diff --git a/codex-rs/windows-sandbox-rs/BUILD.bazel b/codex-rs/windows-sandbox-rs/BUILD.bazel
index 8531cb4d66..50255d4540 100644
--- a/codex-rs/windows-sandbox-rs/BUILD.bazel
+++ b/codex-rs/windows-sandbox-rs/BUILD.bazel
@@ -55,4 +55,8 @@ codex_rust_crate(
         ":codex-command-runner",
         ":codex-windows-sandbox-setup",
     ],
+    # Setup rotates machine-wide account passwords. The process-local test lock
+    # cannot prevent exec-server's elevated filesystem tests from rotating them
+    # between this crate's setup and logon. Windows tests execute locally in CI.
+    test_tags = ["exclusive-if-local"],
 )
diff --git a/codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs b/codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs
index 296b81b0e4..f2f025cb63 100644
--- a/codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs
+++ b/codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs
@@ -337,7 +337,12 @@ fn elevated_non_tty_cmd_forwards_env_output_and_exit() {
             /*use_private_desktop*/ true,
         )
         .await
-        .expect("spawn elevated non-tty cmd session");
+        .unwrap_or_else(|err| {
+            panic!(
+                "spawn elevated non-tty cmd session: {err:#}\nsandbox log:\n{}",
+                sandbox_log(codex_home.path())
+            )
+        });
         let (stdout, exit_code) =
             collect_stdout_and_exit(spawned, codex_home.path(), Duration::from_secs(10)).await;
         let stdout = String::from_utf8_lossy(&stdout);