diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1588ad7a..8653a2c8 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -301,6 +301,8 @@ elseif (${CMAKE_SYSTEM_NAME} MATCHES "Windows")
     )
 endif()
 
+include_directories("${CMAKE_SOURCE_DIR}/ext/gulrak-filesystem/include")
+
 #
 # OpenSSL
 #
diff --git a/src/gui/src/SslCertificate.cpp b/src/gui/src/SslCertificate.cpp
index ea770503..57fb5f1b 100644
--- a/src/gui/src/SslCertificate.cpp
+++ b/src/gui/src/SslCertificate.cpp
@@ -18,7 +18,7 @@
 #include "SslCertificate.h"
 #include "common/DataDirectories.h"
 #include "base/finally.h"
-#include "io/fstream.h"
+#include "io/filesystem.h"
 #include "net/FingerprintDatabase.h"
 #include "net/SecureUtils.h"
 
diff --git a/src/lib/io/filesystem.cpp b/src/lib/io/filesystem.cpp
index 3a50edc9..46ae06db 100644
--- a/src/lib/io/filesystem.cpp
+++ b/src/lib/io/filesystem.cpp
@@ -15,6 +15,9 @@
     along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
 
+// this header must come first so that it picks up the filesystem implementation
+#include <ghc/fs_impl.hpp>
+
 #include "filesystem.h"
 #if SYSAPI_WIN32
 #include "common/win32/encoding_utilities.h"
@@ -26,43 +29,42 @@ namespace barrier {
 namespace {
 
 template<class Stream>
-void open_utf8_path_impl(Stream& stream, const std::string& path, std::ios_base::openmode mode)
+void open_utf8_path_impl(Stream& stream, const fs::path& path, std::ios_base::openmode mode)
 {
 #if SYSAPI_WIN32
-    // on Windows we need to use a private constructor from wchar_t* string.
-    auto wchar_path = utf8_to_win_char(path);
-    stream.open(wchar_path.data(), mode);
+    // on Windows we need to use a non-standard constructor from wchar_t* string
+    // which fs::path::native() returns
+    stream.open(path.native().c_str(), mode);
 #else
-    stream.open(path.c_str(), mode);
+    stream.open(path.native().c_str(), mode);
 #endif
 }
 
 } // namespace
 
-void open_utf8_path(std::ifstream& stream, const std::string& path, std::ios_base::openmode mode)
+void open_utf8_path(std::ifstream& stream, const fs::path& path, std::ios_base::openmode mode)
 {
     open_utf8_path_impl(stream, path, mode);
 }
 
-void open_utf8_path(std::ofstream& stream, const std::string& path, std::ios_base::openmode mode)
+void open_utf8_path(std::ofstream& stream, const fs::path& path, std::ios_base::openmode mode)
 {
     open_utf8_path_impl(stream, path, mode);
 }
 
-void open_utf8_path(std::fstream& stream, const std::string& path, std::ios_base::openmode mode)
+void open_utf8_path(std::fstream& stream, const fs::path& path, std::ios_base::openmode mode)
 {
     open_utf8_path_impl(stream, path, mode);
 }
 
-std::FILE* fopen_utf8_path(const std::string& path, const std::string& mode)
+std::FILE* fopen_utf8_path(const fs::path& path, const std::string& mode)
 {
 #if SYSAPI_WIN32
-    auto wchar_path = utf8_to_win_char(path);
     auto wchar_mode = utf8_to_win_char(mode);
-    return _wfopen(reinterpret_cast<wchar_t*>(wchar_path.data()),
+    return _wfopen(path.native().c_str(),
                    reinterpret_cast<wchar_t*>(wchar_mode.data()));
 #else
-    return std::fopen(path.c_str(), mode.c_str());
+    return std::fopen(path.native().c_str(), mode.c_str());
 #endif
 }
 
diff --git a/src/lib/io/filesystem.h b/src/lib/io/filesystem.h
index 9747ffe5..78e34230 100644
--- a/src/lib/io/filesystem.h
+++ b/src/lib/io/filesystem.h
@@ -21,17 +21,20 @@
 #include <cstdio>
 #include <iosfwd>
 #include <ios>
+#include <ghc/fs_fwd.hpp>
 
 namespace barrier {
 
-void open_utf8_path(std::ifstream& stream, const std::string& path,
+namespace fs = ghc::filesystem;
+
+void open_utf8_path(std::ifstream& stream, const fs::path& path,
                     std::ios_base::openmode mode = std::ios_base::in);
-void open_utf8_path(std::ofstream& stream, const std::string& path,
+void open_utf8_path(std::ofstream& stream, const fs::path& path,
                     std::ios_base::openmode mode = std::ios_base::out);
-void open_utf8_path(std::fstream& stream, const std::string& path,
+void open_utf8_path(std::fstream& stream, const fs::path& path,
                     std::ios_base::openmode mode = std::ios_base::in | std::ios_base::out);
 
-std::FILE* fopen_utf8_path(const std::string& path, const std::string& mode);
+std::FILE* fopen_utf8_path(const fs::path& path, const std::string& mode);
 
 } // namespace barrier
 
diff --git a/src/lib/net/FingerprintDatabase.cpp b/src/lib/net/FingerprintDatabase.cpp
index 3dcbaee6..020f19b6 100644
--- a/src/lib/net/FingerprintDatabase.cpp
+++ b/src/lib/net/FingerprintDatabase.cpp
@@ -17,7 +17,7 @@
 
 #include "base/String.h"
 #include "FingerprintDatabase.h"
-#include "io/fstream.h"
+#include "io/filesystem.h"
 #include <algorithm>
 #include <fstream>
 
diff --git a/src/lib/net/SecureSocket.cpp b/src/lib/net/SecureSocket.cpp
index 3c65d9ac..9ac674d6 100644
--- a/src/lib/net/SecureSocket.cpp
+++ b/src/lib/net/SecureSocket.cpp
@@ -26,7 +26,7 @@
 #include "base/Log.h"
 #include "base/String.h"
 #include "common/DataDirectories.h"
-#include "io/fstream.h"
+#include "io/filesystem.h"
 #include "net/FingerprintDatabase.h"
 
 #include <openssl/ssl.h>