diff --git a/metropolis/cli/metroctl/BUILD.bazel b/metropolis/cli/metroctl/BUILD.bazel
index 024b96c..6d9f32a 100644
--- a/metropolis/cli/metroctl/BUILD.bazel
+++ b/metropolis/cli/metroctl/BUILD.bazel
@@ -66,7 +66,6 @@
         "@org_golang_google_protobuf//types/known/fieldmaskpb",
         "@org_golang_x_crypto//ssh",
         "@org_golang_x_crypto//ssh/agent",
-        "@org_golang_x_crypto//ssh/terminal",
         "@org_golang_x_net//proxy",
         "@org_golang_x_sync//semaphore",
         "@org_golang_x_term//:term",
diff --git a/metropolis/cli/metroctl/cmd_install_ssh.go b/metropolis/cli/metroctl/cmd_install_ssh.go
index 8c6f6ad..f779f43 100644
--- a/metropolis/cli/metroctl/cmd_install_ssh.go
+++ b/metropolis/cli/metroctl/cmd_install_ssh.go
@@ -17,7 +17,6 @@
 	"github.com/spf13/cobra"
 	xssh "golang.org/x/crypto/ssh"
 	"golang.org/x/crypto/ssh/agent"
-	"golang.org/x/crypto/ssh/terminal"
 	"golang.org/x/term"
 	"google.golang.org/protobuf/proto"
 
@@ -55,11 +54,14 @@
 			log.Println("ssh agent authentication will not be available.")
 		}
 
-		if term.IsTerminal(int(os.Stdin.Fd())) {
+		// On Windows syscall.Stdin is a handle and needs to be cast to an
+		// int for term.
+		stdin := int(syscall.Stdin) // nolint:unconvert
+		if term.IsTerminal(stdin) {
 			authMethods = append(authMethods,
 				xssh.PasswordCallback(func() (string, error) {
 					fmt.Printf("%s@%s's password: ", user, address)
-					b, err := terminal.ReadPassword(syscall.Stdin)
+					b, err := term.ReadPassword(stdin)
 					if err != nil {
 						return "", err
 					}
@@ -75,7 +77,7 @@
 								return nil, err
 							}
 						} else {
-							b, err := terminal.ReadPassword(syscall.Stdin)
+							b, err := term.ReadPassword(stdin)
 							if err != nil {
 								return nil, err
 							}