diff --git a/hermes_cli/doctor_platform.py b/hermes_cli/doctor_platform.py
index 71894ddd19..66b8d8761b 100644
--- a/hermes_cli/doctor_platform.py
+++ b/hermes_cli/doctor_platform.py
@@ -380,7 +380,7 @@ def _macos_desktop_dr(app: Path) -> str | None:
     if not codesign:
         return None
     try:
-        proc = subprocess.run([codesign, "-d", "--requirements", "-", str(app)], capture_output=True, text=True, timeout=15)
+        proc = subprocess.run([codesign, "-d", "--requirements", "-", str(app)], capture_output=True, text=True, encoding="utf-8", errors="replace", timeout=15)
     except (FileNotFoundError, subprocess.TimeoutExpired):
         return None
     if proc.returncode != 0:
diff --git a/tools/computer_use/cua_backend.py b/tools/computer_use/cua_backend.py
index 135f70cc3b..bae3bcd8dd 100644
--- a/tools/computer_use/cua_backend.py
+++ b/tools/computer_use/cua_backend.py
@@ -184,8 +184,8 @@ def _linux_session_locked() -> Optional[bool]:
         return None
 
     def _loginctl(*args: str) -> subprocess.CompletedProcess:
-        return subprocess.run(["loginctl", *args], capture_output=True, text=True,
-                              timeout=2.0, stdin=subprocess.DEVNULL)
+        return subprocess.run(["loginctl", *args], capture_output=True, text=True, encoding="utf-8",
+                              errors="replace", timeout=2.0, stdin=subprocess.DEVNULL)
 
     try:
         proc = _loginctl("list-sessions", "--no-legend")
diff --git a/tools/computer_use/cua_backend_daemon.py b/tools/computer_use/cua_backend_daemon.py
index 87c4735c6e..e379271113 100644
--- a/tools/computer_use/cua_backend_daemon.py
+++ b/tools/computer_use/cua_backend_daemon.py
@@ -49,8 +49,8 @@ def _validate_cua_driver_app_signature(app_path: str) -> None:
     if not codesign:
         raise RuntimeError("codesign is required to verify CuaDriver.app before launching it.")
     try:
-        proc = subprocess.run([codesign, "-dv", app_path], capture_output=True, text=True, timeout=15,
-                              stdin=subprocess.DEVNULL)
+        proc = subprocess.run([codesign, "-dv", app_path], capture_output=True, text=True, encoding="utf-8",
+                              errors="replace", timeout=15, stdin=subprocess.DEVNULL)
     except (OSError, subprocess.TimeoutExpired) as exc:
         raise RuntimeError(f"could not verify CuaDriver.app signature: {exc}") from exc
     if proc.returncode != 0: