diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..8d2b912
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,4 @@
+# Release validation parses workflow jobs and verifies canonical patch bytes.
+# Keep these inputs identical when Windows checks out with core.autocrlf=true.
+.github/workflows/*.yml text eol=lf
+patches/*.patch text eol=lf
diff --git a/scripts/mod-ollama-chat-patch.test.mjs b/scripts/mod-ollama-chat-patch.test.mjs
index 4047c2e..58677e3 100644
--- a/scripts/mod-ollama-chat-patch.test.mjs
+++ b/scripts/mod-ollama-chat-patch.test.mjs
@@ -105,7 +105,12 @@ function resolveMsvcEnvironment() {
       "/c",
       `call "${developerCommand}" -no_logo -arch=x64 -host_arch=x64 >nul && set`,
     ],
-    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] },
+    {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      // This argument already uses cmd.exe quoting, not Windows argv escaping.
+      windowsVerbatimArguments: true,
+    },
   );
   return mergeWindowsEnvironment(process.env, output);
 }