diff --git a/scripts/generate-licenses.mjs b/scripts/generate-licenses.mjs
index bcfe18ec..649e86e1 100644
--- a/scripts/generate-licenses.mjs
+++ b/scripts/generate-licenses.mjs
@@ -1,4 +1,4 @@
-import { execFileSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -156,14 +156,18 @@ function commandOutput(command, args) {
   // spawn batch files without a shell (CVE-2024-27980), so `execFileSync`
   // fails with EINVAL there. Every argument below is a literal from this file,
   // so routing that one call through cmd.exe interpolates nothing.
-  const needsShell = process.platform === "win32" && command === "pnpm";
-  return execFileSync(needsShell ? "pnpm.cmd" : command, args, {
+  // One command string rather than an argument list: Node deprecates
+  // passing arguments alongside `shell: true` (DEP0190).
+  const options = {
     cwd: PROJECT_ROOT,
     encoding: "utf8",
     maxBuffer: MAX_COMMAND_OUTPUT,
-    shell: needsShell,
     windowsHide: true,
-  });
+  };
+  if (process.platform === "win32" && command === "pnpm") {
+    return execSync(["pnpm.cmd", ...args].join(" "), options);
+  }
+  return execFileSync(command, args, options);
 }
 
 function generateInventory() {