diff --git a/.buildkite/windows.rayci.yml b/.buildkite/windows.rayci.yml
index d6621a220db3..c270a9486a8d 100644
--- a/.buildkite/windows.rayci.yml
+++ b/.buildkite/windows.rayci.yml
@@ -39,6 +39,15 @@ steps:
     job_env: WINDOWS
     instance_type: windows
     commands:
+      # RELEASE-BUILD OVERRIDE (DO NOT MERGE): stamp the wheels with the real 2.56.0
+      # release commit, even though this branch's HEAD carries the windowsbuild fix.
+      # build-wheel-windows.sh reads BUILDKITE_COMMIT for ray.__commit__; the env is
+      # forwarded into the container via _DOCKER_ENV. Drop these lines for the clean PR.
+      # BUILDKITE_BRANCH routes the broker upload (copy_files.py key is
+      # {BUILDKITE_BRANCH}/{BUILDKITE_COMMIT}/{fn}) to the release prefix the PyPI
+      # upload reads from, so no post-hoc S3 copy is needed.
+      - export BUILDKITE_COMMIT=637fd062205393b9e1929996bfe1d49bd3f8469d
+      - export BUILDKITE_BRANCH=releases/2.56.0
       - bash ci/ray_ci/windows/install_tools.sh
       - bazel run //ci/ray_ci:build_in_docker_windows -- wheel --python-version {{matrix}} --operating-system windows --upload
     matrix:
diff --git a/ci/ray_ci/windows/build_base.sh b/ci/ray_ci/windows/build_base.sh
index 2398179d5c83..080cfc179dce 100644
--- a/ci/ray_ci/windows/build_base.sh
+++ b/ci/ray_ci/windows/build_base.sh
@@ -16,9 +16,9 @@ conda init
 # Conda 26.3.1 crashes on Windows when it tries to clean up a locked exe during
 # a build-variant swap. Preventing self-update avoids that code path.
 conda config --set auto_update_conda false
-conda install -q -y python="${PYTHON_FULL_VERSION}" requests=2.32.3
+conda install -q -y python="${PYTHON_FULL_VERSION}" requests=2.32.3 pyopenssl=23.2.0
 # Force CA trust stack to the newest versions available at build time.
-conda update -c conda-forge -q -y ca-certificates certifi
+conda update --freeze-installed -c conda-forge -q -y ca-certificates certifi
 
 # Install torch first, as some dependencies (e.g. torch-spline-conv) need torch to be
 # installed for their own install.