Unable to start ChromeDriver in CI environment - selenium

Question

I am using Selenium with ChromeDriver in .NET Core. All tests work fine locally, however fail in TeamCity with the following error:
Starting ChromeDriver 80.0.3987.106 (f68069574609230cf9b635cd784cfb1bf81bb53a-refs/branch-heads/3987#{#882}) on port 24272
Only local connections are allowed.
Please protect ports used by ChromeDriver and related test frameworks to prevent access by malicious code.
...
OneTimeSetUp: OpenQA.Selenium.WebDriverException : Cannot start the driver service on http://localhost:24272/
After the tests have finished, chromedriver.exe isn't terminated. There is nothing in the Windows event log or further details in the build logs, so I'm now stabbing in the dark.
I am using the following arguments, some added out of desperation:
var options = new ChromeOptions();
options.AddArgument("--headless");
options.AddArgument("--remote-debugging-port=9222");
options.AddArgument("--no-sandbox");
options.AddArgument("--no-first-run");
// See https://bugs.chromium.org/p/chromium/issues/detail?id=737678
options.AddArgument("--disable-gpu");
Driver = new ChromeDriver(options);
Interestingly, the remote debugging port != the port in the first error. Not sure if this means anything. The Chromedriver documentation suggests that options are added without leading --, but removing this doesn't seem to have any effect.
FWIW the TeamCity agent is running as a local Windows service account on Windows Server 2008 R2 (yes, I know).