Teamcity Signtool via Msbuild Runner throws error on timestamp

Signtool is able to sign all passed assemblies just fine, but when it tries to timestamp them it fails with error code 255.

This also results in an error in the event viewer:

Faulting application name: signtool.exe, version: 10.0.10586.212, time stamp: 0x56fa257d Faulting module name: ntdll.dll, version: 6.3.9600.17415, time stamp: 0x54504b0d

Exception code: 0xc0000374

Fault offset: 0x000e5be4

Faulting process id: 0x768

Faulting application start time: 0x01d3061e0a3c7af5

Faulting application path: C:\Program Files (x86)\Microsoft SDKs\ClickOnce\SignTool\signtool.exe

Faulting module path: C:\Windows\SYSTEM32\ntdll.dll

My msbuild task for timestamping looks like:

<Exec Command='"$(SDK40ToolsPath)..\..\..\..\ClickOnce\SignTool\SignTool.exe" timestamp /t http://timestamp.verisign.com/scripts/timstamp.dll "%(SignableFiles.FullPath)"' />

I was able to produce an error when running the signtool directly from command line, but running cmd as an Administrator resolved that issue. After adding permissions to the user (same user that is running TeamCity Build agent service), allowed me to execute the signtool timestamp successfully without elevation.

To get closer to reproducing, I tried mocking my msbuild file to just run the signtool, but this also succeeded.

TeamCity seems to use an MSBuildBootstrapper, but I was unable to figure out the correct syntax to call my custom build script from it. Has anyone else run into this issue?