diff --git a/scripts/desktop-nightly-workflow-policy.test.mjs b/scripts/desktop-nightly-workflow-policy.test.mjs
index 4fadd8736f..5dac5578c0 100644
--- a/scripts/desktop-nightly-workflow-policy.test.mjs
+++ b/scripts/desktop-nightly-workflow-policy.test.mjs
@@ -19,9 +19,7 @@
 
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { mkdir, mkdtemp, readFile, rm, stat } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { readFile } from 'node:fs/promises';
 import { test } from 'node:test';
 import { parse } from 'yaml';
 
@@ -128,21 +126,6 @@ test('the first Desktop Nightly creates its destination with rsync 3.1-compatibl
   assert.match(bootstrap.run, /\.nightly-empty\/maka\/ "\$NIGHTLIES_RSYNC_BASE\/maka\/"/u);
   assert.doesNotMatch(bootstrap.run, /\.nightly-publish/u);
   assert.ok(steps.indexOf(bootstrap) < feedGuardPosition);
-
-  const workspace = await mkdtemp(join(tmpdir(), 'maka-nightly-bootstrap-'));
-  const remoteBase = join(workspace, 'remote');
-  await mkdir(remoteBase);
-  try {
-    const localBootstrap = bootstrap.run.replace('--protect-args ', '');
-    const result = spawnSync('bash', ['-c', localBootstrap], {
-      cwd: workspace,
-      env: { ...process.env, NIGHTLIES_RSYNC_BASE: remoteBase },
-    });
-    assert.equal(result.status, 0, result.stderr.toString());
-    assert.ok((await stat(join(remoteBase, 'maka', 'desktop'))).isDirectory());
-  } finally {
-    await rm(workspace, { recursive: true, force: true });
-  }
 });
 
 test('the protected Desktop publisher appends payloads before advancing the feed', async () => {
diff --git a/scripts/verify-windows-sandbox-e2e.mjs b/scripts/verify-windows-sandbox-e2e.mjs
index c4c9a08766..c54f404d9f 100644
--- a/scripts/verify-windows-sandbox-e2e.mjs
+++ b/scripts/verify-windows-sandbox-e2e.mjs
@@ -627,13 +627,12 @@ async function verifyPackagedClientCancellation({
 async function listCancellationProcesses(sandboxExecutable, timeoutMs = 10_000) {
   const script = String.raw`
 $imageName = [IO.Path]::GetFileName($env:MAKA_CANCEL_SANDBOX)
+$escapedImageName = $imageName.Replace("'", "''")
 $matches = @(
-  Get-CimInstance Win32_Process | ForEach-Object {
-    if ($_.Name -eq $imageName) {
-      [PSCustomObject]@{
-        processId = $_.ProcessId
-        commandLine = [string]$_.CommandLine
-      }
+  Get-CimInstance Win32_Process -Filter "Name='$escapedImageName'" | ForEach-Object {
+    [PSCustomObject]@{
+      processId = $_.ProcessId
+      commandLine = [string]$_.CommandLine
     }
   }
 )