diff --git a/benchmarks/CMakeLists.txt b/benchmarks/CMakeLists.txt
index 32c6e1925f..6b71cb76f2 100644
--- a/benchmarks/CMakeLists.txt
+++ b/benchmarks/CMakeLists.txt
@@ -62,7 +62,7 @@ endif()
 set(CMAKE_BUILD_TYPE RelWithDebInfo)
 
 # /utf-8 affects <format>.
-add_compile_options("$<$<COMPILE_LANGUAGE:CXX>:/diagnostics:caret;/W4;/WX;/w14265;/w15038;/w15262;/utf-8>")
+add_compile_options("$<$<COMPILE_LANGUAGE:CXX>:/diagnostics:caret;/W4;/WX;/w14265;/w15038;/w15262;/utf-8;/Zc:preprocessor>")
 
 if(NOT EXISTS "${CMAKE_CURRENT_LIST_DIR}/google-benchmark/.git")
     message(FATAL_ERROR "google-benchmark is not checked out; make sure to run\n    git submodule update --init benchmarks/google-benchmark")
diff --git a/stl/CMakeLists.txt b/stl/CMakeLists.txt
index 376f4ef9cd..0cbcb75f1d 100644
--- a/stl/CMakeLists.txt
+++ b/stl/CMakeLists.txt
@@ -421,7 +421,7 @@ add_compile_definitions(_CRTBLD _VCRT_ALLOW_INTERNALS _HAS_OLD_IOSTREAMS_MEMBERS
 set(CMAKE_MSVC_DEBUG_INFORMATION_FORMAT "Embedded")
 
 add_compile_options(/WX /Gy
-    "$<$<COMPILE_LANGUAGE:CXX>:/diagnostics:caret;/W4;/w14265;/w15038;/fastfail;/guard:cf;/Zp8;/std:c++latest;/permissive-;/Zc:threadSafeInit-;/Zl>"
+    "$<$<COMPILE_LANGUAGE:CXX>:/diagnostics:caret;/W4;/w14265;/w15038;/fastfail;/guard:cf;/Zp8;/std:c++latest;/permissive-;/Zc:preprocessor;/Zc:threadSafeInit-;/Zl>"
     "$<$<COMPILE_LANGUAGE:ASM_MASM>:/W3;/nologo;/quiet>"
 )
 
diff --git a/tools/validate/CMakeLists.txt b/tools/validate/CMakeLists.txt
index 2be5cc5fb3..5d2d5f34d7 100644
--- a/tools/validate/CMakeLists.txt
+++ b/tools/validate/CMakeLists.txt
@@ -5,8 +5,7 @@ cmake_minimum_required(VERSION 3.29.0)
 project(msvc_standard_libraries_validate LANGUAGES CXX)
 
 add_executable(validate-binary validate.cpp)
-# we use SAL annotations, so pass /analyze
-target_compile_options(validate-binary PRIVATE /W4 /WX /analyze)
+target_compile_options(validate-binary PRIVATE /W4 /WX /analyze /Zc:preprocessor)
 set_target_properties(validate-binary
     PROPERTIES
         CXX_STANDARD 23
diff --git a/tools/validate/validate.cpp b/tools/validate/validate.cpp
index 37e4dc78e6..0a7936b50a 100644
--- a/tools/validate/validate.cpp
+++ b/tools/validate/validate.cpp
@@ -1,7 +1,6 @@
 // Copyright (c) Microsoft Corporation.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 
-#define _CRT_SECURE_NO_WARNINGS
 #include <algorithm>
 #include <array>
 #include <cassert>
@@ -21,8 +20,10 @@ constexpr size_t max_line_length = 120;
 
 class BinaryFile {
 public:
-    explicit BinaryFile(const filesystem::path& filepath) : m_file(_wfopen(filepath.c_str(), L"rb")) {
-        if (!m_file) {
+    explicit BinaryFile(const filesystem::path& filepath) {
+        const auto err = _wfopen_s(&m_file, filepath.c_str(), L"rb");
+
+        if (err != 0 || !m_file) {
             println(stderr, "Validation failed: {} couldn't be opened.", filepath.string());
         }
     }
@@ -40,7 +41,7 @@ class BinaryFile {
     }
 
     ~BinaryFile() {
-        if (fclose(m_file) != 0) {
+        if (m_file && fclose(m_file) != 0) {
             println(stderr, "fclose() failed.");
             abort();
         }