diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 3a5f75a..85efdcd 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -239,9 +239,9 @@ Planned dependencies (to be added as each part is implemented):
 | System service | `/etc/lost/lost.toml` | `/var/lib/lost/.lost/` (`lost.service` sets `HOME=/var/lib/lost`) |
 | User (Linux, BSD) | `~/.lost/lost.toml` | `~/.lost/` |
 | User (macOS) | `~/Library/Application Support/LOST/lost.toml` | `~/Library/Application Support/LOST/` |
-| User (Windows) | `%USERPROFILE%\LOST\lost.toml` | `%USERPROFILE%\LOST\` |
+| User (Windows) | `%LOCALAPPDATA%\LOST\lost.toml` | `%LOCALAPPDATA%\LOST\` |
 
-One folder per user holds both config and data. It's created readable by its owner only, since it also holds the signing key (§9.2).
+One folder per user holds both config and data. It's created readable by its owner only, since it also holds the signing key (§9.2). On Windows it's in `AppData\Local` (`C:\Users\NAME\AppData\Local\LOST\`), as Bitcoin Core's is since 28.0: unlike `AppData\Roaming`, it's never copied to a server by roaming profiles, which matters for a big database and for a key that shouldn't leave the computer.
 
 Configuration precedence: command-line flag → the user's `lost.toml` → `/etc/lost/lost.toml` → built-in default.
 
diff --git a/README.md b/README.md
index 4f4f7f2..3aaa69b 100644
--- a/README.md
+++ b/README.md
@@ -124,7 +124,7 @@ It obeys robots.txt, asks each server for one thing a second (`--delay`), and sa
 ### Database
 
 The local database is stored by default either in `~/.lost/` (Linux, BSD), `~/Library/Application Support/LOST/` (macOS),
-or `%USERPROFILE%\LOST\` (Windows).
+or `%LOCALAPPDATA%\LOST\` (Windows, i.e. `C:\Users\NAME\AppData\Local\LOST\`).
 
 
 ## Building
diff --git a/dist/lost.toml b/dist/lost.toml
index eede557..84be108 100644
--- a/dist/lost.toml
+++ b/dist/lost.toml
@@ -1,6 +1,6 @@
 # LOST configuration.
 # System-wide: /etc/lost/lost.toml. Per user: ~/.lost/lost.toml (Linux/BSD),
-# ~/Library/Application Support/LOST/lost.toml (macOS), %USERPROFILE%\LOST\lost.toml (Windows).
+# ~/Library/Application Support/LOST/lost.toml (macOS), %LOCALAPPDATA%\LOST\lost.toml (Windows).
 # Every key is optional; command-line flags override this file.
 
 [server]
diff --git a/src/config.rs b/src/config.rs
index b2c089a..989e767 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -114,10 +114,14 @@ impl Default for GuiConfig {
 
 /// The per-user folder that holds both config and data:
 /// `~/.lost` (Linux, BSD), `~/Library/Application Support/LOST` (macOS),
-/// `%USERPROFILE%\LOST` (Windows).
+/// `%LOCALAPPDATA%\LOST` (Windows: `AppData\Local`, which roaming
+/// profiles never copy to a server, unlike `AppData\Roaming`; the database
+/// can be big, and the signing key shouldn't leave the computer).
 pub fn user_dir() -> Option<PathBuf> {
     if cfg!(windows) {
-        std::env::var_os("USERPROFILE").map(|home| PathBuf::from(home).join("LOST"))
+        std::env::var_os("LOCALAPPDATA")
+            .filter(|dir| !dir.is_empty())
+            .map(|dir| PathBuf::from(dir).join("LOST"))
     } else {
         let home = PathBuf::from(std::env::var_os("HOME").filter(|h| !h.is_empty())?);
         if cfg!(target_os = "macos") {