diff --git a/README.md b/README.md
index 8e8ce1c9fc3a2..56e256d08184f 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,8 @@ of what it's like to use one of these C++ libraries.
 
 ```cc
 #include "google/cloud/storage/client.h"
+#include "google/cloud/common_options.h"
+#include <cstdlib>
 #include <iostream>
 #include <string>
 
@@ -41,7 +43,17 @@ int main(int argc, char* argv[]) {
 
   // Create a client to communicate with Google Cloud Storage. This client
   // uses the default configuration for authentication and project id.
-  auto client = google::cloud::storage::Client();
+  auto options = google::cloud::Options{};
+
+  // If the CURL_CA_BUNDLE environment variable is set, configure the client
+  // to use it. This is required for the Windows CI environment where standard
+  // system roots may not be sufficient or accessible by the hermetic build.
+  auto const* ca_bundle = std::getenv("CURL_CA_BUNDLE");
+  if (ca_bundle != nullptr) {
+    options.set<google::cloud::CARootsFilePathOption>(ca_bundle);
+  }
+
+  auto client = google::cloud::storage::Client(options);
 
   auto writer = client.WriteObject(bucket_name, "quickstart.txt");
   writer << "Hello World!";
diff --git a/ci/kokoro/windows/builds/bazel.ps1 b/ci/kokoro/windows/builds/bazel.ps1
index 1bf16b73d0027..b468d8d185ff8 100644
--- a/ci/kokoro/windows/builds/bazel.ps1
+++ b/ci/kokoro/windows/builds/bazel.ps1
@@ -40,14 +40,19 @@ $test_flags = $build_flags
 $test_flags += @("--test_output=errors", "--verbose_failures=true")
 
 Write-Host "`n$(Get-Date -Format o) Compiling and running unit tests"
-bazelisk $common_flags test $test_flags --test_tag_filters=-integration-test ...
+# See #15678
+$exclude_build_targets = @("-//google/cloud/bigtable:internal_query_plan_test", `
+    "-//google/cloud/storage/tests:storage_include_test-default", `
+    "-//google/cloud/storage/tests:storage_include_test-grpc-metadata", `
+    "-//google/cloud/pubsub/samples:all")
+bazelisk $common_flags test $test_flags --test_tag_filters=-integration-test ... -- $exclude_build_targets
 if ($LastExitCode) {
     Write-Host -ForegroundColor Red "bazel test failed with exit code ${LastExitCode}."
     Exit ${LastExitCode}
 }
 
 Write-Host "`n$(Get-Date -Format o) Compiling extra programs with bazel $common_flags build $build_flags ..."
-bazelisk $common_flags build $build_flags ...
+bazelisk $common_flags build $build_flags ... -- $exclude_build_targets
 if ($LastExitCode) {
     Write-Host -ForegroundColor Red "bazel build failed with exit code ${LastExitCode}."
     Exit ${LastExitCode}
@@ -80,6 +85,7 @@ if (Test-Integration-Enabled) {
     Write-Host "`n$(Get-Date -Format o) Running minimal quickstart prorams"
     Install-Roots-Pem
     ${env:GRPC_DEFAULT_SSL_ROOTS_FILE_PATH}="${env:KOKORO_GFILE_DIR}/roots.pem"
+    ${env:CURL_CA_BUNDLE}="${env:KOKORO_GFILE_DIR}/roots.pem"
     ${env:GOOGLE_APPLICATION_CREDENTIALS}="${env:KOKORO_GFILE_DIR}/kokoro-run-key.json"
     Invoke-REST-Quickstart
     Invoke-gRPC-Quickstart
diff --git a/google/cloud/storage/README.md b/google/cloud/storage/README.md
index 015c42f7fd0dc..c6103d5385776 100644
--- a/google/cloud/storage/README.md
+++ b/google/cloud/storage/README.md
@@ -22,6 +22,8 @@ this library.
 
 ```cc
 #include "google/cloud/storage/client.h"
+#include "google/cloud/common_options.h"
+#include <cstdlib>
 #include <iostream>
 #include <string>
 
@@ -35,7 +37,17 @@ int main(int argc, char* argv[]) {
 
   // Create a client to communicate with Google Cloud Storage. This client
   // uses the default configuration for authentication and project id.
-  auto client = google::cloud::storage::Client();
+  auto options = google::cloud::Options{};
+
+  // If the CURL_CA_BUNDLE environment variable is set, configure the client
+  // to use it. This is required for the Windows CI environment where standard
+  // system roots may not be sufficient or accessible by the hermetic build.
+  auto const* ca_bundle = std::getenv("CURL_CA_BUNDLE");
+  if (ca_bundle != nullptr) {
+    options.set<google::cloud::CARootsFilePathOption>(ca_bundle);
+  }
+
+  auto client = google::cloud::storage::Client(options);
 
   auto writer = client.WriteObject(bucket_name, "quickstart.txt");
   writer << "Hello World!";
diff --git a/google/cloud/storage/quickstart/quickstart.cc b/google/cloud/storage/quickstart/quickstart.cc
index 7431229ce5623..0faff90d343f3 100644
--- a/google/cloud/storage/quickstart/quickstart.cc
+++ b/google/cloud/storage/quickstart/quickstart.cc
@@ -14,6 +14,8 @@
 
 //! [all]
 #include "google/cloud/storage/client.h"
+#include "google/cloud/common_options.h"
+#include <cstdlib>
 #include <iostream>
 #include <string>
 
@@ -27,7 +29,17 @@ int main(int argc, char* argv[]) {
 
   // Create a client to communicate with Google Cloud Storage. This client
   // uses the default configuration for authentication and project id.
-  auto client = google::cloud::storage::Client();
+  auto options = google::cloud::Options{};
+
+  // If the CURL_CA_BUNDLE environment variable is set, configure the client
+  // to use it. This is required for the Windows CI environment where standard
+  // system roots may not be sufficient or accessible by the hermetic build.
+  auto const* ca_bundle = std::getenv("CURL_CA_BUNDLE");
+  if (ca_bundle != nullptr) {
+    options.set<google::cloud::CARootsFilePathOption>(ca_bundle);
+  }
+
+  auto client = google::cloud::storage::Client(options);
 
   auto writer = client.WriteObject(bucket_name, "quickstart.txt");
   writer << "Hello World!";