diff --git a/.travis.yml b/.travis.yml
index 83cf4d8b..5b5b081a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -90,25 +90,25 @@ script:
 
 jobs:
   include:
-    - stage: deploy
-      if: (type in (push, api)) AND (repo = sass/dart-sass) AND (tag =~ ^\d+\.\d+\.\d+([+-].*)?$)
-      env: DART_CHANNEL=dev DART_VERSION=latest
-      script: skip # Don't run tests
+  - stage: deploy
+    if: (type IN (push, api)) AND (repo = sass/dart-sass) AND tag =~ ^\d+\.\d+\.\d+([+-].*)?$
+    env: DART_CHANNEL=dev DART_VERSION=latest
+    script: skip # Don't run tests
 
-      deploy:
-        # Deploy to GitHub, npm, pub, and Homebrew.
-        # TODO: Deploy to Chocolatey as well.
-        provider: script
-        script: tool/deploy.sh
+    deploy:
+      # Deploy to GitHub, npm, pub, and Homebrew.
+      # TODO: Deploy to Chocolatey as well.
+      provider: script
+      script: tool/deploy.sh
 
-        # This causes the deploy to only be build when a tag is pushed. This
-        # is because the `tag` attribute in `if:` statements has a different
-        # understanding of the "current tag" than this, which uses the
-        # `TRAVIS_TAG` environment variable. `if:` statements check whether a
-        # tag exists that refers to the current commit, whereas `TRAVIS_TAG`
-        # checks whether the current build was caused by a tag.
-        #
-        # We check `if:` because it avoids unnecessary build steps, and
-        # `on: {tags: true}` ensures that we only deploy on the build caused
-        # by pushing a tag, not the build caused by pushing master.
-        on: {tags: true}
+      # This causes the deploy to only be build when a tag is pushed. This
+      # is because the `tag` attribute in `if:` statements has a different
+      # understanding of the "current tag" than this, which uses the
+      # `TRAVIS_TAG` environment variable. `if:` statements check whether a
+      # tag exists that refers to the current commit, whereas `TRAVIS_TAG`
+      # checks whether the current build was caused by a tag.
+      #
+      # We check `if:` because it avoids unnecessary build steps, and
+      # `on: {tags: true}` ensures that we only deploy on the build caused
+      # by pushing a tag, not the build caused by pushing master.
+      on: {tags: true}
diff --git a/tool/deploy.sh b/tool/deploy.sh
index d571634b..7b8a2368 100755
--- a/tool/deploy.sh
+++ b/tool/deploy.sh
@@ -10,6 +10,7 @@ mkdir -p ~/.pub-cache
 tar xfO credentials.tar npm > ~/.npmrc
 tar xfO credentials.tar pub > ~/.pub-cache/credentials.json
 tar xfO credentials.tar git > ~/.npmrc
+tar xfO credentials.tar choco > choco
 
