diff --git a/cmd/kubectl_token_oauth.go b/cmd/kubectl_token_oauth.go
index 6c5e6d05..2e8c8395 100644
--- a/cmd/kubectl_token_oauth.go
+++ b/cmd/kubectl_token_oauth.go
@@ -199,8 +199,10 @@ func openBrowser(openURL string) error {
 		cmd = "xdg-open"
 		args = []string{openURL}
 	case "windows":
-		cmd = "cmd"
-		args = []string{"/c", "start", "", openURL}
+		// rundll32 handles the URL as a single argument; avoids cmd.exe
+		// interpreting `&` in query strings as a command separator.
+		cmd = "rundll32"
+		args = []string{"url.dll,FileProtocolHandler", openURL}
 	default:
 		return fmt.Errorf("unsupported platform: %s", runtime.GOOS)
 	}