diff --git a/scripts/windows/installed-release-smoke.ps1 b/scripts/windows/installed-release-smoke.ps1
index 019693d84..65d5f3cbc 100644
--- a/scripts/windows/installed-release-smoke.ps1
+++ b/scripts/windows/installed-release-smoke.ps1
@@ -97,6 +97,18 @@ function Stop-OwnedProcess {
 }
 
 try {
+    # A real profile folder is private to its account. RUNNER_TEMP inherits the
+    # drive root's "Users may create folders" entry, which private storage refuses.
+    New-Item -ItemType Directory -Path $root -Force | Out-Null
+    $rootAcl = [Security.AccessControl.DirectorySecurity]::new()
+    $rootAcl.SetAccessRuleProtection($true, $false)
+    foreach ($sid in @([Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [Security.Principal.SecurityIdentifier]::new('S-1-5-18'),
+            [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))) {
+        $rootAcl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl',
+            'ContainerInherit,ObjectInherit', 'None', 'Allow'))
+    }
+    Set-Acl -LiteralPath $root -AclObject $rootAcl
     New-Item -ItemType Directory -Path $local, (Join-Path $root 'roaming'), (Join-Path $root 'electron') -Force | Out-Null
     $result.assets = @(Get-Content -LiteralPath $AssetEvidence -Raw | ConvertFrom-Json)
     if ($result.assets.Count -ne 2) { throw 'Expected authenticated ZIP and Setup asset evidence' }
diff --git a/scripts/windows/normal-release-smoke.ps1 b/scripts/windows/normal-release-smoke.ps1
index e2ab66ef3..4c39ebab0 100644
--- a/scripts/windows/normal-release-smoke.ps1
+++ b/scripts/windows/normal-release-smoke.ps1
@@ -210,6 +210,18 @@ $expression = @'
 '@
 
 try {
+    # A real profile folder is private to its account. RUNNER_TEMP inherits the
+    # drive root's "Users may create folders" entry, which private storage refuses.
+    New-Item -ItemType Directory -Path $root -Force | Out-Null
+    $rootAcl = [Security.AccessControl.DirectorySecurity]::new()
+    $rootAcl.SetAccessRuleProtection($true, $false)
+    foreach ($sid in @([Security.Principal.WindowsIdentity]::GetCurrent().User,
+            [Security.Principal.SecurityIdentifier]::new('S-1-5-18'),
+            [Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))) {
+        $rootAcl.AddAccessRule([Security.AccessControl.FileSystemAccessRule]::new($sid, 'FullControl',
+            'ContainerInherit,ObjectInherit', 'None', 'Allow'))
+    }
+    Set-Acl -LiteralPath $root -AclObject $rootAcl
     New-Item -ItemType Directory -Force -Path $normalUserDataDirectory, (Join-Path $root 'local'), (Join-Path $root 'roaming'),
         (Join-Path $root 'home'), (Split-Path -Parent $Report) | Out-Null
     $result.assets = @(Get-Content -LiteralPath $AssetEvidence -Raw | ConvertFrom-Json)