diff --git a/package.json b/package.json
index 5de7738090..f13d8c5172 100644
--- a/package.json
+++ b/package.json
@@ -31,10 +31,14 @@
     "install:ci": "concurrently -g -c auto -n install:fw:ci \"yarn install --inline-builds\" npm:install:crwrsca:ci",
     "install:crwrsca": "yarn --cwd packages/create-cedar-rsc-app install",
     "install:crwrsca:ci": "yarn --cwd packages/create-cedar-rsc-app install --inline-builds",
-    "lint": "concurrently -c auto npm:lint:fw npm:lint:crwrsca",
+    "lint": "concurrently -c auto npm:lint:fw npm:lint:templates npm:lint:crwrsca",
     "lint:crwrsca": "yarn --cwd packages/create-cedar-rsc-app run lint",
-    "lint:fix": "yarn lint --fix",
-    "lint:fw": "cross-env RWJS_CWD=packages/create-cedar-app/templates/ts eslint --config .eslintrc.js --ignore-pattern Routes.jsx --ignore-pattern create-cedar-rsc-app packages",
+    "lint:crwrsca:fix": "yarn --cwd packages/create-cedar-rsc-app run lint --fix",
+    "lint:fix": "concurrently -c auto npm:lint:fw:fix npm:lint:templates:fix npm:lint:crwrsca:fix",
+    "lint:fw": "eslint --config .eslintrc.js --ignore-pattern Routes.jsx --ignore-pattern create-cedar-rsc-app --ignore-pattern packages/create-cedar-app/templates --no-eslintrc packages",
+    "lint:fw:fix": "eslint --config .eslintrc.js --ignore-pattern Routes.jsx --ignore-pattern create-cedar-rsc-app --ignore-pattern packages/create-cedar-app/templates --no-eslintrc packages --fix",
+    "lint:templates": "concurrently -c auto \"cd packages/create-cedar-app/templates/ts && npx eslint .\" \"cd packages/create-cedar-app/templates/js && npx eslint .\" \"cd packages/create-cedar-app/templates/esm-ts && npx eslint .\" \"cd packages/create-cedar-app/templates/esm-js && npx eslint .\"",
+    "lint:templates:fix": "concurrently -c auto \"cd packages/create-cedar-app/templates/ts && npx eslint . --fix\" \"cd packages/create-cedar-app/templates/js && npx eslint . --fix\" \"cd packages/create-cedar-app/templates/esm-ts && npx eslint . --fix\" \"cd packages/create-cedar-app/templates/esm-js && npx eslint . --fix\"",
     "project:copy": "node ./tasks/framework-tools/frameworkFilesToProject.mjs",
     "project:deps": "node ./tasks/framework-tools/frameworkDepsToProject.mjs",
     "project:sync": "node ./tasks/framework-tools/frameworkSyncToProject.mjs",
diff --git a/packages/cli/src/commands/__tests__/test.test.js b/packages/cli/src/commands/__tests__/test.test.js
index 05bf788a51..efa03209f2 100644
--- a/packages/cli/src/commands/__tests__/test.test.js
+++ b/packages/cli/src/commands/__tests__/test.test.js
@@ -39,7 +39,8 @@ afterEach(() => {
 test('Runs tests for all available sides if no filter passed', async () => {
   await handler({})
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
   expect(execa.mock.results[0].value.params).toContain('web')
   expect(execa.mock.results[0].value.params).toContain('api')
 })
@@ -50,9 +51,10 @@ test('Syncs or creates test database when the flag --db-push is set to true', as
     dbPush: true,
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
-
-  expect(execa.mock.results[0].value.params).toContain('--projects', 'api')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
+  expect(execa.mock.results[0].value.params).toContain('--projects')
+  expect(execa.mock.results[0].value.params).toContain('api')
 })
 
 test('Skips test database sync/creation when the flag --db-push is set to false', async () => {
@@ -61,7 +63,8 @@ test('Skips test database sync/creation when the flag --db-push is set to false'
     dbPush: false,
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
 })
 
