diff --git a/src/ci_orchestrator/transport/winrm.py b/src/ci_orchestrator/transport/winrm.py
index c5151f6..1a77a2f 100644
--- a/src/ci_orchestrator/transport/winrm.py
+++ b/src/ci_orchestrator/transport/winrm.py
@@ -59,6 +59,7 @@ class WinRmTransport:
         ssl: bool = True,
         cert_validation: bool = False,
         connection_timeout: int = 30,
+        auth: str = "ntlm",
     ) -> None:
         self._host = host
         self._username = username
@@ -67,6 +68,12 @@ class WinRmTransport:
         self._ssl = ssl
         self._cert_validation = cert_validation
         self._connection_timeout = connection_timeout
+        # Build VMs use local (workgroup) accounts. pypsrp defaults to
+        # 'negotiate', which tries Kerberos with no domain and fails under
+        # SSPI with SEC_E_UNKNOWN_CREDENTIALS. NTLM is required for local
+        # accounts. The guest username must also be host-qualified
+        # (WINBUILD-2025\ci_build), stored that way in the credential vault.
+        self._auth = auth
         self._client: Client | None = None
 
     # ----------------------------------------------------------- connection
@@ -86,6 +93,7 @@ class WinRmTransport:
                 password=self._password,
                 port=self._port,
                 ssl=self._ssl,
+                auth=self._auth,
                 cert_validation=self._cert_validation,
                 connection_timeout=self._connection_timeout,
             )