IIS app pool permissions break Modern UI publish — what's the recommended approach?

Self-hosted 2025 R2, instance under C:\Program Files\Acumatica ERP\xxxx. Publishing projects with Modern UI files fails. I confirmed the cause: the npm process runs under the app pool identity, which has no write permission inside C:\Program Files, so webpack dies instantly with no error at all. Switching the app pool from ApplicationPoolIdentity to LocalSystem fixes it. Granting Modify to the virtual account does not.
We publish only once or twice a year and we'd rather not create a dedicated service account on the OS. So what's the right way to handle this?
Switch to LocalSystem  only during publish and switch back?
Reinstall the instance to a non-protected path like C:\Acumatica? 

is there an official recommendation for the app pool identity and folder permissions when the instance is under C:\Program Files？