 test('Runs tests for all available sides if no side filter passed', async () => {
@@ -69,7 +72,8 @@ test('Runs tests for all available sides if no side filter passed', async () =>
     filter: ['bazinga'],
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
   expect(execa.mock.results[0].value.params).toContain('bazinga')
   expect(execa.mock.results[0].value.params).toContain('web')
   expect(execa.mock.results[0].value.params).toContain('api')
@@ -83,7 +87,8 @@ test('Runs tests specified side if even with additional filters', async () => {
   expect(execa.mock.results[0].value.cmd).not.toBe('yarn rw')
   expect(execa.mock.results[0].value.params).not.toContain('api')
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
   expect(execa.mock.results[0].value.params).toContain('bazinga')
   expect(execa.mock.results[0].value.params).toContain('web')
 })
@@ -93,7 +98,8 @@ test('Does not create db when calling test with just web', async () => {
     filter: ['web'],
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
 })
 
 test('Passes filter param to jest command if passed', async () => {
@@ -101,7 +107,8 @@ test('Passes filter param to jest command if passed', async () => {
     filter: ['web', 'bazinga'],
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
   expect(execa.mock.results[0].value.params).toContain('bazinga')
 })
 
@@ -113,7 +120,8 @@ test('Passes other flags to jest', async () => {
     collectCoverage: true,
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
   expect(execa.mock.results[0].value.params).toContain('-u')
   expect(execa.mock.results[0].value.params).toContain('--debug')
   expect(execa.mock.results[0].value.params).toContain('--json')
@@ -127,7 +135,8 @@ test('Passes values of other flags to jest', async () => {
   })
 
   // Second command because api side runs
-  expect(execa.mock.results[0].value.cmd).toBe('yarn jest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('jest')
 
   // Note that these below tests aren't the best, since they don't check for order
   // But I'm making sure only 2 extra params get passed
diff --git a/packages/cli/src/commands/__tests__/testEsm.test.js b/packages/cli/src/commands/__tests__/testEsm.test.js
index c434ae4068..59f54f506e 100644
--- a/packages/cli/src/commands/__tests__/testEsm.test.js
+++ b/packages/cli/src/commands/__tests__/testEsm.test.js
@@ -28,7 +28,8 @@ afterEach(() => {
 test('Runs tests for all available sides if no filter passed', async () => {
   await handler({})
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('vitest')
   expect(execa.mock.results[0].value.params).toContain('web')
   expect(execa.mock.results[0].value.params).toContain('api')
 })
@@ -39,8 +40,9 @@ test('Syncs or creates test database when the flag --db-push is set to true', as
     dbPush: true,
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
 
+  expect(execa.mock.results[0].value.params).toContain('vitest')
   expect(execa.mock.results[0].value.params).toEqual(
     expect.arrayContaining(['--project', 'api']),
   )
@@ -52,7 +54,8 @@ test('Skips test database sync/creation when the flag --db-push is set to false'
     dbPush: false,
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('vitest')
 })
 
 test('Runs tests for all available sides if no side filter passed', async () => {
@@ -60,7 +63,8 @@ test('Runs tests for all available sides if no side filter passed', async () =>
     filter: ['bazinga'],
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('vitest')
   expect(execa.mock.results[0].value.params).toContain('bazinga')
   expect(execa.mock.results[0].value.params).toContain('web')
   expect(execa.mock.results[0].value.params).toContain('api')
@@ -74,7 +78,8 @@ test('Runs tests specified side even with additional filters', async () => {
   expect(execa.mock.results[0].value.cmd).not.toBe('yarn rw')
   expect(execa.mock.results[0].value.params).not.toContain('api')
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('vitest')
   expect(execa.mock.results[0].value.params).toContain('bazinga')
   expect(execa.mock.results[0].value.params).toContain('web')
 })
@@ -84,7 +89,8 @@ test('Does not create db when calling test with just web', async () => {
     filter: ['web'],
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('vitest')
 })
 
 test('Passes filter param to vitest command if passed', async () => {
@@ -92,7 +98,8 @@ test('Passes filter param to vitest command if passed', async () => {
     filter: ['web', 'bazinga'],
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('vitest')
   expect(execa.mock.results[0].value.params).toContain('bazinga')
 })
 
@@ -105,7 +112,8 @@ test('Passes other flags to vitest', async () => {
     watch: true,
   })
 
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('vitest')
   expect(execa.mock.results[0].value.params).toContain('-u')
   expect(execa.mock.results[0].value.params).toContain('--debug')
   expect(execa.mock.results[0].value.params).toContain('--json')
@@ -120,7 +128,8 @@ test('Passes values of other flags to vitest', async () => {
   })
 
   // Second command because api side runs
-  expect(execa.mock.results[0].value.cmd).toBe('yarn vitest')
+  expect(execa.mock.results[0].value.cmd).toBe('yarn')
+  expect(execa.mock.results[0].value.params).toContain('vitest')
 
   // Note that these below tests aren't the best, since they don't check for order
   // But I'm making sure only 2 extra params get passed
diff --git a/packages/cli/src/commands/generate.js b/packages/cli/src/commands/generate.js
index 41e7412d9b..b63f21a271 100644
--- a/packages/cli/src/commands/generate.js
+++ b/packages/cli/src/commands/generate.js
@@ -28,11 +28,10 @@ export const description = 'Generate boilerplate code and type definitions'
 export const builder = (yargs) =>
   yargs
     .command('types', 'Generate supplementary code', {}, () => {
-      recordTelemetryAttributes({
-        command: 'generate types',
-      })
+      recordTelemetryAttributes({ command: 'generate types' })
+
       try {
-        execa.sync('yarn rw-gen', { shell: true, stdio: 'inherit' })
+        execa.sync('yarn', ['rw-gen'], { stdio: 'inherit' })
       } catch (error) {
         // rw-gen is responsible for logging its own errors but we need to
         // make sure we exit with a non-zero exit code
diff --git a/packages/cli/src/commands/generate/directive/directiveHandler.js b/packages/cli/src/commands/generate/directive/directiveHandler.js
index fe73381316..8d07458f12 100644
--- a/packages/cli/src/commands/generate/directive/directiveHandler.js
+++ b/packages/cli/src/commands/generate/directive/directiveHandler.js
@@ -153,15 +153,10 @@ export const handler = async (args) => {
         task: () => {
           // Regenerate again at the end if we rollback changes
           addFunctionToRollback(async () => {
-            await execa('yarn rw-gen', [], {
-              stdio: 'pipe',
-              shell: true,
-            })
+            await execa('yarn', ['rw-gen'], { stdio: 'pipe' })
           }, true)
-          return execa('yarn rw-gen', [], {
-            stdio: 'inherit',
-            shell: true,
-          })
+
+          return execa('yarn', ['rw-gen'], { stdio: 'inherit' })
         },
       },
       {
diff --git a/packages/cli/src/commands/lint.js b/packages/cli/src/commands/lint.js
index ee45205ad3..122a624787 100644
--- a/packages/cli/src/commands/lint.js
+++ b/packages/cli/src/commands/lint.js
@@ -40,24 +40,23 @@ export const handler = async ({ path, fix, format }) => {
   try {
     const pathString = path?.join(' ')
     const sbPath = getPaths().web.storybook
-    const result = await execa(
-      'yarn eslint',
-      [
-        fix && '--fix',
-        `--format ${format}`,
-        !pathString && fs.existsSync(getPaths().web.src) && 'web/src',
-        !pathString && fs.existsSync(getPaths().web.config) && 'web/config',
-        !pathString && fs.existsSync(sbPath) && 'web/.storybook',
-        !pathString && fs.existsSync(getPaths().scripts) && 'scripts',
-        !pathString && fs.existsSync(getPaths().api.src) && 'api/src',
-        pathString,
-      ].filter(Boolean),
-      {
-        cwd: getPaths().base,
-        shell: true,
-        stdio: 'inherit',
-      },
-    )
+    const args = [
+      'eslint',
+      fix && '--fix',
+      '--format',
+      format,
+      !pathString && fs.existsSync(getPaths().web.src) && 'web/src',
+      !pathString && fs.existsSync(getPaths().web.config) && 'web/config',
+      !pathString && fs.existsSync(sbPath) && 'web/.storybook',
+      !pathString && fs.existsSync(getPaths().scripts) && 'scripts',
+      !pathString && fs.existsSync(getPaths().api.src) && 'api/src',
+      pathString,
+    ].filter(Boolean)
+
+    const result = await execa('yarn', args, {
+      cwd: getPaths().base,
+      stdio: 'inherit',
+    })
 
