diff --git a/scripts/install-upstream-tunnel-task.ps1 b/scripts/install-upstream-tunnel-task.ps1
index 0ca554e8..af85eac8 100644
--- a/scripts/install-upstream-tunnel-task.ps1
+++ b/scripts/install-upstream-tunnel-task.ps1
@@ -85,7 +85,14 @@ $argumentList = @(
     '-ConfigPath', (ConvertTo-TaskArgument $privateConfigPath)
 )
 $taskArguments = $argumentList -join ' '
-$currentUser = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+$currentUser = if ([string]::IsNullOrWhiteSpace($env:USERNAME)) {
+    [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+}
+else {
+    # Task Scheduler can return ERROR_FILE_NOT_FOUND when a local SAM account
+    # is registered with a stale or unresolvable machine-qualified prefix.
+    $env:USERNAME
+}
 
 if ($PSCmdlet.ShouldProcess($TaskName, 'register and start the read-only upstream tunnel task')) {
     $privateConfigDirectory = Split-Path -Parent $privateConfigPath
diff --git a/tests/Unit/Deployment/BusinessMirrorScheduleTest.php b/tests/Unit/Deployment/BusinessMirrorScheduleTest.php
index 73e7075f..330a8ef2 100644
--- a/tests/Unit/Deployment/BusinessMirrorScheduleTest.php
+++ b/tests/Unit/Deployment/BusinessMirrorScheduleTest.php
@@ -79,4 +79,14 @@ class BusinessMirrorScheduleTest extends TestCase
             $this->assertStringContainsString('ClickHouse did not become healthy', $contents, $script);
         }
     }
+
+    public function test_tunnel_task_uses_the_local_sam_account_and_hidden_powershell(): void
+    {
+        $contents = file_get_contents(dirname(__DIR__, 3) . '/scripts/install-upstream-tunnel-task.ps1');
+
+        $this->assertIsString($contents);
+        $this->assertStringContainsString('$env:USERNAME', $contents);
+        $this->assertStringContainsString("'-WindowStyle', 'Hidden'", $contents);
+        $this->assertStringContainsString('TASK_LOGON_INTERACTIVE_TOKEN', $contents);
+    }
 }