diff --git a/src/conductor/cli/update.py b/src/conductor/cli/update.py
index 2f04e33..0c2bd58 100644
--- a/src/conductor/cli/update.py
+++ b/src/conductor/cli/update.py
@@ -334,7 +334,7 @@ def run_update(console: Console) -> None:
         renamed_exes = _rename_windows_exes()
 
     try:
-        proc = subprocess.run(cmd, capture_output=True, text=True)  # noqa: S603
+        proc = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8")  # noqa: S603
 
         if proc.returncode == 0:
             console.print(f"[green]Successfully upgraded to v{version}[/green]")
diff --git a/src/conductor/executor/script.py b/src/conductor/executor/script.py
index b1c8d43..a7fd0b6 100644
--- a/src/conductor/executor/script.py
+++ b/src/conductor/executor/script.py
@@ -92,7 +92,11 @@ async def execute(
         # Build environment (merge os.environ + agent.env)
         # Note: ${VAR:-default} patterns in agent.env are already resolved
         # by the config loader during YAML parsing.
-        env = {**os.environ, **agent.env} if agent.env else None
+        # Always set PYTHONUTF8=1 so child Python processes use UTF-8 encoding
+        # instead of the system default (cp1252 on Windows), preventing garbled
+        # Unicode characters in script output.
+        base_env = {**os.environ, "PYTHONUTF8": "1"}
+        env = {**base_env, **agent.env} if agent.env else base_env
 
         _verbose_log(f"  Script: {rendered_command} {' '.join(rendered_args)}")
 
diff --git a/src/conductor/mcp_auth.py b/src/conductor/mcp_auth.py
index 840cfd4..e5b3cde 100644
--- a/src/conductor/mcp_auth.py
+++ b/src/conductor/mcp_auth.py
@@ -69,6 +69,7 @@ def get_azure_token(scope: str) -> str | None:
             ],
             capture_output=True,
             text=True,
+            encoding="utf-8",
             timeout=30,
         )
         if result.returncode == 0: