diff --git a/scripts/validate-pack.js b/scripts/validate-pack.js
index e0954c966..b35bc1b5a 100644
--- a/scripts/validate-pack.js
+++ b/scripts/validate-pack.js
@@ -26,6 +26,7 @@ function runNpm(args, options = {}) {
   return execFileSync(getNpmCommand(), args, {
     cwd: ROOT,
     encoding: 'utf8',
+    shell: process.platform === 'win32',
     stdio: ['pipe', 'pipe', 'pipe'],
     maxBuffer: DEFAULT_MAX_BUFFER,
     env: {
@@ -125,6 +126,7 @@ try {
     const installOutput = execFileSync(getNpmCommand(), ['install', tarball], {
       cwd: installDir,
       encoding: 'utf8',
+      shell: process.platform === 'win32',
       stdio: ['pipe', 'pipe', 'pipe'],
       maxBuffer: DEFAULT_MAX_BUFFER,
       env: {
diff --git a/src/tests/integration/web-mode-cli.test.ts b/src/tests/integration/web-mode-cli.test.ts
index 68b6c9c1b..9eee1f803 100644
--- a/src/tests/integration/web-mode-cli.test.ts
+++ b/src/tests/integration/web-mode-cli.test.ts
@@ -165,6 +165,7 @@ test('launchWebMode prefers the packaged standalone host and opens the resolved
       detached: true,
       stdio: 'ignore',
       windowsHide: true,
+      shell: false,
       env: {
         TEST_ENV: '1',
         HOSTNAME: '127.0.0.1',
diff --git a/src/tests/windows-portability.test.ts b/src/tests/windows-portability.test.ts
index 22616360c..30dbde0e5 100644
--- a/src/tests/windows-portability.test.ts
+++ b/src/tests/windows-portability.test.ts
@@ -66,8 +66,13 @@ test("Windows launch points use shell-safe shims", () => {
 		path.join(process.cwd(), "src", "resources", "extensions", "gsd", "pre-execution-checks.ts"),
 		"utf8",
 	);
+	const validatePack = readFileSync(
+		path.join(process.cwd(), "scripts", "validate-pack.js"),
+		"utf8",
+	);
 
 	assert.match(gsdClient, /shell:\s*process\.platform === "win32"/);
 	assert.match(updateService, /npm\.cmd/);
 	assert.match(preExecution, /npm\.cmd/);
+	assert.match(validatePack, /shell:\s*process\.platform === 'win32'/);
 });