 function travis_cmd() {
   echo "\$ $@"
@@ -41,3 +42,7 @@ git config --local user.name "Natalie Weizenbaum"
 git config --local user.email "nweiz@google.com"
 travis_cmd pub run grinder update_homebrew
 travis_fold end homebrew
+
+travis_fold start chocolatey
+travis_cmd pub run grinder update_chocolatey
+travis_fold end chocolatey
diff --git a/tool/encrypted/credentials.tar.enc b/tool/encrypted/credentials.tar.enc
index 5b8b7541..01d8ae6b 100644
Binary files a/tool/encrypted/credentials.tar.enc and b/tool/encrypted/credentials.tar.enc differ
diff --git a/tool/godaddy.pem b/tool/godaddy.pem
new file mode 100644
index 00000000..ead19e3c
--- /dev/null
+++ b/tool/godaddy.pem
@@ -0,0 +1,28 @@
+-----BEGIN CERTIFICATE-----
+MIIE0DCCA7igAwIBAgIBBzANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCVVMx
+EDAOBgNVBAgTB0FyaXpvbmExEzARBgNVBAcTClNjb3R0c2RhbGUxGjAYBgNVBAoT
+EUdvRGFkZHkuY29tLCBJbmMuMTEwLwYDVQQDEyhHbyBEYWRkeSBSb290IENlcnRp
+ZmljYXRlIEF1dGhvcml0eSAtIEcyMB4XDTExMDUwMzA3MDAwMFoXDTMxMDUwMzA3
+MDAwMFowgbQxCzAJBgNVBAYTAlVTMRAwDgYDVQQIEwdBcml6b25hMRMwEQYDVQQH
+EwpTY290dHNkYWxlMRowGAYDVQQKExFHb0RhZGR5LmNvbSwgSW5jLjEtMCsGA1UE
+CxMkaHR0cDovL2NlcnRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkvMTMwMQYDVQQD
+EypHbyBEYWRkeSBTZWN1cmUgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IC0gRzIwggEi
+MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC54MsQ1K92vdSTYuswZLiBCGzD
+BNliF44v/z5lz4/OYuY8UhzaFkVLVat4a2ODYpDOD2lsmcgaFItMzEUz6ojcnqOv
+K/6AYZ15V8TPLvQ/MDxdR/yaFrzDN5ZBUY4RS1T4KL7QjL7wMDge87Am+GZHY23e
+cSZHjzhHU9FGHbTj3ADqRay9vHHZqm8A29vNMDp5T19MR/gd71vCxJ1gO7GyQ5HY
+pDNO6rPWJ0+tJYqlxvTV0KaudAVkV4i1RFXULSo6Pvi4vekyCgKUZMQWOlDxSq7n
+eTOvDCAHf+jfBDnCaQJsY1L6d8EbyHSHyLmTGFBUNUtpTrw700kuH9zB0lL7AgMB
+AAGjggEaMIIBFjAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAdBgNV
+HQ4EFgQUQMK9J47MNIMwojPX+2yz8LQsgM4wHwYDVR0jBBgwFoAUOpqFBxBnKLbv
+9r0FQW4gwZTaD94wNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8v
+b2NzcC5nb2RhZGR5LmNvbS8wNQYDVR0fBC4wLDAqoCigJoYkaHR0cDovL2NybC5n
+b2RhZGR5LmNvbS9nZHJvb3QtZzIuY3JsMEYGA1UdIAQ/MD0wOwYEVR0gADAzMDEG
+CCsGAQUFBwIBFiVodHRwczovL2NlcnRzLmdvZGFkZHkuY29tL3JlcG9zaXRvcnkv
+MA0GCSqGSIb3DQEBCwUAA4IBAQAIfmyTEMg4uJapkEv/oV9PBO9sPpyIBslQj6Zz
+91cxG7685C/b+LrTW+C05+Z5Yg4MotdqY3MxtfWoSKQ7CC2iXZDXtHwlTxFWMMS2
+RJ17LJ3lXubvDGGqv+QqG+6EnriDfcFDzkSnE3ANkR/0yBOtg2DZ2HKocyQetawi
+DsoXiWJYRBuriSUBAA/NxBti21G00w9RKpv0vHP8ds42pM3Z2Czqrpv1KrKQ0U11
+GIo/ikGQI31bS/6kA1ibRrLDYGCD+H1QQc7CoZDDu+8CL9IVVO5EFdkKrqeKM+2x
+LXY2JtwE65/3YR8V3Idv7kaWKK2hJn0KCacuBKONvPi8BDAB
+-----END CERTIFICATE-----
diff --git a/tool/grind.dart b/tool/grind.dart
index a002380a..c2798453 100644
--- a/tool/grind.dart
+++ b/tool/grind.dart
@@ -277,13 +277,50 @@ This package is Dart Sass, the new Dart implementation of Sass.
   return builder.build() as xml.XmlDocument;
 }
 
+@Task('Upload the Chocolatey package to the current version.')
+@Depends(chocolatey_package)
+update_chocolatey() async {
+  // For some reason, although Chrome seems able to access it just fine,
+  // command-line tools don't seem to be able to verify the certificate for
+  // Chocolatey, so we need to manually add the intermediate GoDaddy certificate
+  // to the security context.
+  SecurityContext.defaultContext.setTrustedCertificates("tool/godaddy.pem");
+
+  var request = new http.MultipartRequest(
+      "PUT", Uri.parse("https://push.chocolatey.org/api/v2/package"));
+  request.headers["X-NuGet-Protocol-Version"] = "4.1.0";
+  request.headers["X-NuGet-ApiKey"] =
+      new File("choco").readAsStringSync().trim();
+  request.files.add(await http.MultipartFile
+      .fromPath("package", "build/sass.${_chocolateyVersion()}.nupkg"));
+
+  var response = await request.send();
+  if (response.statusCode ~/ 100 != 2) {
+    fail("${response.statusCode} error creating release:\n"
+        "${await response.stream.bytesToString()}");
+  } else {
+    log("Released Dart Sass ${_chocolateyVersion()} to Chocolatey.");
+    response.stream.listen(null).cancel();
+  }
+}
+
 /// The current Sass version, formatted for Chocolatey which doesn't allow dots
 /// in prerelease versions.
 String _chocolateyVersion() {
   var components = _version.split("-");
   if (components.length == 1) return components.first;
   assert(components.length == 2);
-  return "${components.first}-${components.last.replaceAll('.', '')}";
+
+  var first = true;
+  var prerelease = components.last.replaceAllMapped('.', (_) {
+    if (first) {
+      first = false;
+      return '';
+    } else {
+      return '-';
+    }
+  });
+  return "${components.first}-$prerelease";
 }
 
 /// Returns the contents of the `properties.psmdcp` file, computed from the
@@ -484,7 +521,7 @@ github_release() async {
   if (response.statusCode != 201) {
     fail("${response.statusCode} error creating release:\n${response.body}");
   } else {
-    log("Released Dart Sass $_version.");
+    log("Released Dart Sass $_version to GitHub.");
   }
 
   var uploadUrl = JSON