diff --git a/source/cmake/kafka.cmake b/source/cmake/kafka.cmake
index a4653168..c627b83c 100644
--- a/source/cmake/kafka.cmake
+++ b/source/cmake/kafka.cmake
@@ -9,37 +9,46 @@ include(FindPkgConfig)
 
 # Check for libsasl2 (required for SASL authentication)
 set(FLB_SASL_ENABLED OFF)
-if(PkgConfig_FOUND)
-  pkg_check_modules(SASL libsasl2)
-  if(SASL_FOUND)
-    message(STATUS "Found libsasl2: ${SASL_VERSION}")
-    set(FLB_SASL_ENABLED ON)
+if( FLB_SYSTEM_WINDOWS )
+  # On Windows, we only need TLS support to enable SASL support in librdkafka
+  if( NOT FLB_TLS )
+    message(WARNING "TLS support is required to enable SASL on Windows")
   endif()
+  set(FLB_SASL_OAUTHBEARER_ENABLED ${FLB_TLS})
+  # Note we do not want to configure FLB_SASL_ENABLED on Windows as this then requires the library to link with
 else()
-  message(WARNING "pkg-config not available - trying fallback SASL detection")
-endif()
-
-# Fallback when pkgconfig is not available or not working properly (centos 6)
-if(NOT FLB_SASL_ENABLED)
-  find_library(SASL2_LIB NAMES sasl2)
-  find_path(SASL2_INCLUDE NAMES sasl/sasl.h)
-  if(SASL2_LIB AND SASL2_INCLUDE)
-    set(FLB_SASL_ENABLED ON)
-    message(STATUS "Found libsasl2 via fallback: ${SASL2_LIB}")
+  if(PkgConfig_FOUND)
+    pkg_check_modules(SASL libsasl2)
+    if(SASL_FOUND)
+      message(STATUS "Found libsasl2: ${SASL_VERSION}")
+      set(FLB_SASL_ENABLED ON)
+    endif()
   else()
-    message(WARNING "libsasl2 not found - SASL authentication will be disabled")
+    message(WARNING "pkg-config not available - trying fallback SASL detection")
   endif()
+
+  # Fallback when pkgconfig is not available or not working properly (centos 6)
+  if(NOT FLB_SASL_ENABLED)
+    find_library(SASL2_LIB NAMES sasl2)
+    find_path(SASL2_INCLUDE NAMES sasl/sasl.h)
+    if(SASL2_LIB AND SASL2_INCLUDE)
+      set(FLB_SASL_ENABLED ON)
+      message(STATUS "Found libsasl2 via fallback: ${SASL2_LIB}")
+    else()
+      message(WARNING "libsasl2 not found - SASL authentication will be disabled")
+    endif()
+  endif()
+  # OAuth Bearer is built into librdkafka when SASL is available
+  set(FLB_SASL_OAUTHBEARER_ENABLED ${FLB_SASL_ENABLED})
 endif()
 
-# OAuth Bearer is built into librdkafka when SASL is available
-set(FLB_SASL_OAUTHBEARER_ENABLED ${FLB_SASL_ENABLED})
 
 # MSK IAM requires OAuth Bearer support
 set(FLB_KAFKA_MSK_IAM_ENABLED ${FLB_SASL_OAUTHBEARER_ENABLED})
 
 # Configure librdkafka options
 FLB_OPTION(WITH_SASL ${FLB_SASL_ENABLED})
-FLB_OPTION(WITH_SSL On)
+FLB_OPTION(WITH_SSL ${FLB_TLS})
 FLB_OPTION(WITH_SASL_OAUTHBEARER ${FLB_SASL_OAUTHBEARER_ENABLED})
 FLB_OPTION(WITH_SASL_CYRUS ${FLB_SASL_ENABLED})
 
@@ -47,15 +56,15 @@ FLB_OPTION(WITH_SASL_CYRUS ${FLB_SASL_ENABLED})
 if(FLB_SASL_ENABLED)
   FLB_DEFINITION(FLB_HAVE_KAFKA_SASL)
   message(STATUS "Kafka SASL authentication: ENABLED")
-else()
-  message(STATUS "Kafka SASL authentication: DISABLED")
+elseif(NOT FLB_SYSTEM_WINDOWS)
+  message(FATAL_ERROR "Kafka SASL authentication: DISABLED")
 endif()
 
 if(FLB_SASL_OAUTHBEARER_ENABLED)
   FLB_DEFINITION(FLB_HAVE_KAFKA_OAUTHBEARER)
   message(STATUS "Kafka OAuth Bearer: ENABLED")
 else()
-  message(STATUS "Kafka OAuth Bearer: DISABLED")
+  message(FATAL_ERROR "Kafka OAuth Bearer: DISABLED")
 endif()
 
 # Disable Curl on macOS (if needed)