diff --git a/scripts/Install-CredentialProvider.ps1 b/scripts/Install-CredentialProvider.ps1
index 1f1e611..c42a0a1 100644
--- a/scripts/Install-CredentialProvider.ps1
+++ b/scripts/Install-CredentialProvider.ps1
@@ -123,7 +123,18 @@ finally {
 $versionId = $packageHash.Substring(0, 16)
 $installPath = Join-Path $installRoot "versions\$versionId"
 $completeMarker = Join-Path $installPath '.complete'
-if ((Test-Path -LiteralPath $installPath) -and -not (Test-Path -LiteralPath $completeMarker)) {
+$completeMarkerValid = $false
+if (Test-Path -LiteralPath $completeMarker -PathType Leaf) {
+    try {
+        $completeMarkerValid = [IO.File]::ReadAllText($completeMarker).Trim() -eq $packageHash
+    }
+    catch {
+        # Treat an unreadable marker as an incomplete installation. Never reuse
+        # a version directory unless its marker proves that every package byte
+        # represented by packageHash finished installing.
+    }
+}
+if ((Test-Path -LiteralPath $installPath) -and -not $completeMarkerValid) {
     $installPath = '{0}-{1}' -f $installPath, ([Guid]::NewGuid().ToString('N').Substring(0, 8))
     $completeMarker = Join-Path $installPath '.complete'
 }
diff --git a/src/SGU.CredentialProvider/SguCredentialTile.cs b/src/SGU.CredentialProvider/SguCredentialTile.cs
index a7f47af..77e6d0b 100644
--- a/src/SGU.CredentialProvider/SguCredentialTile.cs
+++ b/src/SGU.CredentialProvider/SguCredentialTile.cs
@@ -5,7 +5,11 @@ using SGU.AuthBroker.Core.Identity;
 
 namespace SGU.CredentialProvider;
 
-internal sealed class SguCredentialTile : CredentialTile2
+// LogonUI can only preserve the alpha channel of the provider logo when the
+// credential exposes ICredentialProviderCredential3. CredentialTile2 returns
+// an HBITMAP, which composites transparent pixels against #464646 and produces
+// a visible grey square around the circular SGU mark.
+internal sealed class SguCredentialTile : CredentialTile3
 {
     private TextboxControl userNameControl = null!;
     private SecurePasswordTextboxControl passwordControl = null!;
diff --git a/tests/SGU.CredentialProvider.Tests/ProviderTileIconTests.cs b/tests/SGU.CredentialProvider.Tests/ProviderTileIconTests.cs
index b5c8179..b373df7 100644
--- a/tests/SGU.CredentialProvider.Tests/ProviderTileIconTests.cs
+++ b/tests/SGU.CredentialProvider.Tests/ProviderTileIconTests.cs
@@ -52,5 +52,6 @@ public sealed class ProviderTileIconTests
         Assert.Equal("Acceso institucional SGU", heading.Label);
         Assert.Equal(FieldState.DisplayInSelectedTile, heading.State);
         Assert.Equal(GenericTileDisplayMode.DisplayAsDedicatedTile, tile.GenericTileDisplayMode);
+        Assert.IsAssignableFrom<CredentialTile3>(tile);
     }
 }