diff --git a/docs/wsl/wsl-container-getting-started.md b/docs/wsl/wsl-container-getting-started.md
index 8a541e00e..b3b6b4035 100644
--- a/docs/wsl/wsl-container-getting-started.md
+++ b/docs/wsl/wsl-container-getting-started.md
@@ -101,6 +101,11 @@ Verify the binary starts without errors:
 .\src\target\x86_64-pc-windows-msvc\release\wxc-exec.exe --help
 ```
 
+> **Note:** paths in this guide use the x64 target directory. On an ARM64 host
+> `build.bat` targets `aarch64-pc-windows-msvc`, so substitute that directory.
+> The WSLC scripts under `scripts\` and `tests\scripts\` pick the host-arch
+> directory themselves.
+
 > **Note:** `wxc-exec.exe` does **not** require `wslcsdk.dll` at startup. The
 > DLL is loaded at runtime only when the WSLC backend is invoked. All other
 > backends (Process Container, Windows Sandbox) work without it.
diff --git a/docs/wsl/wslc-sdk-bindings.md b/docs/wsl/wslc-sdk-bindings.md
index 9858cc5c6..a7c375182 100644
--- a/docs/wsl/wslc-sdk-bindings.md
+++ b/docs/wsl/wslc-sdk-bindings.md
@@ -108,7 +108,7 @@ match the pinned SDK.
    staged next to `wxc-exec.exe`, then:
 
    ```powershell
-   cargo build -p wxc --features wslc --release --target x86_64-pc-windows-msvc
+   cargo build -p wxc --features wslc --release --target x86_64-pc-windows-msvc  # aarch64-pc-windows-msvc on ARM64
    .\tests\scripts\run_wslc_all_tests.ps1
    ```
 
diff --git a/scripts/ci/run_backend_validation_tests.ps1 b/scripts/ci/run_backend_validation_tests.ps1
index 66caf27d3..830f31ad1 100644
--- a/scripts/ci/run_backend_validation_tests.ps1
+++ b/scripts/ci/run_backend_validation_tests.ps1
@@ -217,10 +217,6 @@ switch ($Backend) {
         }
     }
     'wslc' {
-        # The current WSLC helper hardcodes the x64 target when locating assets.
-        if ($Architecture -ne 'x64') {
-            throw 'The existing WSLC test harness is not architecture-portable yet.'
-        }
         Invoke-TestScript -Path (Join-Path $testScriptRoot 'run_wslc_all_tests.ps1') -Arguments @{
             WxcExecPath = $wxc
         }
diff --git a/scripts/setup-wslc.ps1 b/scripts/setup-wslc.ps1
index e37e79046..f931bafd7 100644
--- a/scripts/setup-wslc.ps1
+++ b/scripts/setup-wslc.ps1
@@ -66,7 +66,11 @@ $ErrorActionPreference = "Stop"
 $RepoRoot = Split-Path -Parent $PSScriptRoot
 
 # Discover wxc-exec.exe -- prefer explicit path, then probe target dirs.
-$Target = "x86_64-pc-windows-msvc"
+$Target = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+    'aarch64-pc-windows-msvc'
+} else {
+    'x86_64-pc-windows-msvc'
+}
 if ($WxcExecPath) {
     $WxcExec = $WxcExecPath
 } else {
diff --git a/tests/scripts/run_wslc_all_tests.ps1 b/tests/scripts/run_wslc_all_tests.ps1
index ca0134306..a665cc183 100644
--- a/tests/scripts/run_wslc_all_tests.ps1
+++ b/tests/scripts/run_wslc_all_tests.ps1
@@ -46,8 +46,13 @@ $ErrorActionPreference = "Stop"
 $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
 $TestConfigs = Join-Path $RepoRoot "tests\configs"
 
-# Find binary -- prefer explicit path, then probe target-specific and default dirs.
-$Target = "x86_64-pc-windows-msvc"
+# Find binary -- prefer explicit path, then probe target-specific and default
+# dirs. Use the host arch to determine which target to use.