     process.exitCode = result.exitCode
   } catch (error) {
diff --git a/packages/cli/src/commands/prismaHandler.js b/packages/cli/src/commands/prismaHandler.js
index 61f8b17669..ea0891acc2 100644
--- a/packages/cli/src/commands/prismaHandler.js
+++ b/packages/cli/src/commands/prismaHandler.js
@@ -70,16 +70,12 @@ export const handler = async ({ _, $0, commands = [], ...options }) => {
   console.log()
 
   try {
-    execa.sync(
-      `"${path.join(rwjsPaths.base, 'node_modules/.bin/prisma')}"`,
-      args,
-      {
-        shell: true,
-        cwd: rwjsPaths.base,
-        stdio: 'inherit',
-        cleanup: true,
-      },
-    )
+    const prismaBin = path.join(rwjsPaths.base, 'node_modules/.bin/prisma')
+    execa.sync(prismaBin, args, {
+      cwd: rwjsPaths.base,
+      stdio: 'inherit',
+      cleanup: true,
+    })
 
     if (hasHelpOption || commands.length === 0) {
       printWrapInfo()
diff --git a/packages/cli/src/commands/serveBothHandler.js b/packages/cli/src/commands/serveBothHandler.js
index c654f3d9dc..e7fa0d90c6 100644
--- a/packages/cli/src/commands/serveBothHandler.js
+++ b/packages/cli/src/commands/serveBothHandler.js
@@ -25,7 +25,6 @@ export const bothServerFileHandler = async (argv) => {
     await execa('yarn', ['rw-serve-fe'], {
       cwd: getPaths().web.base,
       stdio: 'inherit',
-      shell: true,
     })
   } else {
     argv.apiPort ??= getAPIPort()
@@ -91,7 +90,6 @@ export const bothSsrRscServerHandler = async (argv, rscEnabled) => {
   const fePromise = execa('yarn', ['rw-serve-fe'], {
     cwd: getPaths().web.base,
     stdio: 'inherit',
-    shell: true,
     env: rscEnabled
       ? {
           // TODO (RSC): Is this how we want to do it? If so, we need to find a way
diff --git a/packages/cli/src/commands/serveWebHandler.js b/packages/cli/src/commands/serveWebHandler.js
index f19416af4c..b29dc895a9 100644
--- a/packages/cli/src/commands/serveWebHandler.js
+++ b/packages/cli/src/commands/serveWebHandler.js
@@ -6,7 +6,6 @@ export const webSsrServerHandler = async (rscEnabled) => {
   await execa('yarn', ['rw-serve-fe'], {
     cwd: getPaths().web.base,
     stdio: 'inherit',
-    shell: true,
     env: rscEnabled
       ? {
           // TODO (RSC): Is this how we want to do it? If so, we need to find a way
diff --git a/packages/cli/src/commands/testHandler.js b/packages/cli/src/commands/testHandler.js
index 77c463c176..411a87ae5b 100644
--- a/packages/cli/src/commands/testHandler.js
+++ b/packages/cli/src/commands/testHandler.js
@@ -151,9 +151,8 @@ export const handler = async ({
     // so we're running it via execa, since `jest.run()` is a bit unstable.
     // https://github.com/facebook/jest/issues/5048
     const runCommand = async () => {
-      await execa('yarn jest', jestArgs, {
+      await execa('yarn', ['jest', ...jestArgs], {
         cwd: rwjsPaths.base,
-        shell: true,
         stdio: 'inherit',
         env: { DATABASE_URL },
       })
diff --git a/packages/cli/src/commands/testHandlerEsm.js b/packages/cli/src/commands/testHandlerEsm.js
index 29602005db..2cc35d83ad 100644
--- a/packages/cli/src/commands/testHandlerEsm.js
+++ b/packages/cli/src/commands/testHandlerEsm.js
@@ -85,9 +85,8 @@ export const handler = async ({
 
