diff --git a/install.ps1 b/install.ps1
index f9caaf6..08acf45 100644
--- a/install.ps1
+++ b/install.ps1
@@ -320,7 +320,13 @@ function Assert-SafeUpdateCache($Path) {
     $root = Normalize-PathForCompare ([System.IO.Path]::GetPathRoot($full))
     $homePath = Normalize-PathForCompare $HOME
     $homeCache = Normalize-PathForCompare (Join-Path $HOME ".cache")
-    if ($full -eq $root -or $full -eq $homePath -or $full -eq $homeCache) {
+    $unsafe = $full -eq $root -or $full -eq $homePath -or $full -eq $homeCache
+    if (-not $unsafe -and $env:LOCALAPPDATA) {
+        $localAppData = Normalize-PathForCompare $env:LOCALAPPDATA
+        $localAppDataDosh = Normalize-PathForCompare (Join-Path $env:LOCALAPPDATA "dosh")
+        $unsafe = $full -eq $localAppData -or $full -eq $localAppDataDosh
+    }
+    if ($unsafe) {
         throw "refusing unsafe update cache path: $Path"
     }
     $full
diff --git a/tests/release_scripts.rs b/tests/release_scripts.rs
index 0b22e7c..9d7216b 100644
--- a/tests/release_scripts.rs
+++ b/tests/release_scripts.rs
@@ -169,6 +169,11 @@ fn windows_installer_reuses_persistent_source_update_cache() {
     assert!(ps1.contains("Assert-NoRelativePathSegments($Path)"));
     assert!(ps1.contains("Assert-NoRelativePathSegments $Path"));
     assert!(ps1.contains("$segment -eq \".\" -or $segment -eq \"..\""));
+    assert!(ps1.contains("$localAppData = Normalize-PathForCompare $env:LOCALAPPDATA"));
+    assert!(ps1.contains(
+        "$localAppDataDosh = Normalize-PathForCompare (Join-Path $env:LOCALAPPDATA \"dosh\")"
+    ));
+    assert!(ps1.contains("$full -eq $localAppData -or $full -eq $localAppDataDosh"));
     assert!(ps1.contains("$sourceCache = Assert-SafeUpdateCache $UpdateCache"));
     assert!(ps1.contains(
         "$fetchArgs = @(\"-C\", $sourceCache, \"fetch\", \"--depth\", \"1\", \"origin\", \"main\")"