+$Target = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+    'aarch64-pc-windows-msvc'
+} else {
+    'x86_64-pc-windows-msvc'
+}
 $Profile = if ($Debug) { "debug" } else { "release" }
 
 if ($WxcExecPath) {
diff --git a/tests/scripts/run_wslc_denied_masking_test.ps1 b/tests/scripts/run_wslc_denied_masking_test.ps1
index 8b0ef923e..cf7fe18e9 100644
--- a/tests/scripts/run_wslc_denied_masking_test.ps1
+++ b/tests/scripts/run_wslc_denied_masking_test.ps1
@@ -1,112 +1,117 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-# WSLC denied-path masking test.
-#
-# WSLC masks a denied path by simply NOT mounting it (see policy_mapping.rs:
-# `build_volume_mounts` maps only readwrite/readonly paths; denied paths are
-# omitted, and `normalize_object_conflicts` tightens same-object aliases to
-# deny). Unlike the Linux LXC/Bubblewrap backends, WSLC does not carve a denied
-# child out of a mounted parent, so this test uses the sibling model: a
-# read-write subdir (`visible`) is mounted as a positive control, while a denied
-# sibling file and a denied sibling directory are left unmounted and must be
-# invisible inside the container.
-#
-# This script owns the on-disk fixture so the config is never run without it
-# (running the config alone would pass for the wrong reason -- the paths simply
-# would not exist).
-#
-# Usage:
-#   .\run_wslc_denied_masking_test.ps1                       # auto-discovers wxc-exec.exe
-#   .\run_wslc_denied_masking_test.ps1 -WxcExecPath <path>   # explicit binary
-#   .\run_wslc_denied_masking_test.ps1 -Debug                # debug build + --debug
-
-param(
-    [switch]$Debug,
-    [string]$WxcExecPath
-)
-
-$ErrorActionPreference = "Stop"
-$RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
-$ConfigPath = Join-Path $RepoRoot "tests\configs\wslc_denied_masking.json"
-
-# Resolve the binary: explicit path, then target-specific and default dirs.
-$Target = "x86_64-pc-windows-msvc"
-$Profile = if ($Debug) { "debug" } else { "release" }
-if ($WxcExecPath) {
-    $WxcExec = $WxcExecPath
-} else {
-    $Candidates = @(
-        (Join-Path $RepoRoot "src\target\$Target\$Profile\wxc-exec.exe"),
-        (Join-Path $RepoRoot "src\target\$Profile\wxc-exec.exe")
-    )
-    $WxcExec = $Candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
-}
-if (-not $WxcExec -or -not (Test-Path $WxcExec)) {
-    Write-Host "ERROR: wxc-exec.exe not found. Build with: cargo build --features wslc --release --target $Target" -ForegroundColor Red
-    exit 1
-}
-
-# Fixed paths must match tests\configs\wslc_denied_masking.json.
-$Base = "C:\wslcmask"
-$VisibleDir = Join-Path $Base "visible"
-$SecretFile = Join-Path $Base "secret_file.txt"
-$SecretDir = Join-Path $Base "secret_dir"
-
-function Remove-Fixture {
-    Remove-Item -Recurse -Force $Base -ErrorAction SilentlyContinue
-}
-
-Remove-Fixture
-try {
-    # Positive control (mounted read-write), plus a denied sibling file and a
-    # denied sibling directory, each holding secret content readable on the host.
-    New-Item -ItemType Directory -Path $VisibleDir -Force | Out-Null
-    New-Item -ItemType Directory -Path $SecretDir -Force | Out-Null
-    Set-Content (Join-Path $VisibleDir "control.txt") "VISIBLE_SECRET"
-    Set-Content $SecretFile "FILE_SECRET"
-    Set-Content (Join-Path $SecretDir "inner.txt") "DIR_SECRET"
-
-    Write-Host "Running WSLC denied-path masking test (denied sibling file + dir left unmounted)..."
