diff --git a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/connection/CredentialsServiceTest.java b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/connection/CredentialsServiceTest.java
index e8dc7a4f87..7b7c41817e 100644
--- a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/connection/CredentialsServiceTest.java
+++ b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/connection/CredentialsServiceTest.java
@@ -25,8 +25,9 @@
 import com.google.auth.oauth2.ServiceAccountCredentials;
 import com.google.cloud.spanner.ErrorCode;
 import com.google.cloud.spanner.SpannerException;
-import java.io.FileInputStream;
+import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
@@ -35,9 +36,9 @@
 @RunWith(JUnit4.class)
 public class CredentialsServiceTest {
   private static final String FILE_TEST_PATH =
-      CredentialsServiceTest.class.getResource("test-key.json").getFile();
-  private static final String APP_DEFAULT_FILE_TEST_PATH =
-      CredentialsServiceTest.class.getResource("test-key-app-default.json").getFile();
+      CredentialsServiceTest.class.getResource("test-key.json").getPath();
+  private static final String SA_APP_DEFAULT_FILE_TEST_PATH =
+      CredentialsServiceTest.class.getResource("test-key-app-default.json").getPath();
 
   private static final String TEST_PROJECT_ID = "test-project";
   private static final String APP_DEFAULT_PROJECT_ID = "app-default-test-project";
@@ -49,7 +50,11 @@ public class CredentialsServiceTest {
         GoogleCredentials internalGetApplicationDefault() throws IOException {
           // Read application default credentials directly from a specific file instead of actually
           // fetching the default from the environment.
-          return GoogleCredentials.fromStream(new FileInputStream(APP_DEFAULT_FILE_TEST_PATH));
+          return ServiceAccountCredentials.fromStream(
+              // Calling `getResource().getPath()` on Windows returns a string that might start with
+              // something like `/C:/...`. Paths.get() interprets the leading / as part of the path
+              // and would be invalid. Use `new File().toPath()` to read from these files.
+              Files.newInputStream(new File(SA_APP_DEFAULT_FILE_TEST_PATH).toPath()));
         }
       };
 
diff --git a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java
index 09e03cbca0..0a0e53a887 100644
--- a/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java
+++ b/google-cloud-spanner/src/test/java/com/google/cloud/spanner/it/ITVPCNegativeTest.java
@@ -48,7 +48,6 @@
 import com.google.common.base.Strings;
 import com.google.longrunning.OperationsClient;
 import com.google.longrunning.OperationsSettings;
-import java.io.FileInputStream;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -352,9 +351,7 @@ public void deniedListBackupOperations() throws IOException {
                 .setTransportChannelProvider(InstantiatingGrpcChannelProvider.newBuilder().build())
                 .setEndpoint("spanner.googleapis.com:443")
                 .setCredentialsProvider(
-                    FixedCredentialsProvider.create(
-                        GoogleCredentials.fromStream(
-                            new FileInputStream(System.getenv("GOOGLE_APPLICATION_CREDENTIALS")))))
+                    FixedCredentialsProvider.create(GoogleCredentials.getApplicationDefault()))
                 .build())) {
       client.listOperations(backupId.getName() + "/operations", "");
       fail("Expected PermissionDeniedException");