diff --git a/wgengine/netstack/netstack.go b/wgengine/netstack/netstack.go
index 21e330aff..90eeed0ec 100644
--- a/wgengine/netstack/netstack.go
+++ b/wgengine/netstack/netstack.go
@@ -184,6 +184,17 @@ func Create(logf logger.Logf, tundev *tstun.Wrapper, e wgengine.Engine, mc *magi
 	if tcpipErr != nil {
 		return nil, fmt.Errorf("could not enable TCP SACK: %v", tcpipErr)
 	}
+	if runtime.GOOS == "windows" {
+		// See https://github.com/tailscale/tailscale/issues/9707
+		// Windows w/RACK performs poorly. ACKs do not appear to be handled in a
+		// timely manner, leading to spurious retransmissions and a reduced
+		// congestion window.
+		tcpRecoveryOpt := tcpip.TCPRecovery(0)
+		tcpipErr = ipstack.SetTransportProtocolOption(tcp.ProtocolNumber, &tcpRecoveryOpt)
+		if tcpipErr != nil {
+			return nil, fmt.Errorf("could not disable TCP RACK: %v", tcpipErr)
+		}
+	}
 	linkEP := channel.New(512, uint32(tstun.DefaultTUNMTU()), "")
 	if tcpipProblem := ipstack.CreateNIC(nicID, linkEP); tcpipProblem != nil {
 		return nil, fmt.Errorf("could not create netstack NIC: %v", tcpipProblem)