diff --git a/nix/toolchain.nix b/nix/toolchain.nix
index e8baa63a8..7f5d89d31 100644
--- a/nix/toolchain.nix
+++ b/nix/toolchain.nix
@@ -18,6 +18,7 @@ let
   pkgsHost = import pkgsSrc {};
   lib = pkgsHost.lib;
   kaniko = (import ./kaniko.nix) pkgsHost;
+  winscp = (import ./winscp.nix) pkgsHost;
 in 
   lib.flatten (builtins.map (pkgs: [
      pkgs.rustPlatform.rust.rustc
@@ -25,5 +26,6 @@ in
      pkgs.buildPackages.stdenv.cc
   ]) pkgsList) ++ [
     kaniko
+    winscp
   ]
 
diff --git a/nix/winscp.nix b/nix/winscp.nix
new file mode 100644
index 000000000..10d3cb289
--- /dev/null
+++ b/nix/winscp.nix
@@ -0,0 +1,28 @@
+pkgs:
+
+pkgs.stdenv.mkDerivation rec {
+  pname = "winscp";
+  version = "5.19.6";
+
+  src = pkgs.fetchzip {
+    url = "https://winscp.net/download/WinSCP-${version}-Portable.zip";
+    sha256 = "sha256-8+6JuT0b1fFQ6etaFTMSjIKvDGzmJoHAuByXiqCBzu0=";
+    stripRoot = false;
+  };
+
+  buildPhase = ''
+    cat > winscp <<EOF
+#!${pkgs.bash}/bin/bash
+
+WINEDEBUG=-all
+${pkgs.winePackages.minimal}/bin/wine $out/opt/WinSCP.com
+EOF
+  '';
+
+  installPhase = ''
+    mkdir -p $out/{bin,opt}
+    cp {WinSCP.com,WinSCP.exe} $out/opt
+    cp winscp $out/bin
+    chmod +x $out/bin/winscp
+  '';
+}
diff --git a/script/dev-env-winscp.sh b/script/dev-env-winscp.sh
new file mode 100644
index 000000000..678da5103
--- /dev/null
+++ b/script/dev-env-winscp.sh
@@ -0,0 +1,4 @@
+export AWS_ACCESS_KEY_ID=`cat /tmp/garage.s3 |cut -d' ' -f1`
+export AWS_SECRET_ACCESS_KEY=`cat /tmp/garage.s3 |cut -d' ' -f2`
+export AWS_DEFAULT_REGION='garage'
+export WINSCP_URL="s3://${AWS_ACCESS_KEY_ID}:${AWS_SECRET_ACCESS_KEY}@127.0.0.1:4443 -certificate=* -rawsettings S3DefaultRegion=garage S3UrlStyle=1"
diff --git a/script/test-smoke.sh b/script/test-smoke.sh
index 4483f65b4..c992803ed 100755
--- a/script/test-smoke.sh
+++ b/script/test-smoke.sh
@@ -116,6 +116,31 @@ if [ -z "$SKIP_DUCK" ]; then
   done
 fi
 
+if [ -z "$SKIP_WINSCP" ]; then
+  echo "🛠️ Testing with winscp"
+  source ${SCRIPT_FOLDER}/dev-env-winscp.sh
+  winscp <<EOF
+open $WINSCP_URL
+ls
+mkdir eprouvette/winscp
+EOF
+  for idx in {1..3}.{rnd,b64}; do
+    winscp <<EOF
+open $WINSCP_URL
+put Z:\\tmp\\garage.$idx eprouvette/winscp/garage.$idx.winscp
+ls eprouvette/winscp/
+get eprouvette/winscp/garage.$idx.winscp Z:\\tmp\\garage.$idx.dl
+rm eprouvette/winscp/garage.$idx.winscp
+EOF
+    diff /tmp/garage.$idx /tmp/garage.$idx.dl
+    rm /tmp/garage.$idx.dl
+  done
+  winscp <<EOF
+open $WINSCP_URL
+rm eprouvette/winscp
+EOF
+fi
+
 # Advanced testing via S3API
 if [ -z "$SKIP_AWS" ]; then
   echo "🔌 Test S3API"
diff --git a/shell.nix b/shell.nix
index 48c76e37a..25ab85580 100644
--- a/shell.nix
+++ b/shell.nix
@@ -13,6 +13,7 @@ let
     overlays = [ cargo2nixOverlay ];
   };
   kaniko = (import ./nix/kaniko.nix) pkgs;
+  winscp = (import ./nix/winscp.nix) pkgs;
 
 in
 
@@ -79,7 +80,8 @@ function refresh_toolchain {
      cargo2nix.packages.x86_64-linux.cargo2nix
     ] else [])
    ++
-   (if integration then [ 
+   (if integration then [
+     winscp
      pkgs.s3cmd
      pkgs.awscli2
      pkgs.minio-client