diff --git a/crates/sign/src/windows.rs b/crates/sign/src/windows.rs
index 3974aff8ca..b63d49cd05 100644
--- a/crates/sign/src/windows.rs
+++ b/crates/sign/src/windows.rs
@@ -200,6 +200,7 @@ const NTE_NOT_FOUND: u32 = 0x8009_0011;
 const NTE_BAD_PROVIDER: u32 = 0x8009_0013;
 const NTE_BAD_PROV_TYPE: u32 = 0x8009_0014;
 const NTE_BAD_KEYSET: u32 = 0x8009_0016;
+const NTE_PROVIDER_DLL_FAIL: u32 = 0x8009_001D;
 const NTE_PROV_DLL_NOT_FOUND: u32 = 0x8009_001E;
 const NTE_SILENT_CONTEXT: u32 = 0x8009_0022;
 const NTE_NOT_SUPPORTED: u32 = 0x8009_0029;
@@ -218,6 +219,11 @@ fn describe(e: &CngError) -> String {
         NTE_BAD_PROVIDER | NTE_BAD_PROV_TYPE | NTE_PROV_DLL_NOT_FOUND => {
             "its key provider isn't available to CNG (a legacy CryptoAPI-only provider, or its driver isn't installed)"
         }
+        // #2207: a smart card or token's middleware that is missing or broken, or a provider
+        // that exists only as 32-bit code, which a 64-bit process can't load.
+        NTE_PROVIDER_DLL_FAIL => {
+            "its key provider's software failed to load (a smart card or token driver that is missing or broken, or a 32-bit-only provider)"
+        }
         NTE_NOT_SUPPORTED => "its key provider doesn't support the operation",
         NTE_DEVICE_NOT_READY | NTE_DEVICE_NOT_FOUND => "the smart card or token isn't available",
         NTE_USER_CANCELLED => "the request was cancelled",
@@ -240,6 +246,11 @@ mod tests {
             "the key is missing from its key store (deleted, or imported under another Windows account) (Windows error 0x80090016)"
         );
         assert_eq!(describe(&CngError::WindowsError(0x8010_000C)), "the smart card isn't available (Windows error 0x8010000C)");
+        assert_eq!(
+            describe(&CngError::WindowsError(0x8009_001D)),
+            "its key provider's software failed to load (a smart card or token driver that is missing or broken, or a 32-bit-only provider) (Windows error 0x8009001D)",
+            "#2207"
+        );
         assert_eq!(describe(&CngError::WindowsError(0x57)), "Windows error 0x00000057");
         assert_eq!(describe(&CngError::InvalidHashLength), "Invalid hash length");
     }