diff --git a/users/emmathorpe/work.nix b/users/emmathorpe/work.nix
index 08cb887..4ddb68b 100644
--- a/users/emmathorpe/work.nix
+++ b/users/emmathorpe/work.nix
@@ -47,7 +47,23 @@
     pkgs.terraform-docs # generate Terraform module docs
     pkgs.yq-go # jq for YAML
     pkgs.gcx # Grafana Cloud CLI (dashboards, SLOs, synthetics, alerts)
+
+    # WSL ships no xdg-open, so anything that shells out to a browser dies with
+    # `exec: "xdg-open,x-www-browser,www-browser": executable file not found`.
+    # kubelogin's interactive login is the one that bites: it is the login mode
+    # the shared cluster kubeconfig uses. Hand the URL to Windows instead.
+    # (wslu, the usual answer, is gone from nixpkgs -- upstream archived it.)
+    (pkgs.writeShellScriptBin "xdg-open" ''
+      url="$1"
+      if command -v powershell.exe >/dev/null 2>&1; then
+        exec powershell.exe -NoProfile -Command "Start-Process '$url'"
+      fi
+      exec explorer.exe "$url"
+    '')
   ];
+
+  # Honoured by tools that read $BROWSER rather than calling xdg-open.
+  home.sessionVariables.BROWSER = "xdg-open";
   services.ssh-agent.enable = true;
 
   # Colourised kubectl. enableAlias points `kubectl` at kubecolor, which parses