diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml
index 5298be1..fab988d 100644
--- a/.gitea/workflows/ci-cd.yml
+++ b/.gitea/workflows/ci-cd.yml
@@ -82,7 +82,8 @@ jobs:
 
       - name: Trust Nexus mirror CA (diagnostic)
         # Verbose / fail-fast version to expose exactly where the chain trust breaks.
-        # Step exits non-zero on any unexpected failure so the CI log shows the cause.
+        # shell: bash required — Gitea act runner defaults to sh, which lacks pipefail.
+        shell: bash
         run: |
           set -euo pipefail
           echo "=== OS / OpenSSL info ==="