diff --git a/.gitea/workflows/BuildAndroid.yml b/.gitea/workflows/BuildAndroid.yml
index 2ada892..2f3928e 100644
--- a/.gitea/workflows/BuildAndroid.yml
+++ b/.gitea/workflows/BuildAndroid.yml
@@ -91,7 +91,10 @@ jobs:
           KEY_ALIAS: ${{ secrets.ANDROID_KEY_ALIAS }}
           KEY_PASSWORD: ${{ secrets.ANDROID_KEY_PASSWORD }}
         run: |
-          set -euo pipefail
+          # The act-runner executes `run` with sh (dash), not bash, so this
+          # script has to stay posix - `set -o pipefail` for example dies
+          # with "Illegal option -o pipefail" before anything else runs.
+          set -eu
 
           # Failing here is on purpose: a silently debug signed apk would be
           # installable once and never updatable afterwards.
@@ -120,7 +123,7 @@ jobs:
       # must never go backwards.
       - name: Build the apk
         run: |
-          set -euo pipefail
+          set -eu
 
           version="${{ github.ref_name }}"
           version="${version#v}"
@@ -158,7 +161,7 @@ jobs:
           # access in a secret and use that instead.
           TOKEN: ${{ github.token }}
         run: |
-          set -euo pipefail
+          set -eu
 
           api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
           asset="ac_web-${{ github.ref_name }}.apk"
@@ -167,8 +170,9 @@ jobs:
           # for a manual re-run of the job.
           releaseId="${{ github.event.release.id }}"
           if [ -z "$releaseId" ] || [ "$releaseId" = "null" ]; then
-            releaseId=$(curl -fsSL -H "Authorization: token $TOKEN" \
-              "$api/releases/tags/${{ github.ref_name }}" | jq -r '.id')
+            release=$(curl -fsSL -H "Authorization: token $TOKEN" \
+              "$api/releases/tags/${{ github.ref_name }}")
+            releaseId=$(printf '%s' "$release" | jq -r '.id')
           fi
 
           curl -fsSL -X POST \
diff --git a/.gitea/workflows/BuildLinux.yml b/.gitea/workflows/BuildLinux.yml
index 3a27907..442376d 100644
--- a/.gitea/workflows/BuildLinux.yml
+++ b/.gitea/workflows/BuildLinux.yml
@@ -82,7 +82,10 @@ jobs:
           # access in a secret and use that instead.
           TOKEN: ${{ github.token }}
         run: |
-          set -euo pipefail
+          # The act-runner executes `run` with sh (dash), not bash, so this
+          # script has to stay posix - `set -o pipefail` for example dies
+          # with "Illegal option -o pipefail" before anything else runs.
+          set -eu
 
           api="${{ github.server_url }}/api/v1/repos/${{ github.repository }}"
           asset="ac_web-linux-x64-${{ github.ref_name }}.tar.gz"
@@ -91,8 +94,9 @@ jobs:
           # for a manual re-run of the job.
           releaseId="${{ github.event.release.id }}"
           if [ -z "$releaseId" ] || [ "$releaseId" = "null" ]; then
-            releaseId=$(curl -fsSL -H "Authorization: token $TOKEN" \
-              "$api/releases/tags/${{ github.ref_name }}" | jq -r '.id')
+            release=$(curl -fsSL -H "Authorization: token $TOKEN" \
+              "$api/releases/tags/${{ github.ref_name }}")
+            releaseId=$(printf '%s' "$release" | jq -r '.id')
           fi
 
           curl -fsSL -X POST \
diff --git a/CLAUDE.md b/CLAUDE.md
index e9e3b8c..89cb08f 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -47,6 +47,7 @@ Notes that are easy to get wrong:
 - **The act-runner of the gitea instance only supports actions up to `node20`.** Anything newer fails with `The runs.using key in action.yml must be one of: [...], got node24`, which is why the Flutter sdk is unpacked from the official archive instead of through `subosito/flutter-action` (that one caches through `actions/cache@v5`). Check the `runs.using` of an action before adding it.
 - The Flutter version is pinned in three places (`FLUTTER_VERSION` in both build workflows, `ARG FLUTTER_VERSION` in `ac_web/Dockerfile`) and must be kept in sync.
 - Steps run with `working-directory: ac_web`, but `upload-artifact` paths are relative to the repository root.
+- **The act-runner executes `run:` with sh (dash), not bash.** A script with `set -o pipefail` fails immediately with `Illegal option -o pipefail`, so the scripts stay posix (`set -eu`, no `[[ ]]`, no arrays) and pipelines are split where the exit code of the *first* command matters.
 - **`actions/upload-artifact` must stay at `@v3`.** `@v4` bundles `@actions/artifact` v2, which aborts with `GHESNotSupportedError` whenever `GITHUB_SERVER_URL` is not `github.com` -- on this instance it is the gitea host, so the check fires before any request and cannot be worked around on the server side. `@v3` uses the older artifact api gitea implements.
 - The workflows are read from the tag the release points at, so they have to be committed **before** the release is created.
 - Artifacts and the built files carry the tag name (`github.ref_name`); the docker image is pushed as the tag, as `latest` and as the short sha.