diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18234744bd..a8735dae80 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -92,6 +92,7 @@ END_UNRELEASED_TEMPLATE
   fixing missing transitive dependencies when extras contain hyphens
   (e.g., `sqlalchemy[postgresql-psycopg2binary]`).
   ([#3587](https://github.com/bazel-contrib/rules_python/issues/3587))
+* (binaries/tests) Stamped build data generated by Windows actions is readable
 
 {#v0-0-0-added}
 ### Added
diff --git a/python/private/build_data_writer.ps1 b/python/private/build_data_writer.ps1
index db7a48e676..846399f194 100644
--- a/python/private/build_data_writer.ps1
+++ b/python/private/build_data_writer.ps1
@@ -1,17 +1,29 @@
 $OutputPath = $env:OUTPUT
-
-Add-Content -Path $OutputPath -Value "TARGET $env:TARGET"
-Add-Content -Path $OutputPath -Value "CONFIG_MODE $env:CONFIG_MODE"
-Add-Content -Path $OutputPath -Value "STAMPED $env:STAMPED"
+$Lines = @(
+    "TARGET $env:TARGET",
+    "CONFIG_MODE $env:CONFIG_MODE",
+    "STAMPED $env:STAMPED"
+)
 
 $VersionFilePath = $env:VERSION_FILE
-if (-not [string]::IsNullOrEmpty($VersionFilePath)) {
-    Get-Content -Path $VersionFilePath | Add-Content -Path $OutputPath
+if (-not [string]::IsNullOrEmpty($VersionFilePath) -and (Test-Path $VersionFilePath)) {
+    $Lines += Get-Content -Path $VersionFilePath
 }
 
 $InfoFilePath = $env:INFO_FILE
-if (-not [string]::IsNullOrEmpty($InfoFilePath)) {
-    Get-Content -Path $InfoFilePath | Add-Content -Path $OutputPath
+if (-not [string]::IsNullOrEmpty($InfoFilePath) -and (Test-Path $InfoFilePath)) {
+    $Lines += Get-Content -Path $InfoFilePath
 }
 
+# Use .NET to write file to avoid PowerShell encoding/locking quirks
+# We use UTF8 without BOM for compatibility with how the bash script writes (and
+# what consumers expect).
+$Utf8NoBom = New-Object System.Text.UTF8Encoding $False
+[System.IO.File]::WriteAllLines($OutputPath, $Lines, $Utf8NoBom)
+
+$Acl = Get-Acl $OutputPath
+$AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule("Everyone", "Read", "Allow")
+$Acl.SetAccessRule($AccessRule)
+Set-Acl $OutputPath $Acl
+
 exit 0