diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index ab61b3088..439ae6816 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -109,7 +109,7 @@ jobs:
           # tooling/ocio-env.sh: vendored static OCIO everywhere it
           # builds (the [patch.crates-io] ocio-sys tracks shaloong/ocio-rs
           # main, whose vendored sources build on GCC >= 16).
-          tooling/ocio-env.sh >> "$GITHUB_ENV"
+          bash tooling/ocio-env.sh >> "$GITHUB_ENV"
 
       # TEMP: cache disabled until the Gitea instance cache is provisioned (Cache cargo artifacts)
       #   uses: Swatinem/rust-cache@v2
@@ -186,7 +186,7 @@ jobs:
           # noble) — do NOT apt-install them here.
 
       - name: Configure build environment
-        run: tooling/ocio-env.sh >> "$GITHUB_ENV"
+        run: bash tooling/ocio-env.sh >> "$GITHUB_ENV"
 
       # TEMP: cache disabled until the Gitea instance cache is provisioned (Cache cargo artifacts)
       #   uses: Swatinem/rust-cache@v2
@@ -247,7 +247,7 @@ jobs:
         run: |
           # Vendored static OCIO (same as every non-Windows platform via
           # tooling/ocio-env.sh); no OCIO_INSTALL_DIR override.
-          tooling/ocio-env.sh >> "$GITHUB_ENV"
+          bash tooling/ocio-env.sh >> "$GITHUB_ENV"
           {
             echo "CFLAGS=-I/opt/homebrew/include"
             echo "LDFLAGS=-L/opt/homebrew/lib"
@@ -364,7 +364,7 @@ jobs:
           # tooling/ocio-env.sh links it STATICALLY when the package ships
           # libOpenColorIO.a, dynamically otherwise (the DLL bundling step
           # below then still applies).
-          tooling/ocio-env.sh >> "$GITHUB_ENV"
+          bash tooling/ocio-env.sh >> "$GITHUB_ENV"
           # ocio-sys is the GIT fork (Mike-Solar/ocio-rs main, pinned in
           # the root manifest): its build.rs already carries the
           # fork's GNU-toolchain fix, so NO crate-unpack/glob patch step