diff --git a/.forgejo/workflows/build.yaml b/.forgejo/workflows/build.yaml
index 041ce25..a52d9f0 100644
--- a/.forgejo/workflows/build.yaml
+++ b/.forgejo/workflows/build.yaml
@@ -28,13 +28,18 @@ jobs:
       # authoritative "newest stable" pointer. Cronicle is marked
       # "private": true in package.json, so npm is not an option -- the
       # Dockerfile builds from the release tarball.
+      #
+      # NOTE: every `run:` block here is POSIX sh. The runner executes these
+      # with dash, which has no `set -o pipefail`. Rather than depend on shell
+      # selection, the fetch and the parse are separate statements: under
+      # `set -e`, an assignment from a failing command substitution aborts, so
+      # `curl -f` failing is caught without needing pipefail.
       - name: Resolve latest upstream Cronicle version
         id: upstream
         run: |
-          set -euo pipefail
-          version="$(curl -fsSL https://api.github.com/repos/jhuckaby/Cronicle/releases/latest \
-                       | jq -r '.tag_name // empty' \
-                       | sed 's/^v//')"
+          set -eu
+          release_json="$(curl -fsSL https://api.github.com/repos/jhuckaby/Cronicle/releases/latest)"
+          version="$(printf '%s' "$release_json" | jq -r '.tag_name // empty' | sed 's/^v//')"
           if [ -z "$version" ]; then
             echo "Could not resolve upstream Cronicle version" >&2
             exit 1
@@ -45,7 +50,7 @@ jobs:
       - name: Compute image tags
         id: tags
         run: |
-          set -euo pipefail
+          set -eu
           shortsha="$(git rev-parse --short HEAD)"
           echo "shortsha=$shortsha" >> "$GITHUB_OUTPUT"
           echo "immutable=${{ steps.upstream.outputs.version }}-$shortsha" >> "$GITHUB_OUTPUT"
@@ -76,7 +81,7 @@ jobs:
       - name: Skip if this exact image was already built
         id: check
         run: |
-          set -uo pipefail
+          set -u
           tag="${IMAGE}:${{ steps.tags.outputs.immutable }}"
           if docker buildx imagetools inspect "$tag" >/dev/null 2>&1; then
             echo "exists=true" >> "$GITHUB_OUTPUT"