diff --git a/ops/platform-acceptance/windows.ps1 b/ops/platform-acceptance/windows.ps1
index aa0836f..17ef2d8 100644
--- a/ops/platform-acceptance/windows.ps1
+++ b/ops/platform-acceptance/windows.ps1
@@ -29,7 +29,11 @@ function Get-Distros {
     return @($raw -split "`r?`n" | ForEach-Object { $_.Trim() } | Where-Object { $_ })
 }
 function Invoke-Distro([string] $Command) {
-    & $Wsl -d $Distro -u root --exec /bin/bash -lc $Command | Out-Host
+    # PowerShell 5 re-quotes native command arguments before invoking wsl.exe.
+    # That mangles bash substitutions and nested quotes even when the
+    # PowerShell string itself is literal. Send the script over stdin instead;
+    # this preserves the exact bytes and was proven under the real runner user.
+    $Command | & $Wsl -d $Distro -u root --exec /bin/bash -s | Out-Host
     if ($LASTEXITCODE -ne 0) { Refuse "in-distribution command failed: $Command" }
 }
 function Assert-DistroVersion([string] $ExpectedVersion) {
diff --git a/test/phase4-platform-acceptance.mjs b/test/phase4-platform-acceptance.mjs
index ee1c0bb..90e16af 100644
--- a/test/phase4-platform-acceptance.mjs
+++ b/test/phase4-platform-acceptance.mjs
@@ -212,6 +212,8 @@ test("Windows code publishes no artifact/signing claim and requires honest reboo
   assert.match(windows, /apply-linux-release\.sh/);
   assert.match(windows, /function Assert-DistroVersion/);
   assert.equal((windows.match(/Assert-DistroVersion \$(?:Version|PreviousVersion)/g) || []).length, 4);
+  assert.match(windows, /\$Command \| & \$Wsl -d \$Distro -u root --exec \/bin\/bash -s/);
+  assert.doesNotMatch(windows, /\/bin\/bash -lc \$Command/);
   assert.doesNotMatch(windows, /Invoke-Distro "test .*systemctl/);
   assert.match(windows, /LocalRootfs/);
   assert.match(read("site/public/install.ps1"), /LocalRootfsSha256/);