diff --git a/docs/production_deploy.md b/docs/production_deploy.md
index 0c97ff2..f266fdf 100644
--- a/docs/production_deploy.md
+++ b/docs/production_deploy.md
@@ -169,6 +169,10 @@ for all endpoint, bucket, key, and signing-path overrides.
 
 The script stops on the first failed command.
 
+External commands are judged by their exit codes. Windows PowerShell may display
+normal OpenSSL stderr notices as error records; they do not fail a successful
+command. Key matching and installer-signature verification still must pass.
+
 - Failure before S3 upload leaves production unchanged.
 - Failure after S3 upload but before AppCast publication leaves clients on the
   preceding AppCast. Fix the issue and rerun the same release.
diff --git a/tool/deploy_launcher.ps1 b/tool/deploy_launcher.ps1
index 4f7bcf9..2099265 100644
--- a/tool/deploy_launcher.ps1
+++ b/tool/deploy_launcher.ps1
@@ -94,9 +94,19 @@ function Invoke-RequiredCommand {
         [Parameter(Mandatory = $true)][string[]]$Arguments
     )
 
-    & $Command @Arguments
-    if ($LASTEXITCODE -ne 0) {
-        throw "Command failed with exit code ${LASTEXITCODE}: $Command"
+    # Windows PowerShell represents native stderr as error records even on exit 0.
+    # OpenSSL writes its normal key-reading notices there; the exit code is the verdict.
+    $previousPreference = $ErrorActionPreference
+    try {
+        $ErrorActionPreference = 'Continue'
+        & $Command @Arguments
+        $commandExitCode = $LASTEXITCODE
+    }
+    finally {
+        $ErrorActionPreference = $previousPreference
+    }
+    if ($commandExitCode -ne 0) {
+        throw "Command failed with exit code ${commandExitCode}: $Command"
     }
 }
 
@@ -559,12 +569,9 @@ try {
     $previousPath = $env:PATH
     try {
         $env:PATH = "$gitOpenSslDirectory;$env:PATH"
-        $signOutput = & $dart run auto_updater:sign_update `
-            $installerPath `
-            $privateKey 2>&1
-        if ($LASTEXITCODE -ne 0) {
-            throw "Could not sign the installer: $signOutput"
-        }
+        $signOutput = Invoke-RequiredCommand -Command $dart -Arguments @(
+            'run', 'auto_updater:sign_update', $installerPath, $privateKey
+        ) 2>&1
     }
     finally {
         $env:PATH = $previousPath