diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 3fc922b..d9f0cfa 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -54,6 +54,13 @@ on:
   pull_request:
     branches: [main]
 
+# Force bash as the default shell. With `container:` set on every
+# job, Gitea Actions otherwise picks `sh -e` and our `set -euo
+# pipefail` fails on dash with "Illegal option -o pipefail".
+defaults:
+  run:
+    shell: bash
+
 jobs:
   test:
     # Sharded by package group. server/http and store are the two
diff --git a/.gitea/workflows/e2e.yml b/.gitea/workflows/e2e.yml
index 7ac2ae1..0cb1b49 100644
--- a/.gitea/workflows/e2e.yml
+++ b/.gitea/workflows/e2e.yml
@@ -22,6 +22,11 @@ on:
     branches: [main]
   workflow_dispatch:
 
+# Force bash as the default shell — see ci.yml header.
+defaults:
+  run:
+    shell: bash
+
 jobs:
   e2e:
     name: Playwright vs docker-compose
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 7a423aa..9c0c078 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -37,6 +37,11 @@ env:
   REGISTRY: gitea.dcglab.co.uk
   IMAGE_NAME: ${{ gitea.repository }}
 
+# Force bash as the default shell — see ci.yml header.
+defaults:
+  run:
+    shell: bash
+
 jobs:
   image:
     name: Build + push image