diff --git a/.github/workflows/release-cut.yml b/.github/workflows/release-cut.yml
index 966396ac453..f7bdc13caac 100644
--- a/.github/workflows/release-cut.yml
+++ b/.github/workflows/release-cut.yml
@@ -2223,10 +2223,13 @@ jobs:
         # Why: electron-builder `--publish always` can create a public release
         # as soon as this platform uploads. Re-draft immediately, then fail, so
         # /releases/latest never keeps serving a missing Windows exe.
+        # Why bash: the Windows matrix defaults to pwsh, which does not expand
+        # "$TAG" into argv.
+        shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ needs.cut.outputs.tag }}
-        run: node config/scripts/assert-github-release-is-draft.mjs "$TAG"
+        run: node config/scripts/assert-github-release-is-draft.mjs "${{ needs.cut.outputs.tag }}"
 
       # Why post-pack for Linux: electron-builder packs and uploads in one
       # `--publish always` invocation. The previous step re-drafts if that
diff --git a/.github/workflows/release-mac-build.yml b/.github/workflows/release-mac-build.yml
index b8e0079984b..7f0149fc74e 100644
--- a/.github/workflows/release-mac-build.yml
+++ b/.github/workflows/release-mac-build.yml
@@ -184,10 +184,11 @@ jobs:
         # Why: re-draft immediately if electron-builder flipped the GitHub
         # release public, then fail. Checking without restoring leaves
         # /releases/latest serving a missing Windows exe.
+        shell: bash
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ inputs.tag }}
-        run: node config/scripts/assert-github-release-is-draft.mjs "$TAG"
+        run: node config/scripts/assert-github-release-is-draft.mjs "${{ inputs.tag }}"
 
       # Why post-publish for macOS: electron-builder packs and uploads in a
       # single `--publish always` invocation, so there is no cheap insertion
diff --git a/config/scripts/assert-github-release-is-draft.mjs b/config/scripts/assert-github-release-is-draft.mjs
index c60722452bb..cce1d51cee2 100644
--- a/config/scripts/assert-github-release-is-draft.mjs
+++ b/config/scripts/assert-github-release-is-draft.mjs
@@ -91,7 +91,9 @@ export async function restorePublishedDesktopReleasesToDraft({
 }
 
 async function main() {
-  const tag = process.argv[2]
+  // Why env TAG: the Windows release-cut matrix uses pwsh, which does not
+  // expand bash-style "$TAG" in argv. The step still exports TAG.
+  const tag = process.argv[2] || process.env.TAG
   const token = process.env.GH_TOKEN || process.env.GITHUB_TOKEN
   const repo = process.env.GITHUB_REPOSITORY || 'stablyai/orca'
   const restored = await restorePublishedDesktopReleasesToDraft({
diff --git a/config/scripts/assert-github-release-is-draft.test.mjs b/config/scripts/assert-github-release-is-draft.test.mjs
index 8b730e9fb37..aed313495de 100644
--- a/config/scripts/assert-github-release-is-draft.test.mjs
+++ b/config/scripts/assert-github-release-is-draft.test.mjs
@@ -128,13 +128,17 @@ describe('release draft workflow contract', () => {
 
     expect(electronBuilderConfig.publish.releaseType).toBe('draft')
     expect(cutCheckout.with['fetch-tags']).toBe(true)
+    expect(linuxDraftStep.shell).toBe('bash')
     expect(linuxDraftStep.run).toContain('assert-github-release-is-draft.mjs')
+    expect(linuxDraftStep.run).toContain('needs.cut.outputs.tag')
     expect(publishRelease.run).toContain('gh release edit')
     expect(publishRelease.run).toContain('--draft=false')
     expect(macSteps.indexOf(abortParentStep)).toBeLessThan(macSteps.indexOf(macPublishStep))
     expect(abortParentStep.env.PARENT_RUN).toBe('${{ inputs.release_run_id }}')
     expect(abortParentStep.run).toContain('refusing to publish mac artifacts')
+    expect(macDraftStep.shell).toBe('bash')
     expect(macDraftStep.run).toContain('assert-github-release-is-draft.mjs')
+    expect(macDraftStep.run).toContain('inputs.tag')
     expect(macPublishStep.with.command).toContain('-c.publish.releaseType=draft')
 
     const linuxCommands = releaseWorkflow.jobs.build.strategy.matrix.include