     // TODO: Run vitest programmatically. See https://vitest.dev/advanced/api/
     const runCommand = async () => {
-      await execa('yarn vitest', vitestArgs, {
+      await execa('yarn', ['vitest', ...vitestArgs], {
         cwd: rwjsPaths.base,
-        shell: true,
         stdio: 'inherit',
         env: { DATABASE_URL },
       })
diff --git a/packages/cli/src/rwfw.js b/packages/cli/src/rwfw.js
index 211bd33b1e..3ea42b8cee 100644
--- a/packages/cli/src/rwfw.js
+++ b/packages/cli/src/rwfw.js
@@ -47,9 +47,11 @@ if (!command.length || command.some((cmd) => helpCommands.includes(cmd))) {
 }
 
 try {
+  // This used to look like `execa.sync('yarn', [...command], {`, but then Node
+  // deprecated passing args in that way.
+  // See https://nodejs.org/api/deprecations.html#DEP0190
   execa.sync('yarn', [...command], {
     stdio: 'inherit',
-    shell: true,
     cwd: absRwFwPath,
     env: {
       RWJS_CWD: projectPath,
diff --git a/packages/create-cedar-app/src/create-cedar-app.js b/packages/create-cedar-app/src/create-cedar-app.js
index 4f2211ee42..f490661263 100644
--- a/packages/create-cedar-app/src/create-cedar-app.js
+++ b/packages/create-cedar-app/src/create-cedar-app.js
@@ -329,10 +329,7 @@ async function initializeGit(newAppDir, commitMessage) {
 
   const gitSubprocess = execa(
     `git init && git add . && git commit -m "${commitMessage}"`,
-    {
-      shell: true,
-      cwd: newAppDir,
-    },
+    { shell: true, cwd: newAppDir },
   )
 
   try {
diff --git a/packages/internal/src/generate/graphqlCodeGen.ts b/packages/internal/src/generate/graphqlCodeGen.ts
index a0595eb568..d984dc3f3b 100644
--- a/packages/internal/src/generate/graphqlCodeGen.ts
+++ b/packages/internal/src/generate/graphqlCodeGen.ts
@@ -240,7 +240,7 @@ async function getPrismaClient(hasGenerated = false): Promise<{
     if (hasGenerated) {
       return { ModelName: {} }
     } else {
-      execa.sync('yarn rw prisma generate', { shell: true })
+      execa.sync('yarn', ['rw', 'prisma', 'generate'])
 
       // Import the newly generated Prisma client. To make sure we actually get
       // the newly generated Prisma client we pass `true` for `hasGenerated` so
diff --git a/packages/telemetry/src/telemetry.ts b/packages/telemetry/src/telemetry.ts
index 91149cd178..7dfcce87c3 100644
--- a/packages/telemetry/src/telemetry.ts
+++ b/packages/telemetry/src/telemetry.ts
@@ -6,38 +6,45 @@ import path from 'path'
 import { getPaths } from '@cedarjs/project-config'
 
