diff --git a/src/main/system-fonts.test.ts b/src/main/system-fonts.test.ts
index 106129feb8f..548fabf5a73 100644
--- a/src/main/system-fonts.test.ts
+++ b/src/main/system-fonts.test.ts
@@ -70,6 +70,22 @@ describe('listSystemFontFamilies', () => {
     })
   })
 
+  it('spawns the Windows font script without an -ExecutionPolicy switch', async () => {
+    // Why: execution policy gates script *files*, never -Command, so the switch
+    // was a no-op -- and it is the highest-weighted token on the command lines
+    // Defender flags (#17858).
+    await withPlatform('win32', async () => {
+      runProcessMock.mockResolvedValue(ok('Consolas\n'))
+      const { listSystemFontFamilies } = await import('./system-fonts')
+      await listSystemFontFamilies()
+
+      const args = runProcessMock.mock.calls[0]?.[0].args ?? []
+      expect(args).toContain('-Command')
+      expect(args).not.toContain('-ExecutionPolicy')
+      expect(args).not.toContain('Bypass')
+    })
+  })
+
   it('runs PowerShell by absolute path on Windows', async () => {
     // Why: a bare `powershell.exe` resolves against the child's PATH, which is
     // not the user's under Electron. Where policy has pruned the System32 entry
diff --git a/src/main/system-fonts.ts b/src/main/system-fonts.ts
index f841e22a579..73d5ef9f993 100644
--- a/src/main/system-fonts.ts
+++ b/src/main/system-fonts.ts
@@ -89,7 +89,8 @@ $fonts.Families | ForEach-Object { $_.Name }
 
   return execFileText(
     windowsPowerShellPath(),
-    ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script],
+    // Why: policy gates script *files*, not -Command, so the switch was a Defender-weighted no-op.
+    ['-NoProfile', '-NonInteractive', '-Command', script],
     8 * 1024 * 1024
   ).then((output) =>
     uniqueSorted(