diff --git a/packages/opencode/script/build.ts b/packages/opencode/script/build.ts
index 34e80d71a08..fc6859183e3 100755
--- a/packages/opencode/script/build.ts
+++ b/packages/opencode/script/build.ts
@@ -65,6 +65,7 @@ const allTargets: {
   arch: "arm64" | "x64"
   abi?: "musl"
   avx2?: false
+  noCa?: true
 }[] = [
   {
     os: "linux",
@@ -117,6 +118,17 @@ const allTargets: {
     arch: "x64",
     avx2: false,
   },
+  {
+    os: "win32",
+    arch: "x64",
+    noCa: true,
+  },
+  {
+    os: "win32",
+    arch: "x64",
+    avx2: false,
+    noCa: true,
+  },
 ]
 
 const targets = singleFlag
@@ -136,6 +148,11 @@ const targets = singleFlag
         return false
       }
 
+      // skip no-ca variants for local dev builds
+      if (item.noCa) {
+        return false
+      }
+
       return true
     })
   : allTargets
@@ -155,6 +172,7 @@ for (const item of targets) {
     item.arch,
     item.avx2 === false ? "baseline" : undefined,
     item.abi === undefined ? undefined : item.abi,
+    item.noCa ? "no-ca" : undefined,
   ]
     .filter(Boolean)
     .join("-")
@@ -178,9 +196,9 @@ for (const item of targets) {
       autoloadDotenv: false,
       autoloadTsconfig: true,
       autoloadPackageJson: true,
-      target: name.replace(pkg.name, "bun") as any,
+      target: name.replace(pkg.name, "bun").replace("-no-ca", "") as any,
       outfile: `dist/${name}/bin/opencode`,
-      execArgv: [`--user-agent=opencode/${Script.version}`, "--use-system-ca", "--"],
+      execArgv: [`--user-agent=opencode/${Script.version}`, ...(!item.noCa && process.env.OPENCODE_DISABLE_SYSTEM_CA !== 'true' ? ['--use-system-ca'] : []), "--"],
       windows: {},
     },
     entrypoints: ["./src/index.ts", parserWorker, workerPath],
diff --git a/packages/opencode/script/publish.ts b/packages/opencode/script/publish.ts
index fbc1c83ba6d..69385b4cef5 100755
--- a/packages/opencode/script/publish.ts
+++ b/packages/opencode/script/publish.ts
@@ -10,6 +10,7 @@ process.chdir(dir)
 const binaries: Record<string, string> = {}
 for (const filepath of new Bun.Glob("*/package.json").scanSync({ cwd: "./dist" })) {
   const pkg = await Bun.file(`./dist/${filepath}`).json()
+  if (pkg.name.includes("-no-ca")) continue
   binaries[pkg.name] = pkg.version
 }
 console.log("binaries", binaries)