diff --git a/.github/workflows/evals-marathon.yml b/.github/workflows/evals-marathon.yml
index ae3a20b2b..9aa0ba98c 100644
--- a/.github/workflows/evals-marathon.yml
+++ b/.github/workflows/evals-marathon.yml
@@ -179,6 +179,7 @@ jobs:
       # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
       # Codex, as before. Without a key the Codex cases fail; they never pass.
       - name: Authenticate the Codex CLI
+        shell: bash
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
diff --git a/.github/workflows/evals-periodic.yml b/.github/workflows/evals-periodic.yml
index e1d4d2cd2..2cfcfdb2e 100644
--- a/.github/workflows/evals-periodic.yml
+++ b/.github/workflows/evals-periodic.yml
@@ -213,6 +213,7 @@ jobs:
       # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
       # Codex, as before. Without a key the Codex cases fail; they never pass.
       - name: Authenticate the Codex CLI
+        shell: bash
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -336,6 +337,7 @@ jobs:
       # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
       # Codex, as before. Without a key the Codex cases fail; they never pass.
       - name: Authenticate the Codex CLI
+        shell: bash
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
diff --git a/.github/workflows/evals.yml b/.github/workflows/evals.yml
index f1406a491..82dfaecbc 100644
--- a/.github/workflows/evals.yml
+++ b/.github/workflows/evals.yml
@@ -281,6 +281,7 @@ jobs:
       # only (scripts/lib/paid-cases.ts scopeCodexAccess); every other paid case sees no
       # Codex, as before. Without a key the Codex cases fail; they never pass.
       - name: Authenticate the Codex CLI
+        shell: bash
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
         env:
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
diff --git a/test/codex-ci-access.test.ts b/test/codex-ci-access.test.ts
index 34a0e15c5..837e3938e 100644
--- a/test/codex-ci-access.test.ts
+++ b/test/codex-ci-access.test.ts
@@ -149,7 +149,13 @@ describe('codex CI access in the image and workflows', () => {
     for (const name of ['evals.yml', 'evals-periodic.yml', 'evals-marathon.yml']) {
       const workflow = Bun.YAML.parse(fs.readFileSync(path.join(ROOT, '.github/workflows', name), 'utf8')) as any;
       for (const job of Object.values<any>(workflow.jobs)) {
-        for (const step of job.steps ?? []) if (/login --with-api-key/.test(String(step.run ?? ''))) steps.push(String(step.run));
+        for (const step of job.steps ?? []) {
+          if (!/login --with-api-key/.test(String(step.run ?? ''))) continue;
+          steps.push(String(step.run));
+          // The paid jobs run inside the CI container whose default shell is `sh -e` (dash),
+          // which rejects `set -o pipefail`; the login step must opt into bash.
+          if (/pipefail/.test(String(step.run))) expect({ step: step.name, shell: step.shell }).toEqual({ step: step.name, shell: 'bash' });
+        }
       }
     }
     expect(steps.length).toBeGreaterThanOrEqual(4);