diff --git a/.taskfiles/desktop.yml b/.taskfiles/desktop.yml
index 27f8dafde0..555e252a4e 100644
--- a/.taskfiles/desktop.yml
+++ b/.taskfiles/desktop.yml
@@ -195,7 +195,11 @@ tasks:
       # `desktop:build` run `jlink:clean` first to force a fresh build.
       - cmd: chmod -R u+w runtime/jre
         platforms: [linux, darwin]
-      - cmd: powershell -NoProfile -Command "Get-ChildItem -Recurse runtime/jre | ForEach-Object { $_.IsReadOnly = $false }"
+      # Single-quoted so Task's shell leaves `$_` and `$false` alone. Double
+      # quotes let it expand them as its own variables, and since neither is
+      # set the command PowerShell actually received was
+      # `ForEach-Object { .IsReadOnly = }`, which fails on every file.
+      - cmd: powershell -NoProfile -Command 'Get-ChildItem -Recurse -File runtime/jre | ForEach-Object { $_.IsReadOnly = $false }'
         platforms: [windows]
     status:
       - test -f runtime/jre/release