diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7b35f22..8688501 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -71,7 +71,10 @@ jobs:
           archive="source/obicall-$VERSION.tar.gz"
           curl -fsSL -o "$archive" "https://github.com/$GITHUB_REPOSITORY/archive/refs/tags/$TAG.tar.gz"
           # The archive GitHub serves must be exactly the tagged commit.
-          archived=$(gzip -dc "$archive" | git get-tar-commit-id)
+          # (Decompressed to a file first: get-tar-commit-id reads only the
+          # header, and under pipefail gzip's broken pipe would fail the step.)
+          gzip -dc "$archive" > "$RUNNER_TEMP/source.tar"
+          archived=$(git get-tar-commit-id < "$RUNNER_TEMP/source.tar")
           [ "$archived" = "$(git rev-parse HEAD)" ] || { echo "::error::archive is commit $archived, tag is $(git rev-parse HEAD)"; exit 1; }
           cp packaging/archlinux/PKGBUILD source/PKGBUILD.archlinux
           cp packaging/msys2/mingw-w64-obicall/PKGBUILD source/PKGBUILD.msys2
diff --git a/packaging/repo/verify-pacman-client.sh b/packaging/repo/verify-pacman-client.sh
index 98cb4a8..9168b5e 100755
--- a/packaging/repo/verify-pacman-client.sh
+++ b/packaging/repo/verify-pacman-client.sh
@@ -61,8 +61,9 @@ else
 fi
 # -------------------------------------------------------------------------
 
-pacman -Qi "$package" | grep -E '^(Name|Version|Validated By)'
-pacman -Qi "$package" | grep -q '^Validated By.*Signature' \
+info=$(pacman -Qi "$package")
+grep -E '^(Name|Version|Validated By)' <<< "$info"
+grep -q '^Validated By.*Signature' <<< "$info" \
     || { echo "FAIL: pacman did not validate $package by signature" >&2; exit 1; }
 installed=$(pacman -Q "$package" | cut -d' ' -f2)
 if [ -n "$version" ] && [ "$installed" != "$version" ]; then