diff --git a/vendor.conf b/vendor.conf
index f89028b707..6100ba8d20 100644
--- a/vendor.conf
+++ b/vendor.conf
@@ -1,7 +1,7 @@
 # the following lines are in sorted order, FYI
 github.com/Azure/go-ansiterm 388960b655244e76e24c75f48631564eaefade62
 github.com/Microsoft/hcsshim v0.5.17
-github.com/Microsoft/go-winio v0.4.0
+github.com/Microsoft/go-winio v0.4.1
 github.com/Sirupsen/logrus v0.11.0
 github.com/davecgh/go-spew 346938d642f2ec3594ed81d874461961cd0faa76
 github.com/docker/libtrust 9cbd2a1374f46905c68a4eb3694a130610adc62a
diff --git a/vendor/github.com/Microsoft/go-winio/file.go b/vendor/github.com/Microsoft/go-winio/file.go
index 078a5687b6..613f31b520 100644
--- a/vendor/github.com/Microsoft/go-winio/file.go
+++ b/vendor/github.com/Microsoft/go-winio/file.go
@@ -124,7 +124,8 @@ func (f *win32File) Close() error {
 	return nil
 }
 
-// prepareIo prepares for a new IO operation
+// prepareIo prepares for a new IO operation.
+// The caller must call f.wg.Done() when the IO is finished, prior to Close() returning.
 func (f *win32File) prepareIo() (*ioOperation, error) {
 	f.wg.Add(1)
 	if f.closing {
@@ -155,7 +156,6 @@ func ioCompletionProcessor(h syscall.Handle) {
 // the operation has actually completed.
 func (f *win32File) asyncIo(c *ioOperation, d *deadlineHandler, bytes uint32, err error) (int, error) {
 	if err != syscall.ERROR_IO_PENDING {
-		f.wg.Done()
 		return int(bytes), err
 	}
 
@@ -192,7 +192,6 @@ func (f *win32File) asyncIo(c *ioOperation, d *deadlineHandler, bytes uint32, er
 	// code to ioCompletionProcessor, c must remain alive
 	// until the channel read is complete.
 	runtime.KeepAlive(c)
-	f.wg.Done()
 	return int(r.bytes), err
 }
 
@@ -202,6 +201,7 @@ func (f *win32File) Read(b []byte) (int, error) {
 	if err != nil {
 		return 0, err
 	}
+	defer f.wg.Done()
 
 	if f.readDeadline.timedout.isSet() {
 		return 0, ErrTimeout
@@ -228,6 +228,8 @@ func (f *win32File) Write(b []byte) (int, error) {
 	if err != nil {
 		return 0, err
 	}
+	defer f.wg.Done()
+
 	if f.writeDeadline.timedout.isSet() {
 		return 0, ErrTimeout
 	}
diff --git a/vendor/github.com/Microsoft/go-winio/pipe.go b/vendor/github.com/Microsoft/go-winio/pipe.go
index 0ee2641ffc..fa270a310f 100644
--- a/vendor/github.com/Microsoft/go-winio/pipe.go
+++ b/vendor/github.com/Microsoft/go-winio/pipe.go
@@ -367,6 +367,8 @@ func connectPipe(p *win32File) error {
 	if err != nil {
 		return err
 	}
+	defer p.wg.Done()
+
 	err = connectNamedPipe(p.handle, &c.o)
 	_, err = p.asyncIo(c, nil, 0, err)
 	if err != nil && err != cERROR_PIPE_CONNECTED {