-    $wxcArgs = @()
-    if ($Debug) { $wxcArgs += "--debug" }
-    $wxcArgs += $ConfigPath
-
-    $prev = $ErrorActionPreference
-    $ErrorActionPreference = "Continue"
-    $output = & $WxcExec @wxcArgs 2>&1 | Out-String
-    $ErrorActionPreference = $prev
-    Write-Host $output
-
-    $fail = 0
-
-    # Positive control: the mounted sibling must be readable, proving the mount
-    # is present (so masking below is attributable to the deny, not absence).
-    if (($output -match "VISIBLE_OK") -and ($output -notmatch "VISIBLE_MISSING")) {
-        Write-Host "PASS: non-denied sibling readable (mount present)." -ForegroundColor Green
-    } else {
-        Write-Host "FAIL: non-denied sibling not readable - mount missing, test inconclusive." -ForegroundColor Red
-        $fail = 1
-    }
-
-    if (($output -match "FILE_MASKED_OK") -and ($output -notmatch "FILE_LEAK")) {
-        Write-Host "PASS: denied file not mounted (masked)." -ForegroundColor Green
-    } else {
-        Write-Host "FAIL: denied file content leaked." -ForegroundColor Red
-        $fail = 1
-    }
-
-    if (($output -match "DIR_MASKED_OK") -and ($output -notmatch "DIR_LEAK")) {
-        Write-Host "PASS: denied directory not mounted (masked)." -ForegroundColor Green
-    } else {
-        Write-Host "FAIL: denied directory content leaked." -ForegroundColor Red
-        $fail = 1
-    }
-
-    if ($fail -ne 0) { $exit = 1 } else { $exit = 0 }
-} finally {
-    Remove-Fixture
-}
-
-Write-Host "WSLC denied-path masking test complete."
-exit $exit
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+# WSLC denied-path masking test.
+#
+# WSLC masks a denied path by simply NOT mounting it (see policy_mapping.rs:
+# `build_volume_mounts` maps only readwrite/readonly paths; denied paths are
+# omitted, and `normalize_object_conflicts` tightens same-object aliases to
+# deny). Unlike the Linux LXC/Bubblewrap backends, WSLC does not carve a denied
+# child out of a mounted parent, so this test uses the sibling model: a
+# read-write subdir (`visible`) is mounted as a positive control, while a denied
+# sibling file and a denied sibling directory are left unmounted and must be
+# invisible inside the container.
+#
+# This script owns the on-disk fixture so the config is never run without it
+# (running the config alone would pass for the wrong reason -- the paths simply
+# would not exist).
+#
+# Usage:
+#   .\run_wslc_denied_masking_test.ps1                       # auto-discovers wxc-exec.exe
+#   .\run_wslc_denied_masking_test.ps1 -WxcExecPath <path>   # explicit binary
+#   .\run_wslc_denied_masking_test.ps1 -Debug                # debug build + --debug
+
+param(
+    [switch]$Debug,
+    [string]$WxcExecPath
+)
+
+$ErrorActionPreference = "Stop"
+$RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
+$ConfigPath = Join-Path $RepoRoot "tests\configs\wslc_denied_masking.json"
+
+# Resolve the binary: explicit path, then target-specific and default dirs.
+# Use the host arch to determine which target to use.
+$Target = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+    'aarch64-pc-windows-msvc'
+} else {
+    'x86_64-pc-windows-msvc'
+}
+$Profile = if ($Debug) { "debug" } else { "release" }
+if ($WxcExecPath) {
+    $WxcExec = $WxcExecPath
+} else {
+    $Candidates = @(
+        (Join-Path $RepoRoot "src\target\$Target\$Profile\wxc-exec.exe"),
+        (Join-Path $RepoRoot "src\target\$Profile\wxc-exec.exe")
+    )
+    $WxcExec = $Candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
+}
+if (-not $WxcExec -or -not (Test-Path $WxcExec)) {
+    Write-Host "ERROR: wxc-exec.exe not found. Build with: cargo build --features wslc --release --target $Target" -ForegroundColor Red
+    exit 1
+}
+
+# Fixed paths must match tests\configs\wslc_denied_masking.json.
