--- a/browser/components/resistfingerprinting/test/browser/browser_navigator.js
+++ b/browser/components/resistfingerprinting/test/browser/browser_navigator.js
@@ -65,16 +65,20 @@ const DEFAULT_PLATFORM = {
 const SPOOFED_PLATFORM = {
   linux: "Linux x86_64",
   win: "Win32",
   macosx: "MacIntel",
   android: "Linux aarch64",
   other: "Linux x86_64",
 };
 
+// If comparison with this value fails in the future,
+// it's time to evaluate if exposing a new Windows
+// version to the Web is appropriate. See
+// https://bugzilla.mozilla.org/show_bug.cgi?id=1693295
 const WindowsOscpu =
   cpuArch == "x86_64"
     ? `Windows NT ${osVersion}; Win64; x64`
     : `Windows NT ${osVersion}`;
 
 const DEFAULT_OSCPU = {
   linux: `Linux ${cpuArch}`,
   win: WindowsOscpu,

--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -946,16 +946,28 @@ void nsHttpHandler::InitUserAgentCompone
   // Gather OS/CPU.
 #  if defined(XP_WIN)
   OSVERSIONINFO info = {sizeof(OSVERSIONINFO)};
 #    pragma warning(push)
 #    pragma warning(disable : 4996)
   if (GetVersionEx(&info)) {
 #    pragma warning(pop)
 
+    if (info.dwMajorVersion >= 10) {
+      // Cap the reported Windows version to 10.0. This way, Microsoft doesn't
+      // get to change Web compat-sensitive values without our veto. The
+      // compat-sensitivity keeps going up as 10.0 stays as the current value
+      // for longer and longer. If the system-reported version ever changes,
+      // we'll be able to take our time to evaluate the Web compat impact
+      // instead of having to scamble to react like happened with macOS
+      // changing from 10.x to 11.x.
+      info.dwMajorVersion = 10;
+      info.dwMinorVersion = 0;
+    }
+
     const char* format;
 #    if defined _M_X64 || defined _M_AMD64
     format = OSCPU_WIN64;
 #    else
     BOOL isWow64 = FALSE;
     if (!IsWow64Process(GetCurrentProcess(), &isWow64)) {
       isWow64 = FALSE;
     }