diff --git a/Changelog.md b/Changelog.md
--- a/Changelog.md
+++ b/Changelog.md
@@ -1,3 +1,8 @@
+## 0.5.2
+
+- add Windows build
+- remove `--user` option
+
 ## 0.5.1
 
 - export `LogLevel` type to make `Config` actually customizable
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -25,8 +25,7 @@
 
 ### Installation
 
-`hprox` should build and work on all unix-like OS with `ghc` support, but it's only
-been tested on Linux and macOS.
+`hprox` should build and work on all unix-like OS with `ghc` support, as well as Windows.
 
 [stack](https://docs.haskellstack.org/en/stable/README/#how-to-install) is recommended to build `hprox`.
 
@@ -70,6 +69,8 @@
 ```sh
 hprox -p 443 -q 8443 -s example.com:fullchain.pem:privkey.pem -a userpass.txt --naive --doh 8.8.8.8
 ```
+
+Then DoH can be accessed at `https://example.com/dns-query`.
 
 ### Known Issue
 
diff --git a/hprox.cabal b/hprox.cabal
--- a/hprox.cabal
+++ b/hprox.cabal
@@ -5,7 +5,7 @@
 -- see: https://github.com/sol/hpack
 
 name:           hprox
-version:        0.5.1
+version:        0.5.2
 synopsis:       a lightweight HTTP proxy server, and more
 description:    Please see the README on GitHub at <https://github.com/bjin/hprox#readme>
 category:       Web
@@ -71,7 +71,6 @@
     , random >=1.2.1
     , tls >=1.5
     , tls-session-manager >=0.0.4
-    , unix >=2.7
     , wai >=3.2.2
     , wai-extra >=3.0
     , warp >=3.2.8
@@ -116,7 +115,6 @@
     , random >=1.2.1
     , tls >=1.5
     , tls-session-manager >=0.0.4
-    , unix >=2.7
     , wai >=3.2.2
     , wai-extra >=3.0
     , warp >=3.2.8
diff --git a/src/Network/HProx.hs b/src/Network/HProx.hs
--- a/src/Network/HProx.hs
+++ b/src/Network/HProx.hs
@@ -30,13 +30,11 @@
 import Network.Wai                 (Application, rawPathInfo)
 import Network.Wai.Handler.Warp
     (InvalidRequest (..), defaultSettings, defaultShouldDisplayException,
-    runSettings, setBeforeMainLoop, setHost, setLogger, setNoParsePath,
-    setOnException, setPort, setServerName)
+    runSettings, setHost, setLogger, setNoParsePath, setOnException, setPort,
+    setServerName)
 import Network.Wai.Handler.WarpTLS
     (OnInsecure (..), WarpTLSException, onInsecure, runTLS, tlsAllowedVersions,
     tlsCiphers, tlsServerHooks, tlsSessionManager, tlsSettings)
-import System.Posix.User
-    (UserEntry (..), getUserEntryForName, setUserID)
 
 import Control.Exception    (Exception (..))
 import GHC.IO.Exception     (IOErrorType (..))
@@ -66,7 +64,6 @@
   { _bind     :: Maybe String
   , _port     :: Int
   , _ssl      :: [(String, CertFile)]
-  , _user     :: Maybe String
   , _auth     :: Maybe FilePath
   , _ws       :: Maybe String
   , _rev      :: Maybe String
@@ -82,7 +79,7 @@
 
 -- | Default value of 'Config', same as running @hprox@ without arguments
 defaultConfig :: Config
-defaultConfig = Config Nothing 3000 [] Nothing Nothing Nothing Nothing Nothing False "hprox" "stdout" INFO
+defaultConfig = Config Nothing 3000 [] Nothing Nothing Nothing Nothing False "hprox" "stdout" INFO
 #ifdef QUIC_ENABLED
     Nothing
 #endif
@@ -115,7 +112,6 @@
     config = Config <$> bind
                     <*> port
                     <*> ssl
-                    <*> user
                     <*> auth
                     <*> ws
                     <*> rev
@@ -148,12 +144,6 @@
        <> metavar "hostname:cerfile:keyfile"
        <> help "enable TLS and specify a domain and associated TLS certificate (can be specified multiple times for multiple domains)")
 
-    user = optional $ strOption
-        ( long "user"
-       <> short 'u'
-       <> metavar "nobody"
-       <> help "setuid after binding port")
-
     auth = optional $ strOption
         ( long "auth"
        <> short 'a'
@@ -207,9 +197,6 @@
        <> help "enable QUIC (HTTP/3) on UDP port")
 #endif
 
-setuid :: String -> IO ()
-setuid user = getUserEntryForName user >>= setUserID . userID
-
 getLoggerType :: String -> LogType' LogStr
 getLoggerType "none"   = LogNone
 getLoggerType "stdout" = LogStdout 4096
@@ -248,7 +235,6 @@
                    setOnException exceptionHandler $
                    setNoParsePath True $
                    setServerName _name $
-                   maybe id (setBeforeMainLoop . setuid) _user
                    defaultSettings
 
         exceptionHandler req ex