+$Base = "C:\wslcmask"
+$VisibleDir = Join-Path $Base "visible"
+$SecretFile = Join-Path $Base "secret_file.txt"
+$SecretDir = Join-Path $Base "secret_dir"
+
+function Remove-Fixture {
+    Remove-Item -Recurse -Force $Base -ErrorAction SilentlyContinue
+}
+
+Remove-Fixture
+try {
+    # Positive control (mounted read-write), plus a denied sibling file and a
+    # denied sibling directory, each holding secret content readable on the host.
+    New-Item -ItemType Directory -Path $VisibleDir -Force | Out-Null
+    New-Item -ItemType Directory -Path $SecretDir -Force | Out-Null
+    Set-Content (Join-Path $VisibleDir "control.txt") "VISIBLE_SECRET"
+    Set-Content $SecretFile "FILE_SECRET"
+    Set-Content (Join-Path $SecretDir "inner.txt") "DIR_SECRET"
+
+    Write-Host "Running WSLC denied-path masking test (denied sibling file + dir left unmounted)..."
+    $wxcArgs = @()
+    if ($Debug) { $wxcArgs += "--debug" }
+    $wxcArgs += $ConfigPath
+
+    $prev = $ErrorActionPreference
+    $ErrorActionPreference = "Continue"
+    $output = & $WxcExec @wxcArgs 2>&1 | Out-String
+    $ErrorActionPreference = $prev
+    Write-Host $output
+
+    $fail = 0
+
+    # Positive control: the mounted sibling must be readable, proving the mount
+    # is present (so masking below is attributable to the deny, not absence).
+    if (($output -match "VISIBLE_OK") -and ($output -notmatch "VISIBLE_MISSING")) {
+        Write-Host "PASS: non-denied sibling readable (mount present)." -ForegroundColor Green
+    } else {
+        Write-Host "FAIL: non-denied sibling not readable - mount missing, test inconclusive." -ForegroundColor Red
+        $fail = 1
+    }
+
+    if (($output -match "FILE_MASKED_OK") -and ($output -notmatch "FILE_LEAK")) {
+        Write-Host "PASS: denied file not mounted (masked)." -ForegroundColor Green
+    } else {
+        Write-Host "FAIL: denied file content leaked." -ForegroundColor Red
+        $fail = 1
+    }
+
+    if (($output -match "DIR_MASKED_OK") -and ($output -notmatch "DIR_LEAK")) {
+        Write-Host "PASS: denied directory not mounted (masked)." -ForegroundColor Green
+    } else {
+        Write-Host "FAIL: denied directory content leaked." -ForegroundColor Red
+        $fail = 1
+    }
+
+    if ($fail -ne 0) { $exit = 1 } else { $exit = 0 }
+} finally {
+    Remove-Fixture
+}
+
+Write-Host "WSLC denied-path masking test complete."
+exit $exit
diff --git a/tests/scripts/run_wslc_dotdot_alias_test.ps1 b/tests/scripts/run_wslc_dotdot_alias_test.ps1
index 114713f23..1e4b83fa9 100644
--- a/tests/scripts/run_wslc_dotdot_alias_test.ps1
+++ b/tests/scripts/run_wslc_dotdot_alias_test.ps1
@@ -32,8 +32,13 @@ $ErrorActionPreference = "Stop"
 $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
 $ConfigPath = Join-Path $RepoRoot "tests\configs\wslc_denied_dotdot_alias.json"
 
-# Resolve the binary: explicit path, then target-specific and default dirs.
-$Target = "x86_64-pc-windows-msvc"
+# Find binary -- prefer explicit path, then probe target-specific and default
+# dirs. Use the host arch to determine which target to use. 
+$Target = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+    'aarch64-pc-windows-msvc'
+} else {
+    'x86_64-pc-windows-msvc'
+}
 $Profile = if ($Debug) { "debug" } else { "release" }
 if ($WxcExecPath) {
     $WxcExec = $WxcExecPath
diff --git a/tests/scripts/run_wslc_most_specific_test.ps1 b/tests/scripts/run_wslc_most_specific_test.ps1
index 9b1281296..2d4c12fe9 100644
--- a/tests/scripts/run_wslc_most_specific_test.ps1
+++ b/tests/scripts/run_wslc_most_specific_test.ps1
@@ -1,90 +1,95 @@
-# Copyright (c) Microsoft Corporation.
