diff --git a/doc/signpath.md b/doc/signpath.md
index cde506ee0..598407c4d 100644
--- a/doc/signpath.md
+++ b/doc/signpath.md
@@ -37,8 +37,8 @@ commit (`github.sha`), so the source matches the build's origin metadata.
 ## Test signing and production review
 
 Run with `test` first. Only this ephemeral GitHub-hosted runner imports the
-configured public self-signed test certificate into its current-user trust
-stores. Each signed file must have a valid timestamped signature from exactly
+configured public self-signed test certificate into its machine trust stores
+to avoid interactive user-store prompts. Each signed file must have a valid timestamped signature from exactly
 that certificate. Test outputs are labelled `-Test-Signed`; they are for
 onboarding verification and are not publicly trusted distribution packages.
 Do not install this certificate on end-user computers.
diff --git a/scripts/trust_signpath_test_certificate.ps1 b/scripts/trust_signpath_test_certificate.ps1
index 0d67baf21..2eb17ca3d 100644
--- a/scripts/trust_signpath_test_certificate.ps1
+++ b/scripts/trust_signpath_test_certificate.ps1
@@ -23,9 +23,12 @@ try {
     }
     # Only the ephemeral GitHub-hosted test job trusts this public certificate.
     # Release jobs never execute this script and retain normal Windows trust.
+    # The user Root store can show an interactive security prompt.
+    # GitHub-hosted Windows runners are disposable and run as administrator.
     foreach ($storeName in @('Root', 'TrustedPublisher')) {
-        $store = [System.Security.Cryptography.X509Certificates.X509Store]::new($storeName, 'CurrentUser')
+        $store = [System.Security.Cryptography.X509Certificates.X509Store]::new($storeName, 'LocalMachine')
         try {
+            Write-Host "Importing the public test certificate into LocalMachine/$storeName"
             $store.Open('ReadWrite')
             $store.Add($certificate)
         } finally {