diff --git a/browser/components/resistfingerprinting/test/browser/browser_navigator.js b/browser/components/resistfingerprinting/test/browser/browser_navigator.js
index f5c04f81115a..b1349cb19f99 100644
--- a/browser/components/resistfingerprinting/test/browser/browser_navigator.js
+++ b/browser/components/resistfingerprinting/test/browser/browser_navigator.js
@@ -70,6 +70,10 @@ const SPOOFED_PLATFORM = {
   other: "Linux x86_64",
 };
 
+// If comparison with this value fails in the future,
+// it's time to evaluate if exposing a new Windows
+// version to the Web is appropriate. See
+// https://bugzilla.mozilla.org/show_bug.cgi?id=1693295
 const WindowsOscpu =
   cpuArch == "x86_64"
     ? `Windows NT ${osVersion}; Win64; x64`
diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp
index bf3d9a125f07..350ca6bf3a38 100644
--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -951,6 +951,18 @@ void nsHttpHandler::InitUserAgentComponents() {
   if (GetVersionEx(&info)) {
 #    pragma warning(pop)
 
+    if (info.dwMajorVersion >= 10) {
+      // Cap the reported Windows version to 10.0. This way, Microsoft doesn't
+      // get to change Web compat-sensitive values without our veto. The
+      // compat-sensitivity keeps going up as 10.0 stays as the current value
+      // for longer and longer. If the system-reported version ever changes,
+      // we'll be able to take our time to evaluate the Web compat impact
+      // instead of having to scamble to react like happened with macOS
+      // changing from 10.x to 11.x.
+      info.dwMajorVersion = 10;
+      info.dwMinorVersion = 0;
+    }
+
     const char* format;
 #    if defined _M_X64 || defined _M_AMD64
     format = OSCPU_WIN64;