installed-cache
+        uses: actions/cache/restore@v5
         with:
           path: ${{ env.VCPKG_ROOT }}\installed
           key: vcpkg-windows-installed-v1-2026.04.27-x64-windows-glib
@@ -156,6 +163,22 @@ jobs:
           @echo off
           "%VCPKG_ROOT%\vcpkg.exe" install glib:x64-windows --x-abi-tools-use-exact-versions
 
+      - name: Save vcpkg binary packages
+        if: steps.vcpkg-cache.outputs.cache-hit != 'true'
+        continue-on-error: true
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
+          key: ${{ steps.vcpkg-cache.outputs.cache-primary-key }}
+
+      - name: Save vcpkg installed tree
+        if: steps.vcpkg-installed-cache.outputs.cache-hit != 'true'
+        continue-on-error: true
+        uses: actions/cache/save@v5
+        with:
+          path: ${{ env.VCPKG_ROOT }}\installed
+          key: ${{ steps.vcpkg-installed-cache.outputs.cache-primary-key }}
+
       - name: Configure (clang-cl)
         shell: cmd
         run: |
diff --git a/tests/meson.build b/tests/meson.build
index 5e0237b..2562675 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -16,15 +16,22 @@ test('skeleton', test_skeleton, suite : 'unit')
 # Normalise to forward slashes; fopen accepts both on every platform.
 fixture_dir = meson.current_source_dir().replace('\\', '/') + '/fixtures'
 
+# MSVC's CRT marks fopen() as deprecated in favour of the Annex K *_s
+# variants, which are not portable to glibc/musl. Silence the deprecation
+# only for this test target so the production library stays unaffected.
+# clang-cl uses MSVC argument syntax and inherits the same warning.
+test_lexer_args = ['-DWG_FIXTURE_DIR="' + fixture_dir + '"']
+if meson.get_compiler('c').get_argument_syntax() == 'msvc'
+  test_lexer_args += '-D_CRT_SECURE_NO_WARNINGS'
+endif
+
 test_lexer = executable('test_lexer',
   files(
     'test_lexer.c',
     '../wiig/lexer/lexer.c',
   ),
   include_directories : [wiig_inc, wiig_src_inc],
-  c_args              : [
-    '-DWG_FIXTURE_DIR="' + fixture_dir + '"',
-  ],
+  c_args              : test_lexer_args,
   dependencies        : [glib_dep],
   install             : false,
 )