diff --git a/.github/actions/run-argument-comment-lint/action.yml b/.github/actions/run-argument-comment-lint/action.yml
index b5e8462167..cb490a606b 100644
--- a/.github/actions/run-argument-comment-lint/action.yml
+++ b/.github/actions/run-argument-comment-lint/action.yml
@@ -32,7 +32,7 @@ runs:
       shell: bash
       run: |
         bazel_targets="$(./tools/argument-comment-lint/list-bazel-targets.sh)"
-        ./.github/scripts/run_bazel_ci.py \
+        MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
           -- \
           build \
           --config=argument-comment-lint \
diff --git a/.github/scripts/run-argument-comment-lint-bazel.sh b/.github/scripts/run-argument-comment-lint-bazel.sh
index 4a7d34a80c..5dd0b80b4f 100755
--- a/.github/scripts/run-argument-comment-lint-bazel.sh
+++ b/.github/scripts/run-argument-comment-lint-bazel.sh
@@ -41,7 +41,7 @@ read_query_labels() {
   query_stdout="$(mktemp)"
   query_stderr="$(mktemp)"
 
-  if ! ./.github/scripts/run_bazel_query_ci.py \
+  if ! MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_query_ci.py \
     --keep_going \
     --output=label \
     -- "$query" >"$query_stdout" 2>"$query_stderr"; then
@@ -72,7 +72,7 @@ if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
   fi
 fi
 
-./.github/scripts/run_bazel_ci.py \
+MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
   -- \
   build \
   "${bazel_lint_args[@]}" \
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index cc7e2116e9..4f7861f388 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -112,7 +112,7 @@ jobs:
             --test_verbose_timeout_warnings
             --build_metadata=COMMIT_SHA=${GITHUB_SHA}
           )
-          ./.github/scripts/run_bazel_ci.py \
+          MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
             "${bazel_wrapper_args[@]}" \
             -- \
             "${bazel_test_args[@]}" \
@@ -192,7 +192,7 @@ jobs:
 
           bazel_test_query='tests(//...) except tests(//third_party/v8:all) except attr(tags, "manual", tests(//...))'
           mapfile -t bazel_targets < <(
-            ./.github/scripts/run_bazel_query_ci.py --output=label -- "${bazel_test_query}" \
+            MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_query_ci.py --output=label -- "${bazel_test_query}" \
               | LC_ALL=C sort
           )
 
@@ -224,7 +224,7 @@ jobs:
             --build_metadata=TAG_windows_test_shard=${BAZEL_TEST_SHARD}
           )
 
-          ./.github/scripts/run_bazel_ci.py \
+          MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
             --print-failed-action-summary \
             --print-failed-test-logs \
             --windows-cross-compile \
@@ -313,7 +313,7 @@ jobs:
             --build_metadata=TAG_windows_native_main=true
           )
 
-          ./.github/scripts/run_bazel_ci.py \
+          MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
             --print-failed-action-summary \
             --print-failed-test-logs \
             -- \
@@ -412,7 +412,7 @@ jobs:
             bazel_targets+=("${target}")
           done <<< "${bazel_target_lines}"
 
-          ./.github/scripts/run_bazel_ci.py \
+          MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
             --print-failed-action-summary \
             "${bazel_wrapper_args[@]}" \
             -- \
@@ -510,7 +510,7 @@ jobs:
             bazel_targets+=("${target}")
           done <<< "${bazel_target_lines}"
 
-          ./.github/scripts/run_bazel_ci.py \
+          MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
             "${bazel_wrapper_args[@]}" \
             -- \
             build \
@@ -524,7 +524,7 @@ jobs:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          ./.github/scripts/run_bazel_ci.py \
+          MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
             --remote-download-toplevel \
             --print-failed-action-summary \
             -- \
diff --git a/.github/workflows/rust-ci-full.yml b/.github/workflows/rust-ci-full.yml
index 30a655dc75..1df0027129 100644
--- a/.github/workflows/rust-ci-full.yml
+++ b/.github/workflows/rust-ci-full.yml
@@ -135,7 +135,7 @@ jobs:
         shell: bash
         run: |
           bazel_targets="$(./tools/argument-comment-lint/list-bazel-targets.sh)"
-          ./.github/scripts/run_bazel_ci.py \
+          MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
             -- \
             build \
             --config=argument-comment-lint \
diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml
index 7639d3dc15..a66b3beb49 100644
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -90,7 +90,7 @@ jobs:
           # BuildBuddy credentials are unavailable. This workflow needs the
           # built `codex` binary on disk afterwards, so ask the wrapper to
           # override CI's default remote_download_minimal behavior.
-          ./.github/scripts/run_bazel_ci.py \
+          MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
             --remote-download-toplevel \
             -- \
             build \
@@ -103,7 +103,7 @@ jobs:
           # the build instead of guessing which Bazel convenience symlink is
           # available on the runner.
           cquery_output="$(
-            ./.github/scripts/run_bazel_ci.py \
+            MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_ci.py \
               -- \
               cquery \
               --output=files \
diff --git a/scripts/list-bazel-clippy-targets.sh b/scripts/list-bazel-clippy-targets.sh
index a384973f04..38252d37be 100755
--- a/scripts/list-bazel-clippy-targets.sh
+++ b/scripts/list-bazel-clippy-targets.sh
@@ -23,7 +23,7 @@ done
 # continue with a partial list if `bazel query` fails. Target discovery is
 # local on all platforms.
 manual_rust_test_targets="$(
-  ./.github/scripts/run_bazel_query_ci.py \
+  MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_query_ci.py \
     --output=label \
     -- 'kind("rust_test rule", attr(tags, "manual", //codex-rs/... except //codex-rs/v8-poc/...))'
 )"
diff --git a/tools/argument-comment-lint/list-bazel-targets.sh b/tools/argument-comment-lint/list-bazel-targets.sh
index ccf2d06fb5..780e6eb128 100755
--- a/tools/argument-comment-lint/list-bazel-targets.sh
+++ b/tools/argument-comment-lint/list-bazel-targets.sh
@@ -10,7 +10,7 @@ cd "${repo_root}"
 # Add only those manual rust_test targets explicitly so inline `#[cfg(test)]`
 # call sites are linted without pulling in unrelated manual release targets.
 manual_rust_test_targets="$(
-  ./.github/scripts/run_bazel_query_ci.py \
+  MSYS2_ARG_CONV_EXCL='*' ./.github/scripts/run_bazel_query_ci.py \
     --output=label \
     -- 'kind("rust_test rule", attr(tags, "manual", //codex-rs/...))'
 )"