diff --git a/scripts/bootstrap-ocsentinel-ninja.ps1 b/scripts/bootstrap-ocsentinel-ninja.ps1
index 834c465..ed25e7f 100644
--- a/scripts/bootstrap-ocsentinel-ninja.ps1
+++ b/scripts/bootstrap-ocsentinel-ninja.ps1
@@ -40,6 +40,31 @@ function Get-OCSentinelManifest {
     }
 }
 
+function Invoke-OCSentinelUpdater {
+    param(
+        [Parameter(Mandatory)][string]$UpdaterPath,
+        [Parameter(Mandatory)][string]$ManifestUri
+    )
+
+    # Existing clients can still contain an older updater without TLS setup.
+    # Start it in a prepared child process so it can download the current package.
+    $escapedUpdaterPath = $UpdaterPath.Replace("'", "''")
+    $escapedManifestUri = $ManifestUri.Replace("'", "''")
+    $command = @"
+`$protocols = [Net.SecurityProtocolType]::Tls12
+if ([Enum]::GetNames([Net.SecurityProtocolType]) -contains 'Tls13') {
+    `$protocols = `$protocols -bor [Net.SecurityProtocolType]::Tls13
+}
+[Net.ServicePointManager]::SecurityProtocol = `$protocols
+[Net.ServicePointManager]::Expect100Continue = `$false
+& '$escapedUpdaterPath' -ManifestUrl '$escapedManifestUri'
+exit `$LASTEXITCODE
+"@
+
+    & powershell.exe -NoProfile -ExecutionPolicy Bypass -Command $command
+    return $LASTEXITCODE
+}
+
 Initialize-OCSentinelTls
 
 $installRoot = Join-Path $env:ProgramFiles "OCSentinel"
@@ -79,9 +104,9 @@ function Assert-ArtifactSignature {
 
 if (Test-Path -LiteralPath $updaterPath) {
     Write-Host "Existing OCSentinel installation found. Checking for updates."
-    & powershell.exe -NoProfile -ExecutionPolicy Bypass -File $updaterPath -ManifestUrl $ManifestUrl
-    if ($LASTEXITCODE -ne 0) {
-        throw "OCSentinel updater exited with code $LASTEXITCODE"
+    $updaterExitCode = Invoke-OCSentinelUpdater -UpdaterPath $updaterPath -ManifestUri $ManifestUrl
+    if ($updaterExitCode -ne 0) {
+        throw "OCSentinel updater exited with code $updaterExitCode"
     }
 }
 else {