diff --git a/.github/workflows/sdk-version-capabilities.yml b/.github/workflows/sdk-version-capabilities.yml
index d30dcdd..d840935 100644
--- a/.github/workflows/sdk-version-capabilities.yml
+++ b/.github/workflows/sdk-version-capabilities.yml
@@ -65,11 +65,15 @@ jobs:
         run: |
           set -uo pipefail
           CSV="$(printf '%s\n' "$COMMENT" | head -n1 | sed -E 's#^/capabilities##')"
-          out="$(bash .github/scripts/apply-sdk-capabilities.sh "$PWD" "$SDK" "$VERSION" "$CSV")"; code=$?
+          # GitHub runs steps with `bash -e`; the apply script exits 2/3 by design,
+          # so guard with `|| code=$?` to capture the code instead of aborting.
+          code=0
+          out="$(bash .github/scripts/apply-sdk-capabilities.sh "$PWD" "$SDK" "$VERSION" "$CSV")" || code=$?
           echo "$out"
-          echo "result=$out" >> "$GITHUB_OUTPUT"
-          echo "code=$code" >> "$GITHUB_OUTPUT"
-          exit 0
+          {
+            echo "result=$out"
+            echo "code=$code"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Reject unknown capabilities
         if: ${{ steps.apply.outputs.code == '3' }}