 const spawnProcess = (...args: string[]) => {
-  // "os.type()" returns 'Windows_NT' on Windows. See https://nodejs.org/docs/latest-v12.x/api/os.html#os_os_type.
-  const execPath =
-    os.type() === 'Windows_NT' ? `"${process.execPath}"` : process.execPath
-  const spawnOptions: Partial<SpawnOptions> =
-    os.type() === 'Windows_NT'
-      ? {
-          stdio: process.env.REDWOOD_VERBOSE_TELEMETRY
-            ? ['ignore', 'inherit', 'inherit']
-            : 'ignore',
-          // The following options run the process in the background without a console window, even though they don't look like they would.
-          // See https://github.com/nodejs/node/issues/21825#issuecomment-503766781 for information
-          detached: false,
-          windowsHide: false,
-          shell: true,
-        }
-      : {
-          stdio: process.env.REDWOOD_VERBOSE_TELEMETRY
-            ? ['ignore', 'inherit', 'inherit']
-            : 'ignore',
-          detached: process.env.REDWOOD_VERBOSE_TELEMETRY ? false : true,
-          windowsHide: true,
-        }
-  spawn(
-    execPath,
-    [
-      path.join(__dirname, 'scripts', 'invoke.js'),
-      ...args,
-      '--root',
-      getPaths().base,
-    ],
-    spawnOptions,
-  ).unref()
+  // "os.type()" returns 'Windows_NT' on Windows.
+  // See https://nodejs.org/docs/latest-v12.x/api/os.html#os_os_type.
+  const isWindows = os.type() === 'Windows_NT'
+  const execPath = isWindows ? `"${process.execPath}"` : process.execPath
+
+  const spawnOptions: Partial<SpawnOptions> = isWindows
+    ? {
+        stdio: process.env.REDWOOD_VERBOSE_TELEMETRY
+          ? ['ignore', 'inherit', 'inherit']
+          : 'ignore',
+        // The following options run the process in the background without a console window, even though they don't look like they would.
+        // See https://github.com/nodejs/node/issues/21825#issuecomment-503766781 for information
+        detached: false,
+        windowsHide: false,
+        shell: true,
+      }
+    : {
+        stdio: process.env.REDWOOD_VERBOSE_TELEMETRY
+          ? ['ignore', 'inherit', 'inherit']
+          : 'ignore',
+        detached: process.env.REDWOOD_VERBOSE_TELEMETRY ? false : true,
+        windowsHide: true,
+      }
+
+  const scriptArgs = [
+    path.join(__dirname, 'scripts', 'invoke.js'),
+    ...args,
+    '--root',
+    getPaths().base,
+  ]
+
+  if (isWindows) {
+    // Use command string with empty args array to avoid DEP0190 warning when
+    // `shell: true`
+    spawn([execPath, ...scriptArgs].join(' '), [], spawnOptions).unref()
+  } else {
+    // Use proper args array when no shell needed
+    spawn(process.execPath, scriptArgs, spawnOptions).unref()
+  }
 }
 
 // wrap a function in this call to get a telemetry hit including how long it took
diff --git a/packages/testing/src/api/vitest/CedarApiVitestEnv.ts b/packages/testing/src/api/vitest/CedarApiVitestEnv.ts
index c933d0286f..82a26d7c86 100644
--- a/packages/testing/src/api/vitest/CedarApiVitestEnv.ts
+++ b/packages/testing/src/api/vitest/CedarApiVitestEnv.ts
@@ -40,10 +40,9 @@ const CedarApiVitestEnvironment: Environment = {
       ? { [directUrlEnvVar]: process.env[directUrlEnvVar] }
       : {}
 
-    execa.sync(`yarn rw`, command, {
+    execa.sync('yarn', ['rw', ...command], {
       cwd: cedarPaths.api.base,
       stdio: 'inherit',
-      shell: true,
       env: {
         DATABASE_URL: process.env.DATABASE_URL,
         ...directUrlDefinition,
diff --git a/packages/testing/src/config/jest/api/globalSetup.ts b/packages/testing/src/config/jest/api/globalSetup.ts
index 7c4d074bf4..cef5cd88b2 100644
--- a/packages/testing/src/config/jest/api/globalSetup.ts
+++ b/packages/testing/src/config/jest/api/globalSetup.ts
@@ -41,10 +41,9 @@ export default async function () {
     env[directUrlEnvVar] = process.env[directUrlEnvVar]
   }
 
-  execa.sync('yarn rw', command, {
+  execa.sync('yarn', ['rw', ...command], {
     cwd: rwjsPaths.api.base,
     stdio: 'inherit',
-    shell: true,
     env,
   })
 }
diff --git a/tasks/framework-tools/tarsync/bin.mts b/tasks/framework-tools/tarsync/bin.mts
index a189c8b346..e634240e6b 100644
--- a/tasks/framework-tools/tarsync/bin.mts
+++ b/tasks/framework-tools/tarsync/bin.mts
@@ -19,21 +19,24 @@ async function main() {
 
   const watcher = chokidar.watch(path.join(FRAMEWORK_PATH, 'packages'), {
     ignored: IGNORED,
-    // We don't want chokidar to emit events as it discovers paths, only as they change.
+    // We don't want chokidar to emit events as it discovers paths, only as they
+    // change.
     ignoreInitial: true,
     // Debounce the events.
     awaitWriteFinish: true,
   })
+
   watcher.on('all', async (_event, filePath) => {
     if (!running) {
       triggered = filePath
       return
     }
 
