diff --git a/.buildkite/ci.ts b/.buildkite/ci.ts
index d737472bd1f1..dbf42e39c7c5 100755
--- a/.buildkite/ci.ts
+++ b/.buildkite/ci.ts
@@ -1062,8 +1062,9 @@ function getWindowsSignStep(windowsPlatforms: Platform[], options: PipelineOptio
     }),
     retry: getRetry(),
     cancel_on_build_failing: isMergeQueue(),
+    // smctl runs signtool.exe, which is only in PATH in a Visual Studio environment.
     command: [
-      `powershell -NoProfile -ExecutionPolicy Bypass -File .buildkite/scripts/sign-windows-artifacts.ps1 ` +
+      `pwsh -NoProfile -File .\\scripts\\vs-shell.ps1 pwsh -NoProfile -File .\\.buildkite\\scripts\\sign-windows-artifacts.ps1 ` +
         `-Artifacts ${artifacts.join(",")} ` +
         `-BuildSteps ${buildSteps.join(",")}`,
     ],
diff --git a/.buildkite/scripts/sign-windows-artifacts.ps1 b/.buildkite/scripts/sign-windows-artifacts.ps1
index 9be47625887c..bcc3a015ffdf 100644
--- a/.buildkite/scripts/sign-windows-artifacts.ps1
+++ b/.buildkite/scripts/sign-windows-artifacts.ps1
@@ -9,7 +9,7 @@
 # with the same name so downstream steps (release, tests) see signed binaries.
 
 param(
-    # Comma-separated list. powershell.exe -File passes everything as
+    # Comma-separated list. pwsh -File passes everything as
     # literal strings, so [string[]] with "a,b,c" becomes a 1-element array.
     [Parameter(Mandatory=$true)]
     [string]$Artifacts,
@@ -25,10 +25,6 @@ $ProgressPreference = "SilentlyContinue"
 $ArtifactList = $Artifacts -split ","
 $BuildStepList = $BuildSteps -split ","
 
-# smctl shells out to signtool.exe which is only in PATH when the VS dev
-# environment is loaded. Dot-source the existing helper to set it up.
-. $PSScriptRoot\..\..\scripts\vs-shell.ps1
-
 function Log-Info {
     param([string]$Message)
     Write-Host "[INFO] $Message" -ForegroundColor Cyan
@@ -262,6 +258,11 @@ try {
     }
     Log-Info "Will sign $($ArtifactList.Count) artifacts: $($ArtifactList -join ', ')"
 
+    # smctl runs signtool.exe and exits 0 when it cannot.
+    if (!(Get-Command signtool.exe -ErrorAction SilentlyContinue)) {
+        throw "signtool.exe is not in PATH. Run this script through scripts/vs-shell.ps1."
+    }
+
     Ensure-Secrets
     Setup-Certificate
     $smctl = Install-KeyLocker
diff --git a/scripts/vs-shell.ps1 b/scripts/vs-shell.ps1
index c9751447f6e1..8fda5f36fbea 100755
--- a/scripts/vs-shell.ps1
+++ b/scripts/vs-shell.ps1
@@ -49,6 +49,11 @@ if($env:VSINSTALLDIR -eq $null) {
   } finally {
     Pop-Location
   }
+
+  # Launch-VsDevShell.ps1 only prints a message when it fails.
+  if ($env:VSINSTALLDIR -eq $null) {
+    throw "Launch-VsDevShell.ps1 did not load the Visual Studio environment."
+  }
 }
 
 if($env:VSCMD_ARG_TGT_ARCH -eq "x86") {