diff --git a/.github/workflows/native.yml b/.github/workflows/native.yml
index 574fbc7..18e6024 100644
--- a/.github/workflows/native.yml
+++ b/.github/workflows/native.yml
@@ -20,7 +20,7 @@ concurrency:
 jobs:
   native:
     # The same dnix commit as pubspec.yaml and flake.lock.
-    uses: cypherstack/dnix/.github/workflows/native.yml@e91763ef25d084b3a5cf271a0cfee69159b1f779
+    uses: cypherstack/dnix/.github/workflows/native.yml@2fd2ed73b9037fe11436f2cde832d7e28d672fa9
     with:
       # Xcode 27 lives on its own public-preview image, not on macos-26.
       macos-runner: xcode-27
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3f4d0e5..b5feb89 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 ## Unreleased
 
+* Update dnix to support native Windows source and development builds through
+  WSL2, including the `wsl_distribution` user define and fixes for paths
+  containing percent escapes. Source builds still verify the existing
+  native-library hashes.
 * The build hook, the Nix build, and the workflows now come from the shared `dnix` package; the package keeps `dnix.json`, `dnix.lock`, a two-line hook, and a two-line flake.
 * The hook obtains the native library in one of three modes: `prebuilt` downloads the library of the pinned native release and verifies its hash, `source` builds it with the Nix flake and verifies the same hash, and `dev` builds with Nix without the Xcode pin or hash check. Static linking is no longer offered.
 * `dnix.lock` is a source file: `update_lock` records what the Rust source builds to and names the release, derived from the hashes, that holds those bytes. CI fails when source and lock disagree and publishes the release when the lock reaches the default branch; nothing is committed by CI.
diff --git a/README.md b/README.md
index 36e5385..c3aa530 100644
--- a/README.md
+++ b/README.md
@@ -34,12 +34,19 @@ hooks:
   verifies it against the hash recorded there. A mismatch is an error, never
   a fallback. Downloads are cached by hash.
 - `source` builds the library with Nix, the same build CI uses, and verifies
-  it against the same hash. Needs Nix on Linux or an Apple Silicon Mac; the
-  Apple targets need Xcode 27.0.
+  it against the same hash. Needs Nix on Linux, an Apple Silicon Mac,
+  or inside WSL2 on Windows; the Apple targets need Xcode 27.0.
 - `dev` builds with Nix but skips the Xcode pin and the hash check, for
   working on the Rust code. The hook notices a `.dnix-build` file from its
   next run on, so touch `dnix.json` after creating it.
 
+On Windows, install Nix in WSL2 and run Dart or Flutter from Windows.
+`source` and `dev` invoke `wsl.exe` using the default distribution. To
+select another distribution, add `wsl_distribution: Ubuntu-24.04` beside
+`build` in the package's user defines. Apple targets still require macOS.
+See [dnix's Windows setup](https://github.com/cypherstack/dnix/blob/main/doc/configuration.md#windows-source-builds)
+for installation and checkout requirements.
+
 Only dynamic libraries are provided, built for macOS 12, iOS 13 (the arm64
 simulator 14), Android API 24, and glibc 2.28 at minimum. iOS stays at 13
 because Flutter 3.47 asks build hooks for iOS 13 and writes 13.0 into each
@@ -59,9 +66,9 @@ default branch. Nothing is ever committed by CI, and old releases stay.
 
 Anyone can rebuild one platform with Nix and compare:
 `dart tool/verify_release.dart linux` (or android, windows, macos, ios, or a
-target triple), on Windows inside WSL2 for the non-Apple platforms. The Apple
-platforms use the Xcode 27.0 bundle under `/Applications`, whatever
-`xcode-select` points at.
+target triple). Native Windows Dart invokes Nix inside WSL2 for non-Apple
+targets. The Apple platforms use the Xcode 27.0 bundle under `/Applications`,
+whatever `xcode-select` points at.
 
 ### How the build stays reproducible
 
diff --git a/example/pubspec.lock b/example/pubspec.lock
index 3a1bd9a..20d6172 100644
--- a/example/pubspec.lock
+++ b/example/pubspec.lock
@@ -69,8 +69,8 @@ packages:
     dependency: transitive
     description:
       path: "."
-      ref: e91763ef25d084b3a5cf271a0cfee69159b1f779
-      resolved-ref: e91763ef25d084b3a5cf271a0cfee69159b1f779
+      ref: 2fd2ed73b9037fe11436f2cde832d7e28d672fa9
+      resolved-ref: 2fd2ed73b9037fe11436f2cde832d7e28d672fa9
       url: "https://github.com/cypherstack/dnix.git"
     source: git
     version: "0.1.0"
diff --git a/flake.lock b/flake.lock
index 928b931..1ee1e89 100644
--- a/flake.lock
+++ b/flake.lock
@@ -7,11 +7,11 @@
         "zig-overlay": "zig-overlay"
       },
       "locked": {
-        "lastModified": 1793124403,
-        "narHash": "sha256-Nf8+4VKQWYAE7telMnxGa2no18Yu4BemMZJ2PCeG+II=",
+        "lastModified": 1793993169,
+        "narHash": "sha256-grByG+r58zmR3EdqYdNVJXiOO5u1nSfa3TTgd/VIp68=",
         "owner": "cypherstack",
         "repo": "dnix",
-        "rev": "e91763ef25d084b3a5cf271a0cfee69159b1f779",
+        "rev": "2fd2ed73b9037fe11436f2cde832d7e28d672fa9",
         "type": "github"
       },
       "original": {
diff --git a/pubspec.yaml b/pubspec.yaml
index 1f8a6c5..49f0d19 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -13,7 +13,7 @@ dependencies:
   dnix:
     git:
       url: https://github.com/cypherstack/dnix.git
-      ref: e91763ef25d084b3a5cf271a0cfee69159b1f779
+      ref: 2fd2ed73b9037fe11436f2cde832d7e28d672fa9
 
 dev_dependencies:
   test: ^1.26.3