diff --git a/codex-rs/hooks/Cargo.toml b/codex-rs/hooks/Cargo.toml
index 874df2d2d9..0ea3719e9d 100644
--- a/codex-rs/hooks/Cargo.toml
+++ b/codex-rs/hooks/Cargo.toml
@@ -32,6 +32,7 @@ uuid = { workspace = true, features = ["v4"] }
 
 [dev-dependencies]
 async-trait = { workspace = true }
+base64 = { workspace = true }
 pretty_assertions = { workspace = true }
 tempfile = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt-multi-thread", "time"] }
diff --git a/codex-rs/hooks/src/engine/command_runner.rs b/codex-rs/hooks/src/engine/command_runner.rs
index 9ed3c5ac15..aa18220613 100644
--- a/codex-rs/hooks/src/engine/command_runner.rs
+++ b/codex-rs/hooks/src/engine/command_runner.rs
@@ -319,6 +319,8 @@ mod tests {
     use std::time::Instant;
 
     use async_trait::async_trait;
+    use base64::Engine as _;
+    use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
     use codex_exec_server::EnvironmentManager;
     use codex_exec_server::ExecProcessEventReceiver;
     use codex_exec_server::ExecServerError;
@@ -443,7 +445,7 @@ mod tests {
 
     fn print_command(output: &str) -> String {
         if cfg!(windows) {
-            format!("powershell -NoLogo -NoProfile -Command \"[Console]::Out.Write('{output}')\"")
+            powershell_command(&format!("[Console]::Out.Write('{output}')"))
         } else {
             format!("printf {output}")
         }
@@ -451,14 +453,24 @@ mod tests {
 
     fn echo_stdin_to_stdout_and_stderr_with_exit_code(exit_code: i32) -> String {
         if cfg!(windows) {
-            format!(
-                "powershell -NoLogo -NoProfile -Command \"$hookInput = [Console]::In.ReadToEnd(); [Console]::Out.Write($hookInput); [Console]::Error.Write('stderr'); exit {exit_code}\""
-            )
+            powershell_command(&format!(
+                "$hookInput = [Console]::In.ReadToEnd(); [Console]::Out.Write($hookInput); [Console]::Error.Write('stderr'); exit {exit_code}"
+            ))
         } else {
             format!("cat; printf stderr >&2; exit {exit_code}")
         }
     }
 
+    fn powershell_command(script: &str) -> String {
+        let encoded = BASE64_STANDARD.encode(
+            script
+                .encode_utf16()
+                .flat_map(u16::to_le_bytes)
+                .collect::<Vec<u8>>(),
+        );
+        format!("powershell.exe -NoLogo -NoProfile -NonInteractive -EncodedCommand {encoded}")
+    }
+
     fn sleep_command(seconds: u64) -> String {
         if cfg!(windows) {
             format!("ping -n {} 127.0.0.1 >NUL", seconds + 1)