diff --git a/etc/taskcluster/decisionlib.py b/etc/taskcluster/decisionlib.py
index f23248a4b79..82090bd75a8 100644
--- a/etc/taskcluster/decisionlib.py
+++ b/etc/taskcluster/decisionlib.py
@@ -431,14 +431,15 @@ class WindowsGenericWorkerTask(GenericWorkerTask):
             cd repo
         """
         if sparse_checkout:
+            self.with_mounts({
+                "file": "sparse-checkout",
+                "content": {"raw": "\n".join(sparse_checkout)},
+            })
             git += """
                 git config core.sparsecheckout true
-                echo %SPARSE_CHECKOUT_BASE64% > .git\\info\\sparse.b64
-                certutil -decode .git\\info\\sparse.b64 .git\\info\\sparse-checkout
+                copy ..\\sparse-checkout .git\\info\\sparse-checkout
                 type .git\\info\\sparse-checkout
             """
-            self.env["SPARSE_CHECKOUT_BASE64"] = base64.b64encode(
-                "\n".join(sparse_checkout).encode("utf-8"))
         git += """
             git fetch --depth 1 %GIT_URL% %GIT_REF%
             git reset --hard %GIT_SHA%
diff --git a/etc/taskcluster/packet.net/tc.py b/etc/taskcluster/packet.net/tc.py
index e9cddd10e6e..355ec4a1a33 100644
--- a/etc/taskcluster/packet.net/tc.py
+++ b/etc/taskcluster/packet.net/tc.py
@@ -22,8 +22,8 @@ def check():
 
 
 def livelog():
-    win2016 = api("awsProvisioner", "workerType", "servo-win2016")
-    files = win2016["secrets"]["files"]
+    win2016 = secret("worker-type:aws-provisioner-v1/servo-win2016")
+    files = win2016["files"]
     assert all(f["encoding"] == "base64" for f in files)
     files = {f.get("description"): f["content"] for f in files}
     cert = files["SSL certificate for livelog"]
@@ -33,7 +33,7 @@ def livelog():
         "livelog_key_base64": key,
         "livelog_cert": base64.b64decode(cert),
         "livelog_key": base64.b64decode(key),
-        "livelog_secret": win2016["secrets"]["generic-worker"]["config"]["livelogSecret"],
+        "livelog_secret": win2016["config"]["livelogSecret"],
     }
 
 
diff --git a/etc/taskcluster/windows/first-boot.ps1 b/etc/taskcluster/windows/first-boot.ps1
index db72fee468f..ce9d0f3712e 100644
--- a/etc/taskcluster/windows/first-boot.ps1
+++ b/etc/taskcluster/windows/first-boot.ps1
@@ -36,7 +36,7 @@ New-NetFirewallRule -DisplayName "Allow livelog GET requests" `
 # Install generic-worker and dependencies
 md C:\generic-worker
 $client.DownloadFile("https://github.com/taskcluster/generic-worker/releases/download" +
-    "/v10.11.3/generic-worker-windows-amd64.exe", "C:\generic-worker\generic-worker.exe")
+    "/v13.0.2/generic-worker-windows-amd64.exe", "C:\generic-worker\generic-worker.exe")
 $client.DownloadFile("https://github.com/taskcluster/livelog/releases/download" +
     "/v1.1.0/livelog-windows-amd64.exe", "C:\generic-worker\livelog.exe")
 Expand-ZIPFile -File "C:\nssm-2.24.zip" -Destination "C:\" `
@@ -44,10 +44,16 @@ Expand-ZIPFile -File "C:\nssm-2.24.zip" -Destination "C:\" `
 Start-Process C:\generic-worker\generic-worker.exe -ArgumentList `
     "new-openpgp-keypair --file C:\generic-worker\generic-worker-gpg-signing-key.key" `
     -Wait -NoNewWindow -PassThru `
-    -RedirectStandardOutput C:\generic-worker\generate-signing-key.log `
-    -RedirectStandardError C:\generic-worker\generate-signing-key.err
+    -RedirectStandardOutput C:\generic-worker\generate-gpg-signing-key.log `
+    -RedirectStandardError C:\generic-worker\generate-gpg-signing-key.err
+Start-Process C:\generic-worker\generic-worker.exe -ArgumentList `
+    "new-ed25519-keypair --file C:\generic-worker\generic-worker-ed25519-signing-key.key" `
+    -Wait -NoNewWindow -PassThru `
+    -RedirectStandardOutput C:\generic-worker\generate-ed25519-signing-key.log `
+    -RedirectStandardError C:\generic-worker\generate-ed25519-signing-key.err
 Start-Process C:\generic-worker\generic-worker.exe -ArgumentList (
         "install service --nssm C:\nssm-2.24\win64\nssm.exe " +
+        "--configure-for-aws " +
         "--config C:\generic-worker\generic-worker.config"
     ) -Wait -NoNewWindow -PassThru `
     -RedirectStandardOutput C:\generic-worker\install.log `