diff --git a/.github/workflows/desktop-release.yml b/.github/workflows/desktop-release.yml
index 492d83ef8..9377d96c2 100644
--- a/.github/workflows/desktop-release.yml
+++ b/.github/workflows/desktop-release.yml
@@ -171,6 +171,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Configure desktop release
+        shell: bash
         env:
           DESKTOP_CHANNEL: ${{ needs.prepare.outputs.channel }}
           DESKTOP_VERSION: ${{ needs.prepare.outputs.version }}
@@ -355,6 +356,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Configure desktop release
+        shell: bash
         env:
           DESKTOP_CHANNEL: ${{ needs.prepare.outputs.channel }}
           DESKTOP_VERSION: ${{ needs.prepare.outputs.version }}
diff --git a/scripts/release/release-workflows.test.mjs b/scripts/release/release-workflows.test.mjs
index 346f5212c..381755a42 100644
--- a/scripts/release/release-workflows.test.mjs
+++ b/scripts/release/release-workflows.test.mjs
@@ -6,6 +6,14 @@ import test from 'node:test';
 const root = resolve(import.meta.dirname, '../..');
 const read = (path) => readFileSync(resolve(root, path), 'utf8');
 
+void test('desktop releases configure both platforms with Bash', () => {
+  const workflow = read('.github/workflows/desktop-release.yml');
+  const configuredWithBash = /^      - name: Configure desktop release\n        shell: bash$/mu;
+  const windowsStart = workflow.indexOf('\n  windows:');
+  assert.match(workflow.slice(workflow.indexOf('\n  mac:'), windowsStart), configuredWithBash);
+  assert.match(workflow.slice(windowsStart, workflow.indexOf('\n  publish:', windowsStart)), configuredWithBash);
+});
+
 void test('release workflow uses full push-boundary lane signals and isolated jobs', () => {
   const workflow = read('.github/workflows/release.yml');
   const desktopJob = workflow.slice(