diff --git a/src/conductor/cli/update.py b/src/conductor/cli/update.py
index 2f04e33..d0013d1 100644
--- a/src/conductor/cli/update.py
+++ b/src/conductor/cli/update.py
@@ -17,6 +17,7 @@
 import hashlib
 import json
 import logging
+import os
 import shutil
 import subprocess
 import sys
@@ -334,7 +335,10 @@ def run_update(console: Console) -> None:
         renamed_exes = _rename_windows_exes()
 
     try:
-        proc = subprocess.run(cmd, capture_output=True, text=True)  # noqa: S603
+        # Set PYTHONUTF8=1 so child Python processes use UTF-8 encoding
+        # instead of the system default (cp1252 on Windows).
+        env = {**os.environ, "PYTHONUTF8": "1"}
+        proc = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", env=env)  # noqa: S603
 
         if proc.returncode == 0:
             console.print(f"[green]Successfully upgraded to v{version}[/green]")
diff --git a/src/conductor/executor/script.py b/src/conductor/executor/script.py
index b1c8d43..a7fd0b6 100644
--- a/src/conductor/executor/script.py
+++ b/src/conductor/executor/script.py
@@ -92,7 +92,11 @@ async def execute(
         # Build environment (merge os.environ + agent.env)
         # Note: ${VAR:-default} patterns in agent.env are already resolved
         # by the config loader during YAML parsing.
-        env = {**os.environ, **agent.env} if agent.env else None
+        # Always set PYTHONUTF8=1 so child Python processes use UTF-8 encoding
+        # instead of the system default (cp1252 on Windows), preventing garbled
+        # Unicode characters in script output.
+        base_env = {**os.environ, "PYTHONUTF8": "1"}
+        env = {**base_env, **agent.env} if agent.env else base_env
 
         _verbose_log(f"  Script: {rendered_command} {' '.join(rendered_args)}")
 
diff --git a/src/conductor/mcp_auth.py b/src/conductor/mcp_auth.py
index 840cfd4..8b6b469 100644
--- a/src/conductor/mcp_auth.py
+++ b/src/conductor/mcp_auth.py
@@ -8,6 +8,7 @@
 
 import asyncio
 import json
+import os
 import subprocess
 import urllib.request
 from typing import Any
@@ -55,6 +56,9 @@ def get_azure_token(scope: str) -> str | None:
         The access token string, or None if token acquisition fails.
     """
     try:
+        # Set PYTHONUTF8=1 so child Python processes use UTF-8 encoding
+        # instead of the system default (cp1252 on Windows).
+        env = {**os.environ, "PYTHONUTF8": "1"}
         result = subprocess.run(
             [
                 "az",
@@ -69,6 +73,8 @@ def get_azure_token(scope: str) -> str | None:
             ],
             capture_output=True,
             text=True,
+            encoding="utf-8",
+            env=env,
             timeout=30,
         )
         if result.returncode == 0: