diff --git a/cmd/pkgsite/main_test.go b/cmd/pkgsite/main_test.go
index 0be2a34..b23f95f 100644
--- a/cmd/pkgsite/main_test.go
+++ b/cmd/pkgsite/main_test.go
@@ -71,7 +71,7 @@
 
 	modcacheChecker := in("",
 		in(".Documentation", hasText("var V = 1")),
-		sourceLinks(path.Join(abs(cacheDir), "modcache.com@v1.0.0"), "a.go"))
+		sourceLinks(path.Join(filepath.ToSlash(abs(cacheDir)), "modcache.com@v1.0.0"), "a.go"))
 
 	ctx := context.Background()
 	for _, test := range []struct {
@@ -88,7 +88,7 @@
 			http.StatusOK,
 			in("",
 				in(".Documentation", hasText("There is no documentation for this package.")),
-				sourceLinks(path.Join(abs(localModule), "example.com/testmod"), "a.go")),
+				sourceLinks(path.Join(filepath.ToSlash(abs(localModule)), "example.com/testmod"), "a.go")),
 		},
 		{
 			"modcache",
diff --git a/internal/source/source.go b/internal/source/source.go
index 07fb70a..1f581fd 100644
--- a/internal/source/source.go
+++ b/internal/source/source.go
@@ -26,6 +26,7 @@
 	"fmt"
 	"net/http"
 	"path"
+	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
@@ -937,7 +938,7 @@
 	// http.FileServer redirects instead of serving the directory contents, with
 	// confusing results.
 	return &Info{
-		repoURL: path.Join("/files", dir),
+		repoURL: path.Join("/files", filepath.ToSlash(dir)),
 		templates: urlTemplates{
 			Repo:      "{repo}/",
 			Directory: "{repo}/{dir}/",
diff --git a/internal/vuln/client.go b/internal/vuln/client.go
index 07c64ea..ef1bfd9 100644
--- a/internal/vuln/client.go
+++ b/internal/vuln/client.go
@@ -8,7 +8,7 @@
 	"bytes"
 	"context"
 	"encoding/json"
-	"path/filepath"
+	"path"
 	"sort"
 	"strings"
 
@@ -394,5 +394,5 @@
 }
 
 func (c *Client) entry(ctx context.Context, id string) ([]byte, error) {
-	return c.src.get(ctx, filepath.Join(idDir, id))
+	return c.src.get(ctx, path.Join(idDir, id))
 }
diff --git a/internal/vuln/source_test.go b/internal/vuln/source_test.go
index 03893e4..6eff01c 100644
--- a/internal/vuln/source_test.go
+++ b/internal/vuln/source_test.go
@@ -12,12 +12,16 @@
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 
 	"golang.org/x/pkgsite/internal/osv"
 )
 
 func TestNewSource(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("windows is not supported (see convertFileURLPath")
+	}
 	t.Run("https", func(t *testing.T) {
 		url := "https://vuln.go.dev"
 		s, err := NewSource(url)
diff --git a/internal/vuln/url_test.go b/internal/vuln/url_test.go
index 37b5bc7..22334cb 100644
--- a/internal/vuln/url_test.go
+++ b/internal/vuln/url_test.go
@@ -6,10 +6,14 @@
 
 import (
 	"net/url"
+	"runtime"
 	"testing"
 )
 
 func TestURLToFilePath(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("windows is not supported (see convertFileURLPath")
+	}
 	for _, tc := range urlTests {
 		if tc.url == "" {
 			continue