-    // If we're already running we don't trigger on certain files which are likely to be
-    // touched by the build process itself.
+    // If we're already running we don't trigger on certain files which are
+    // likely to be touched by the build process itself.
 
-    // `package.json` files are touched when we switch between esm and cjs builds.
+    // `package.json` files are touched when we switch between esm and cjs
+    // builds.
     if (filePath.endsWith('package.json')) {
       return
     }
@@ -47,13 +50,8 @@ async function main() {
       triggered = ''
       running = true
       try {
-        await tarsync(
-          {
-            projectPath,
-            verbose,
-          },
-          `File change: ${path.relative(FRAMEWORK_PATH, thisTrigger)}`,
-        )
+        const relativePath = path.relative(FRAMEWORK_PATH, thisTrigger)
+        await tarsync({ projectPath, verbose }, `File change: ${relativePath}`)
       } finally {
         running = false
       }
diff --git a/tasks/test-project/rebuild-fragments-test-project-fixture.ts b/tasks/test-project/rebuild-fragments-test-project-fixture.ts
index 4252c3cbcd..f5b3e58851 100755
--- a/tasks/test-project/rebuild-fragments-test-project-fixture.ts
+++ b/tasks/test-project/rebuild-fragments-test-project-fixture.ts
@@ -407,8 +407,7 @@ async function runCommand() {
     title: 'Lint --fix all the things',
     task: async () => {
       try {
-        await exec('yarn rw lint --fix', [], {
-          shell: true,
+        await exec('yarn', ['rw', 'lint', '--fix'], {
           stdio: 'pipe',
           cleanup: true,
           cwd: OUTPUT_PROJECT_PATH,
diff --git a/tasks/test-project/rebuild-test-project-fixture-esm.ts b/tasks/test-project/rebuild-test-project-fixture-esm.ts
index 8b0b719bc5..c758f5e1e3 100755
--- a/tasks/test-project/rebuild-test-project-fixture-esm.ts
+++ b/tasks/test-project/rebuild-test-project-fixture-esm.ts
@@ -499,8 +499,7 @@ async function runCommand() {
     title: 'Lint --fix all the things',
     task: async () => {
       try {
-        await exec('yarn rw lint --fix', [], {
-          shell: true,
+        await exec('yarn', ['rw', 'lint', '--fix'], {
           stdio: 'pipe',
           cleanup: true,
           cwd: OUTPUT_PROJECT_PATH,
diff --git a/tasks/test-project/rebuild-test-project-fixture.ts b/tasks/test-project/rebuild-test-project-fixture.ts
index bcd98ba5aa..c38dcccb54 100755
--- a/tasks/test-project/rebuild-test-project-fixture.ts
+++ b/tasks/test-project/rebuild-test-project-fixture.ts
@@ -499,8 +499,7 @@ async function runCommand() {
     title: 'Lint --fix all the things',
     task: async () => {
       try {
-        await exec('yarn rw lint --fix', [], {
-          shell: true,
+        await exec('yarn', ['rw', 'lint', '--fix'], {
           stdio: 'pipe',
           cleanup: true,
           cwd: OUTPUT_PROJECT_PATH,
diff --git a/tasks/test-project/test-project b/tasks/test-project/test-project
index eb87385f50..3fba0909e8 100755
--- a/tasks/test-project/test-project
+++ b/tasks/test-project/test-project
@@ -276,7 +276,7 @@ const globalTasks = () =>
         title: 'Lint --fix all the things',
         task: async () => {
           try {
-            await execa('yarn rw lint --fix', [], {
+            await execa('yarn rw lint --fix', {
               shell: true,
               stdio: 'ignore',
               cleanup: true,