-# Licensed under the MIT License.
-
-# WSLC most-specific-path-wins test (denied parent, read-write child).
-#
-# The Linux LXC/Bubblewrap backends realise most-specific-wins via ordered bind
-# mounts. WSLC reaches the SAME observable outcome by a different mechanism: it
-# mounts each read-write path as its own volume and leaves denied paths
-# unmounted (see policy_mapping.rs `build_volume_mounts`). Mounting the specific
-# read-write child (`data\secret_child`) while denying its parent (`data`) means
-# the child is present and writable inside the container, while a sibling under
-# the (unmounted) denied parent is invisible.
-#
-# This script owns the on-disk fixture so the config is never run without it.
-#
-# Usage:
-#   .\run_wslc_most_specific_test.ps1                       # auto-discovers wxc-exec.exe
-#   .\run_wslc_most_specific_test.ps1 -WxcExecPath <path>   # explicit binary
-#   .\run_wslc_most_specific_test.ps1 -Debug                # debug build + --debug
-
-param(
-    [switch]$Debug,
-    [string]$WxcExecPath
-)
-
-$ErrorActionPreference = "Stop"
-$RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
-$ConfigPath = Join-Path $RepoRoot "tests\configs\wslc_most_specific_denied_parent.json"
-
-# Resolve the binary: explicit path, then target-specific and default dirs.
-$Target = "x86_64-pc-windows-msvc"
-$Profile = if ($Debug) { "debug" } else { "release" }
-if ($WxcExecPath) {
-    $WxcExec = $WxcExecPath
-} else {
-    $Candidates = @(
-        (Join-Path $RepoRoot "src\target\$Target\$Profile\wxc-exec.exe"),
-        (Join-Path $RepoRoot "src\target\$Profile\wxc-exec.exe")
-    )
-    $WxcExec = $Candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
-}
-if (-not $WxcExec -or -not (Test-Path $WxcExec)) {
-    Write-Host "ERROR: wxc-exec.exe not found. Build with: cargo build --features wslc --release --target $Target" -ForegroundColor Red
-    exit 1
-}
-
-# Fixed paths must match tests\configs\wslc_most_specific_denied_parent.json.
-$Base = "C:\wslcmsp"
-$DataDir = Join-Path $Base "data"
-$ChildDir = Join-Path $DataDir "secret_child"
-
-function Remove-Fixture {
-    Remove-Item -Recurse -Force $Base -ErrorAction SilentlyContinue
-}
-
-Remove-Fixture
-try {
-    # Read-write child (mounted) with a keeper secret, plus a sibling secret
-    # under the denied parent (left unmounted, must be masked).
-    New-Item -ItemType Directory -Path $ChildDir -Force | Out-Null
-    Set-Content (Join-Path $ChildDir "keep.txt") "CHILD_KEPT"
-    Set-Content (Join-Path $DataDir "sibling.txt") "PARENT_SECRET"
-
-    Write-Host "Running WSLC most-specific test (denied parent, rw child)..."
-    $wxcArgs = @()
-    if ($Debug) { $wxcArgs += "--debug" }
-    $wxcArgs += $ConfigPath
-
-    $prev = $ErrorActionPreference
-    $ErrorActionPreference = "Continue"
-    $output = & $WxcExec @wxcArgs 2>&1 | Out-String
-    $ErrorActionPreference = $prev
-    Write-Host $output
-
-    if (($output -match "CHILD_OK") -and ($output -match "CHILD_WRITE_OK") `
-            -and ($output -match "PARENT_MASKED_OK") `
-            -and ($output -notmatch "CHILD_MISSING") -and ($output -notmatch "CHILD_WRITE_FAIL") `
-            -and ($output -notmatch "PARENT_LEAK")) {
-        Write-Host "PASS: rw child mounted and writable; denied parent sibling masked." -ForegroundColor Green
-        $exit = 0
-    } else {
-        Write-Host "FAIL: most-specific rw child did not win over denied parent." -ForegroundColor Red
-        $exit = 1
-    }
-} finally {
-    Remove-Fixture
-}
-
-Write-Host "WSLC most-specific-path-wins test complete."
