diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 818f3b7..4d86759 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -142,15 +142,24 @@ jobs:
           API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
           TAG: ${{ github.ref_name }}
         run: |
-          # pipefail is required: without it a failing curl would be masked by
-          # a successful jq, id would become null, and the assets would be
-          # uploaded to a release that does not exist.
+          # Keep this POSIX: the runner executes steps with dash, where
+          # `set -o pipefail` does not exist. So the curl call is kept out of a
+          # pipeline — under `set -e` a failed command substitution aborts the
+          # step, which is what pipefail would have bought us. Without that, a
+          # failing curl would be masked by a successful jq, id would become
+          # null, and assets would be uploaded to a release that never existed.
           # No -x here: the command carries the token.
-          set -euo pipefail
-          id=$(curl -fsS -X POST "$API/releases" \
+          set -eu
+          response=$(curl -fsS -X POST "$API/releases" \
             -H "Authorization: token $TOKEN" \
             -H "Content-Type: application/json" \
-            -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\"}" | jq -r .id)
+            -d "{\"tag_name\":\"$TAG\",\"name\":\"$TAG\"}")
+
+          id=$(printf '%s' "$response" | jq -r '.id // empty')
+          if [ -z "$id" ]; then
+            echo "no release id in response: $response" >&2
+            exit 1
+          fi
           echo "release $TAG (id $id)"
 
           for file in dist/*.exe; do