diff --git a/build/windows/README.md b/build/windows/README.md
index 223ca18f8c8..715a4515fba 100644
--- a/build/windows/README.md
+++ b/build/windows/README.md
@@ -131,7 +131,10 @@ redistributable, which the ASF cannot ship. An interactive install says so when
 it cannot find `vcruntime140.dll`, rather than letting the first run fail with a
 missing-DLL dialog. It never blocks, and a silent install - which is what a
 package manager does - shows nothing; the WinGet and Chocolatey packages declare
-the redistributable as a dependency instead, so their users never see it.
+the redistributable as a dependency instead, so their users never see it. They
+ask for version 14.51 or later, because it has to be at least as new as the build
+tools the compiler was built with; a version already installed only counts from
+there on.
 
 ## `installer/test-installer.ps1`
 
diff --git a/build/windows/chocolatey/test-chocolatey-package.ps1 b/build/windows/chocolatey/test-chocolatey-package.ps1
index 5e0e4d9a5a4..e200e3b8686 100644
--- a/build/windows/chocolatey/test-chocolatey-package.ps1
+++ b/build/windows/chocolatey/test-chocolatey-package.ps1
@@ -117,6 +117,25 @@ try {
         (@($dependencies | Where-Object { $_.id -eq 'vcredist140' }).Count -eq 1) `
         (($dependencies | ForEach-Object { $_.id }) -join ', ')
 
+    # The installed redistributable has to be at least as new as the build
+    # tools the compiler was built with. Without a minimum, any version that is
+    # already installed satisfies the dependency and is not updated.
+    $redist = @($dependencies | Where-Object { $_.id -eq 'vcredist140' }) | Select-Object -First 1
+    $redistMinimum = if ($redist) { [string]$redist.version } else { '' }
+    Assert-True 'the redistributable dependency names a minimum version' `
+        ($redistMinimum -match '^14\.\d+') "version '$redistMinimum'"
+
+    # Both package managers have to ask for the same runtime.
+    $wingetTemplate = Get-Content -LiteralPath (Join-Path $PSScriptRoot '..\winget\Apache.Thrift.installer.yaml.in') -Raw
+    $wingetMinimum = ([regex]::Match($wingetTemplate, "MinimumVersion:\s*'([^']*)'")).Groups[1].Value
+    Assert-True 'the minimum matches the one in the WinGet manifest' `
+        ([bool]$redistMinimum -and ($redistMinimum -eq $wingetMinimum)) "nuspec '$redistMinimum', WinGet '$wingetMinimum'"
+
+    # There is no square Thrift logo to point at, and Chocolatey flags a dead
+    # icon link.
+    Assert-True 'the nuspec names no icon' (-not $nuspec.package.metadata.iconUrl) `
+        ([string]$nuspec.package.metadata.iconUrl)
+
     $install = Get-Content -LiteralPath $installPath -Raw
     Assert-True 'the install script holds no placeholders' ($install -notmatch '__[A-Z0-9_]+__')
     Assert-True 'the checksum reaches the install script' ($install -match "checksum64\s*=\s*'$sha'")
diff --git a/build/windows/chocolatey/thrift.nuspec.in b/build/windows/chocolatey/thrift.nuspec.in
index 6f713525fed..02f1a081610 100644
--- a/build/windows/chocolatey/thrift.nuspec.in
+++ b/build/windows/chocolatey/thrift.nuspec.in
@@ -36,7 +36,7 @@
     <mailingListUrl>https://thrift.apache.org/mailing</mailingListUrl>
     <licenseUrl>https://www.apache.org/licenses/LICENSE-2.0</licenseUrl>
     <requireLicenseAcceptance>false</requireLicenseAcceptance>
-    <iconUrl>https://thrift.apache.org/assets/images/thrift-logo.svg</iconUrl>
+    <!-- No iconUrl: there is no square Thrift logo to point at. -->
     <copyright>Copyright (c) The Apache Software Foundation</copyright>
     <tags>apache thrift rpc idl codegen compiler serialization admin</tags>
     <summary>The Apache Thrift IDL compiler</summary>
@@ -64,8 +64,11 @@ shell afterwards.
     <dependencies>
       <!-- The compiler links the shared runtime, so it needs the Visual C++
            redistributable, which the ASF cannot ship. Chocolatey installs
-           this first. -->
-      <dependency id="vcredist140" />
+           this first. It has to be at least as new as the build tools the
+           compiler was built with, so a version already installed only
+           counts from that one on. Keep it equal to MinimumVersion in
+           build/windows/winget/Apache.Thrift.installer.yaml.in. -->
+      <dependency id="vcredist140" version="14.51" />
     </dependencies>
   </metadata>
   <files>
diff --git a/build/windows/winget/Apache.Thrift.installer.yaml.in b/build/windows/winget/Apache.Thrift.installer.yaml.in
index c9dfe1e38e8..7c4acaa746e 100644
--- a/build/windows/winget/Apache.Thrift.installer.yaml.in
+++ b/build/windows/winget/Apache.Thrift.installer.yaml.in
@@ -32,10 +32,15 @@ UpgradeBehavior: install
 ProductCode: '{064E0C5D-29EE-47DD-BB5E-172FE25FE936}_is1'
 ReleaseDate: __RELEASE_DATE__
 # The compiler links the shared runtime, so it needs the Visual C++
-# redistributable, which the ASF cannot ship. WinGet installs this first.
+# redistributable, which the ASF cannot ship. WinGet installs this first. It
+# has to be at least as new as the build tools the compiler was built with, so
+# a version already installed only counts from that one on. Keep it equal to
+# the vcredist140 version in build/windows/chocolatey/thrift.nuspec.in. Quoted,
+# so that YAML does not read it as a number.
 Dependencies:
   PackageDependencies:
     - PackageIdentifier: Microsoft.VCRedist.2015+.x64
+      MinimumVersion: '14.51'
 Installers:
   - Architecture: x64
     InstallerUrl: __INSTALLER_URL__
diff --git a/build/windows/winget/test-winget-manifests.ps1 b/build/windows/winget/test-winget-manifests.ps1
index 2b2fff10e3a..13c52465a73 100644
--- a/build/windows/winget/test-winget-manifests.ps1
+++ b/build/windows/winget/test-winget-manifests.ps1
@@ -126,6 +126,13 @@ try {
     Assert-True 'the redistributable is declared as a dependency' `
         ($installer -match 'PackageIdentifier:\s*Microsoft\.VCRedist\.2015\+\.x64') $installer
 