-exit $exit
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT License.
+
+# WSLC most-specific-path-wins test (denied parent, read-write child).
+#
+# The Linux LXC/Bubblewrap backends realise most-specific-wins via ordered bind
+# mounts. WSLC reaches the SAME observable outcome by a different mechanism: it
+# mounts each read-write path as its own volume and leaves denied paths
+# unmounted (see policy_mapping.rs `build_volume_mounts`). Mounting the specific
+# read-write child (`data\secret_child`) while denying its parent (`data`) means
+# the child is present and writable inside the container, while a sibling under
+# the (unmounted) denied parent is invisible.
+#
+# This script owns the on-disk fixture so the config is never run without it.
+#
+# Usage:
+#   .\run_wslc_most_specific_test.ps1                       # auto-discovers wxc-exec.exe
+#   .\run_wslc_most_specific_test.ps1 -WxcExecPath <path>   # explicit binary
+#   .\run_wslc_most_specific_test.ps1 -Debug                # debug build + --debug
+
+param(
+    [switch]$Debug,
+    [string]$WxcExecPath
+)
+
+$ErrorActionPreference = "Stop"
+$RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
+$ConfigPath = Join-Path $RepoRoot "tests\configs\wslc_most_specific_denied_parent.json"
+
+# Resolve the binary: explicit path, then target-specific and default dirs.
+# Use the host arch to determine which target to use.
+$Target = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+    'aarch64-pc-windows-msvc'
+} else {
+    'x86_64-pc-windows-msvc'
+}
+$Profile = if ($Debug) { "debug" } else { "release" }
+if ($WxcExecPath) {
+    $WxcExec = $WxcExecPath
+} else {
+    $Candidates = @(
+        (Join-Path $RepoRoot "src\target\$Target\$Profile\wxc-exec.exe"),
+        (Join-Path $RepoRoot "src\target\$Profile\wxc-exec.exe")
+    )
+    $WxcExec = $Candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
+}
+if (-not $WxcExec -or -not (Test-Path $WxcExec)) {
+    Write-Host "ERROR: wxc-exec.exe not found. Build with: cargo build --features wslc --release --target $Target" -ForegroundColor Red
+    exit 1
+}
+
+# Fixed paths must match tests\configs\wslc_most_specific_denied_parent.json.
+$Base = "C:\wslcmsp"
+$DataDir = Join-Path $Base "data"
+$ChildDir = Join-Path $DataDir "secret_child"
+
+function Remove-Fixture {
+    Remove-Item -Recurse -Force $Base -ErrorAction SilentlyContinue
+}
+
+Remove-Fixture
+try {
+    # Read-write child (mounted) with a keeper secret, plus a sibling secret
+    # under the denied parent (left unmounted, must be masked).
+    New-Item -ItemType Directory -Path $ChildDir -Force | Out-Null
+    Set-Content (Join-Path $ChildDir "keep.txt") "CHILD_KEPT"
+    Set-Content (Join-Path $DataDir "sibling.txt") "PARENT_SECRET"
+
+    Write-Host "Running WSLC most-specific test (denied parent, rw child)..."
+    $wxcArgs = @()
+    if ($Debug) { $wxcArgs += "--debug" }
+    $wxcArgs += $ConfigPath
+
+    $prev = $ErrorActionPreference
+    $ErrorActionPreference = "Continue"
+    $output = & $WxcExec @wxcArgs 2>&1 | Out-String
+    $ErrorActionPreference = $prev
+    Write-Host $output
+
+    if (($output -match "CHILD_OK") -and ($output -match "CHILD_WRITE_OK") `
+            -and ($output -match "PARENT_MASKED_OK") `
+            -and ($output -notmatch "CHILD_MISSING") -and ($output -notmatch "CHILD_WRITE_FAIL") `
+            -and ($output -notmatch "PARENT_LEAK")) {
+        Write-Host "PASS: rw child mounted and writable; denied parent sibling masked." -ForegroundColor Green
+        $exit = 0
+    } else {
+        Write-Host "FAIL: most-specific rw child did not win over denied parent." -ForegroundColor Red
+        $exit = 1
+    }
+} finally {
+    Remove-Fixture
+}
+
+Write-Host "WSLC most-specific-path-wins test complete."
