diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f36cff4c9..a3c1a390f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        runs-on: [ubuntu-latest, windows-latest, macos-latest]
+        runs-on: [ubuntu-latest, windows-2022, macos-latest]
         python:
         - '2.7'
         - '3.5'
@@ -38,19 +38,24 @@ jobs:
         # present), or add new keys to an existing matrix element if all the
         # existing keys match.
         #
-        # We support an optional keys: args, for cmake args
+        # We support an optional key: args, for cmake args
         include:
           # Just add a key
           - runs-on: ubuntu-latest
-            python: 3.6
+            python: '3.6'
             args: >
               -DPYBIND11_FINDPYTHON=ON
           - runs-on: windows-latest
-            python: 3.6
+            python: '3.6'
             args: >
               -DPYBIND11_FINDPYTHON=ON
           - runs-on: macos-latest
-            python: pypy-2.7
+            python: 'pypy-2.7'
+          # Inject a couple Windows 2019 runs
+          - runs-on: windows-2019
+            python: '3.9'
+          - runs-on: windows-2019
+            python: '2.7'
 
     name: "🐍 ${{ matrix.python }} • ${{ matrix.runs-on }} • x64 ${{ matrix.args }}"
     runs-on: ${{ matrix.runs-on }}
@@ -182,6 +187,7 @@ jobs:
     # setuptools
     - name: Setuptools helpers test
       run: pytest tests/extra_setuptools
+      if: "!(matrix.python == '3.5' && matrix.runs-on == 'windows-2022')"
 
 
   deadsnakes:
diff --git a/include/pybind11/detail/common.h b/include/pybind11/detail/common.h
index eb5fb0868..2d57367d0 100644
--- a/include/pybind11/detail/common.h
+++ b/include/pybind11/detail/common.h
@@ -154,6 +154,14 @@
 // C4505: 'PySlice_GetIndicesEx': unreferenced local function has been removed (PyPy only)
 #  pragma warning(disable: 4505)
 #  if defined(_DEBUG) && !defined(Py_DEBUG)
+// Workaround for a VS 2022 issue.
+// NOTE: This workaround knowingly violates the Python.h include order requirement:
+// https://docs.python.org/3/c-api/intro.html#include-files
+// See https://github.com/pybind/pybind11/pull/3497 for full context.
+#    include <yvals.h>
+#    if _MSVC_STL_VERSION >= 143
+#      include <crtdefs.h>
+#    endif
 #    define PYBIND11_DEBUG_MARKER
 #    undef _DEBUG
 #  endif
diff --git a/include/pybind11/embed.h b/include/pybind11/embed.h
index 9843f0f97..af36340f3 100644
--- a/include/pybind11/embed.h
+++ b/include/pybind11/embed.h
@@ -102,6 +102,13 @@ inline wchar_t *widen_chars(const char *safe_arg) {
     wchar_t *widened_arg = Py_DecodeLocale(safe_arg, nullptr);
 #else
     wchar_t *widened_arg = nullptr;
+
+// warning C4996: 'mbstowcs': This function or variable may be unsafe.
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable:4996)
+#endif
+
 #    if defined(HAVE_BROKEN_MBSTOWCS) && HAVE_BROKEN_MBSTOWCS
     size_t count = strlen(safe_arg);
 #    else
@@ -111,6 +118,11 @@ inline wchar_t *widen_chars(const char *safe_arg) {
         widened_arg = new wchar_t[count + 1];
         mbstowcs(widened_arg, safe_arg, count + 1);
     }
+
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
+
 #endif
     return widened_arg;
 }