diff --git a/setup.py b/setup.py
index 7088f3b1121..160726f72bb 100644
--- a/setup.py
+++ b/setup.py
@@ -59,7 +59,7 @@ def read_file(filename, encoding='utf8'):
 # However environment markers are supported only with setuptools >= 36.2.
 # So this dependency is not added for old Linux distributions with old setuptools,
 # in order to allow these systems to build certbot from sources.
-pywin32_req = 'pywin32>=225'
+pywin32_req = 'pywin32>=225'  # do not forget to edit pywin32 dependency accordingly in windows-installer/construct.py
 if StrictVersion(setuptools_version) >= StrictVersion('36.2'):
     install_requires.append(pywin32_req + " ; sys_platform == 'win32'")
 elif 'bdist_wheel' in sys.argv[1:]:
diff --git a/windows-installer/construct.py b/windows-installer/construct.py
index 7fd3039f9ea..94ce1fa4d7b 100644
--- a/windows-installer/construct.py
+++ b/windows-installer/construct.py
@@ -1,15 +1,17 @@
 #!/usr/bin/env python3
+import contextlib
 import ctypes
 import struct
 import subprocess
 import os
 import sys
 import shutil
+import tempfile
 import time
 
-
 PYTHON_VERSION = (3, 7, 4)
 PYTHON_BITNESS = 32
+PYWIN32_VERSION = 225  # do not forget to edit pywin32 dependency accordingly in setup.py
 
 
 def main():
@@ -42,9 +44,10 @@ def _compile_wheels(repo_path, build_path, venv_python):
     # certbot_packages.extend([name for name in os.listdir(repo_path) if name.startswith('certbot-dns-')])
     wheels_project = [os.path.join(repo_path, package) for package in certbot_packages]
 
-    command = [venv_python, '-m', 'pip', 'wheel', '-w', wheels_path]
-    command.extend(wheels_project)
-    subprocess.check_call(command)
+    with _prepare_constraints(repo_path) as constraints_file_path:
+        command = [venv_python, '-m', 'pip', 'wheel', '-w', wheels_path, '--constraint', constraints_file_path]
+        command.extend(wheels_project)
+        subprocess.check_call(command)
 
 
 def _prepare_build_tools(venv_path, venv_python, repo_path):
@@ -55,6 +58,23 @@ def _prepare_build_tools(venv_path, venv_python, repo_path):
     subprocess.check_call([venv_python, os.path.join(repo_path, 'tools', 'pip_install.py'), 'wheel', 'pynsist'])
 
 
+@contextlib.contextmanager
+def _prepare_constraints(repo_path):
+    requirements = os.path.join(repo_path, 'letsencrypt-auto-source', 'pieces', 'dependency-requirements.txt')
+    constraints = subprocess.check_output(
+        [sys.executable, os.path.join(repo_path, 'tools', 'strip_hashes.py'), requirements],
+        universal_newlines=True)
+    workdir = tempfile.mkdtemp()
+    try:
+        constraints_file_path = os.path.join(workdir, 'constraints.txt')
+        with open(constraints_file_path, 'a') as file_h:
+            file_h.write(constraints)
+            file_h.write('pywin32=={0}'.format(PYWIN32_VERSION))
+        yield constraints_file_path
+    finally:
+        shutil.rmtree(workdir)
+
+
 def _copy_assets(build_path, repo_path):
     print('Copy assets')
     if os.path.exists(build_path):