Started from pwsh 7, the child Windows PowerShell 5.1 inherits PowerShell 7's PSModulePath and cannot load Microsoft.PowerShell.Security, so ConvertTo-SecureString fails and every DPAPI set/get reports "Windows credential protection failed". The release workflow's Windows lane (steps in pwsh) hit it in the existing DPAPI test. The keyring now spawns PowerShell without PSModulePath; each shell computes its own. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>