+exit $exit
\ No newline at end of file
diff --git a/tests/scripts/run_wslc_object_test.ps1 b/tests/scripts/run_wslc_object_test.ps1
index 006b10fc2..a2cf06cb5 100644
--- a/tests/scripts/run_wslc_object_test.ps1
+++ b/tests/scripts/run_wslc_object_test.ps1
@@ -28,8 +28,13 @@ $ErrorActionPreference = "Stop"
 $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
 $ConfigPath = Join-Path $RepoRoot "tests\configs\wslc_filesystem_object.json"
 
-# Resolve the binary: explicit path, then target-specific and default dirs.
-$Target = "x86_64-pc-windows-msvc"
+# Find binary -- prefer explicit path, then probe target-specific and default
+# dirs. Use the host arch to determine which target to use. 
+$Target = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+    'aarch64-pc-windows-msvc'
+} else {
+    'x86_64-pc-windows-msvc'
+}
 $Profile = if ($Debug) { "debug" } else { "release" }
 if ($WxcExecPath) {
     $WxcExec = $WxcExecPath
diff --git a/tests/scripts/run_wslc_proxy_test.ps1 b/tests/scripts/run_wslc_proxy_test.ps1
index 1c17c3c3e..cc32edc14 100644
--- a/tests/scripts/run_wslc_proxy_test.ps1
+++ b/tests/scripts/run_wslc_proxy_test.ps1
@@ -37,8 +37,13 @@ $ErrorActionPreference = "Stop"
 $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
 $ConfigPath = Join-Path $RepoRoot "tests\configs\wslc_network_proxy.json"
 
-# Resolve the binary: explicit path, then target-specific and default dirs.
-$Target = "x86_64-pc-windows-msvc"
+# Find binary -- prefer explicit path, then probe target-specific and default
+# dirs. Use the host arch to determine which target to use. 
+$Target = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+    'aarch64-pc-windows-msvc'
+} else {
+    'x86_64-pc-windows-msvc'
+}
 $Profile = if ($Debug) { "debug" } else { "release" }
 if ($WxcExecPath) {
     $WxcExec = $WxcExecPath
diff --git a/tests/scripts/run_wslc_state_aware_tests.ps1 b/tests/scripts/run_wslc_state_aware_tests.ps1
index 70bd5a5e8..7605b358f 100644
--- a/tests/scripts/run_wslc_state_aware_tests.ps1
+++ b/tests/scripts/run_wslc_state_aware_tests.ps1
@@ -37,7 +37,7 @@
     provision so the spawned daemon inherits them.
 
 .PARAMETER WxcExecPath
-    Path to wxc-exec.exe. Default probes the x64 target release/debug dirs.
+    Path to wxc-exec.exe. Default probes the host-arch target release/debug dirs.
 
 .PARAMETER ConfigDir
     Directory holding the state-aware request fixtures. Defaults to
@@ -66,7 +66,13 @@ $RepoRoot = Split-Path -Parent (Split-Path -Parent $PSScriptRoot)
 
 # ---------------- Locate wxc-exec.exe + daemon ----------------
 
-$Target = "x86_64-pc-windows-msvc"
+# Find binary -- prefer explicit path, then probe target-specific and default
+# dirs. Use the host arch to determine which target to use. 
+$Target = if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') {
+    'aarch64-pc-windows-msvc'
+} else {
+    'x86_64-pc-windows-msvc'
+}
 $Prof = if ($Debug) { "debug" } else { "release" }
 
 if ($WxcExecPath) {