diff --git a/creds/peercreds/peercreds_windows.go b/creds/peercreds/peercreds_windows.go
index 3f2a2a4..557f312 100644
--- a/creds/peercreds/peercreds_windows.go
+++ b/creds/peercreds/peercreds_windows.go
@@ -18,7 +18,7 @@ func Get(conn net.Conn) (*Creds, error) {
 		return nil, ErrUnsupportedConnType
 	}
 
-	h, err := winioPipeHandle(conn)
+	h, err := pipeHandle(conn)
 	if err != nil {
 		return nil, err
 	}
@@ -59,6 +59,18 @@ func Get(conn net.Conn) (*Creds, error) {
 	}, nil
 }
 
+
+type handle interface {
+	Handle() windows.Handle
+}
+
+func pipeHandle(conn net.Conn) (windows.Handle, error) {
+	if c, ok := conn.(handle); ok {
+		return c.Handle(), nil
+	}
+	return winioPipeHandle(conn)
+}
+
 // winioPipeHandle digs the underlying syscall HANDLE out of a go-winio
 // pipe connection using reflect + unsafe. This depends on the current
 // internal layout of github.com/Microsoft/go-winio:
diff --git a/go.mod b/go.mod
index 3e50632..d8b6271 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module go.linka.cloud/grpc-toolkit
 
-go 1.23.0
+go 1.23.1
 
 toolchain go1.24.3
 
@@ -58,6 +58,7 @@ require (
 	golang.org/x/net v0.40.0
 	golang.org/x/sync v0.14.0
 	golang.org/x/sys v0.33.0
+	golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb
 	google.golang.org/genproto/googleapis/api v0.0.0-20250519155744-55703ea1f237
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250519155744-55703ea1f237
 	google.golang.org/grpc v1.72.1
diff --git a/go.sum b/go.sum
index 744b51e..02fa039 100644
--- a/go.sum
+++ b/go.sum
@@ -906,6 +906,8 @@ golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8T
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb h1:whnFRlWMcXI9d+ZbWg+4sHnLp52d5yiIPUxMBSt4X9A=
+golang.zx2c4.com/wireguard v0.0.0-20250521234502-f333402bd9cb/go.mod h1:rpwXGsirqLqN2L0JDJQlwOboGHmptD5ZD6T2VmcqhTw=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
diff --git a/service/listen.go b/service/listen_other.go
similarity index 100%
rename from service/listen.go
rename to service/listen_other.go
diff --git a/service/listen_windows.go b/service/listen_windows.go
index 8bff049..d7fd426 100644
--- a/service/listen_windows.go
+++ b/service/listen_windows.go
@@ -3,12 +3,15 @@ package service
 import (
 	"net"
 
-	"github.com/Microsoft/go-winio"
+	"golang.zx2c4.com/wireguard/ipc/namedpipe"
 )
 
+// listen uses wireguard's namedpipe package to listen on named pipes on Windows until
+// https://github.com/golang/go/issues/49650 is resolved.
+// For other networks, it falls back to the standard net.Listen.
 func listen(network, address string) (net.Listener, error) {
 	if network == "pipe" {
-		return winio.ListenPipe(address, nil)
+		return namedpipe.Listen(address)
 	}
 	return net.Listen(network, address)
 }
diff --git a/service/service.go b/service/service.go
index 45bc9ba..65bed91 100644
--- a/service/service.go
+++ b/service/service.go
@@ -139,7 +139,8 @@ func newService(opts ...Option) (*service, error) {
 		grpc.StreamInterceptor(si),
 		grpc.UnaryInterceptor(ui),
 	}
-	if _, ok := s.opts.lis.(*net.UnixListener); ok || strings.HasPrefix(s.opts.address, "unix://") || strings.HasPrefix(s.opts.address, `\\.\pipe\`) {
+	if (s.opts.lis != nil && (s.opts.lis.Addr().Network() == "unix" || s.opts.lis.Addr().Network() == "pipe")) ||
+		strings.HasPrefix(s.opts.address, "unix://") || strings.HasPrefix(s.opts.address, `\\.\pipe\`) {
 		gopts = append(gopts, grpc.Creds(peercreds.New()))
 	}
 	s.server = grpc.NewServer(append(gopts, s.opts.serverOpts...)...)