diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 3d0e3fa..52073b6 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -14,6 +14,15 @@ env:
 permissions:
   contents: read
 
+# Every step runs with "shell: bash", which GitHub runs as
+# "bash --noprofile --norc -eo pipefail {0}". The default for a step that
+# names no shell is "bash -e {0}", without pipefail: "go test ... | tee"
+# and "go-test-coverage ... | sed ... | tee" took tee's status, so a failing
+# test or a coverage below its threshold passed the job.
+defaults:
+  run:
+    shell: bash
+
 jobs:
   build:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c903acb..9ec7feb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,6 +12,15 @@ permissions:
   pull-requests: write
   id-token: write
 
+# Every step runs with "shell: bash", which GitHub runs as
+# "bash --noprofile --norc -eo pipefail {0}". The default for a step that
+# names no shell is "bash -e {0}", without pipefail: "go test ... | tee"
+# and "go-test-coverage ... | sed ... | tee" took tee's status, so a failing
+# test or a coverage below its threshold passed the job.
+defaults:
+  run:
+    shell: bash
+
 jobs:
   release:
     name: Release