diff --git a/scripts/ecc.js b/scripts/ecc.js
index dfad4eb86..4fdc23831 100755
--- a/scripts/ecc.js
+++ b/scripts/ecc.js
@@ -232,7 +232,7 @@ function runCommand(commandName, args) {
     {
       cwd: process.cwd(),
       env: commandName === 'ito'
-        ? createSafeItoEnvironment(process.env, { includeControls: true })
+        ? { ...createSafeItoEnvironment(process.env, { includeControls: true }) }
         : process.env,
       encoding: 'utf8',
       maxBuffer: 10 * 1024 * 1024,
diff --git a/scripts/ito.js b/scripts/ito.js
index 6548c7caa..8f37ee20c 100755
--- a/scripts/ito.js
+++ b/scripts/ito.js
@@ -206,7 +206,7 @@ function defaultOpenUrl(url) {
   }
 
   const result = spawnSync(executable, args, {
-    env: createSafeItoEnvironment(process.env),
+    env: { ...createSafeItoEnvironment(process.env) },
     stdio: "ignore",
     windowsHide: true,
     shell: false,
diff --git a/tests/scripts/ito-handoff.test.js b/tests/scripts/ito-handoff.test.js
index e68551291..102a549e0 100644
--- a/tests/scripts/ito-handoff.test.js
+++ b/tests/scripts/ito-handoff.test.js
@@ -268,7 +268,8 @@ function main() {
       assert.match(result.stdout, /no supported structured ECC intake/i)
     }],
     ["npm welcome remains POSIX-safe around apostrophes", () => {
-      const result = spawnSync("npm", ["run", "welcome"], {
+      const npmExecutable = process.platform === "win32" ? "npm.cmd" : "npm"
+      const result = spawnSync(npmExecutable, ["run", "welcome"], {
         cwd: REPO_ROOT,
         encoding: "utf8",
       })