+    # The installed redistributable has to be at least as new as the build
+    # tools the compiler was built with. Without a minimum, any version that is
+    # already installed satisfies the dependency and is not updated. Quoted, so
+    # that YAML does not read 14.51 as a number.
+    Assert-True 'the redistributable dependency names a minimum version' `
+        ($installer -match "PackageIdentifier:\s*Microsoft\.VCRedist\.2015\+\.x64\s*\n\s*MinimumVersion:\s*'14\.\d+'") $installer
+
     # downloads.apache.org only carries the current release, so a manifest
     # naming it stops working at the next one.
     Assert-True 'the installer URL defaults to the Apache archive' `
diff --git a/doc/ReleaseManagement.md b/doc/ReleaseManagement.md
index 3e58a9d86f1..1d48f948d41 100644
--- a/doc/ReleaseManagement.md
+++ b/doc/ReleaseManagement.md
@@ -205,6 +205,13 @@ All Apache Thrift releases go through a 72-hour final release candidate voting p
             Do **not** build a statically linked compiler to make that list shorter.  The
             project moved away from one deliberately, and the released compiler is expected
             to require the Visual C++ redistributable; the check fails if it does not.
+
+            The installed redistributable has to be at least as new as the build tools the
+            compiler was built with, so the WinGet and Chocolatey packages ask for that version
+            or later: 14.51, what 0.25.0 was built with.  If you build with newer build tools -
+            `dumpbin /headers thrift.exe` shows their version as the linker version - raise
+            `MinimumVersion` in `build/windows/winget/Apache.Thrift.installer.yaml.in` and the
+            `vcredist140` version in `build/windows/chocolatey/thrift.nuspec.in` to match.
         1. Copy the executable `thrift.exe` to your linux system where the signed tarball lives and rename it to `thrift-1.0.0.exe` (substitute the correct version, of course).
         1. Sign the executable the same way you signed the tarball.
         1. Build the Windows installer from the very same executable: