diff --git a/.gitea/workflows/gitea-main-ci.yaml b/.gitea/workflows/gitea-main-ci.yaml
index aa6e96c..37a80d8 100644
--- a/.gitea/workflows/gitea-main-ci.yaml
+++ b/.gitea/workflows/gitea-main-ci.yaml
@@ -204,6 +204,11 @@ jobs:
         # Reproducible: pinned Go (1.26.4) + go.sum-pinned deps + -trimpath/no buildid.
         # fleet-enrol fetches go-tpm from the proxy (pinned by go.sum); hostapi is
         # stdlib-only (GOPROXY=off).
+        # shell: bash is explicit — the Gitea/act runner defaults run steps to sh
+        # (dash), where `set -o pipefail` is an illegal option. `set -e` is
+        # load-bearing: without it a failed go build/test in the first ( … ) group
+        # is masked by the trailing `file` success and a broken binary reaches Packer.
+        shell: bash
         run: |
           set -euo pipefail
           ( cd files/enrol \