diff --git a/codex-rs/windows-sandbox-service/src/registered_runtime.rs b/codex-rs/windows-sandbox-service/src/registered_runtime.rs
index d1132d96e3..554cece304 100644
--- a/codex-rs/windows-sandbox-service/src/registered_runtime.rs
+++ b/codex-rs/windows-sandbox-service/src/registered_runtime.rs
@@ -163,7 +163,8 @@ pub(crate) fn provision(
                     None,
                     DeploymentOptions::None,
                 )?)
-            })?;
+            })
+            .context("start managed runtime package registration")?;
             // As with provisioning, retain the request's resources until Windows finishes.
             // A client timeout or an unreadable status cannot safely release the profile.
             let mut status_error_logged = false;
@@ -193,18 +194,26 @@ pub(crate) fn provision(
                 }
                 std::thread::sleep(Duration::from_millis(50));
             }
-            operation.GetResults()?.ExtendedErrorCode()?.ok()?;
+            operation
+                .GetResults()
+                .and_then(|result| result.ExtendedErrorCode())
+                .and_then(windows::core::HRESULT::ok)
+                .context("finish managed runtime package registration")?;
             ensure!(
-                registered_packages(&profile.user_sid, &family)?.contains(full_name),
+                registered_packages(&profile.user_sid, &family)
+                    .context("verify managed runtime package registration")?
+                    .contains(full_name),
                 "runtime registration completed without the expected package"
             );
         }
-        metadata::grant(identity.token.0, &profile.user_sid, record)?;
+        metadata::grant(identity.token.0, &profile.user_sid, record)
+            .context("grant managed runtime metadata permissions")?;
         profile.unload_profile()?;
     }
     if !receipt_current {
         record.runtime_mut()?.ready_package = Some(full_name.to_string());
-        crate::installation_record::save_runtime(record)?;
+        crate::installation_record::save_runtime(record)
+            .context("persist completed managed runtime registration")?;
     }
     Ok(())
 }