diff --git a/.github/actions/setup-builder/action.yml b/.github/actions/setup-builder/action.yml
index 532174590f..e961ed6335 100644
--- a/.github/actions/setup-builder/action.yml
+++ b/.github/actions/setup-builder/action.yml
@@ -26,8 +26,8 @@ runs:
   using: "composite"
   steps:
     - name: Setup specified Rust toolchain
-      shell: bash
       if: ${{ inputs.rust-version != '' }}
+      shell: bash
       env:
         RUST_VERSION: ${{ inputs.rust-version }}
       run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 63ee893fa2..071d6dbcbf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -172,6 +172,7 @@ jobs:
         run: make docker-up
 
       - name: Run tests
+        shell: bash
         env:
           # Disable debug info to speed up compilation and reduce artifact size
           RUSTFLAGS: "-C debuginfo=0"
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d6ba35d9f4..83e1031d17 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -65,6 +65,7 @@ jobs:
         # Only publish if it's a tag and the tag is not a pre-release
         if: ${{ startsWith(github.ref, 'refs/tags/') && !contains(github.ref, '-') }}
         run: cargo publish --all-features # zizmor: ignore[use-trusted-publishing] -- https://github.com/apache/iceberg-rust/issues/1539
+        shell: bash
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
 
diff --git a/.github/workflows/release_python.yml b/.github/workflows/release_python.yml
index d9fcdd406b..b19fa165dc 100644
--- a/.github/workflows/release_python.yml
+++ b/.github/workflows/release_python.yml
@@ -49,6 +49,7 @@ jobs:
       - name: Validate release tag format
         id: validate
         # Valid formats: v<major>.<minor>.<patch> OR v<major>.<minor>.<patch>-rc.<release_candidate>
+        shell: bash
         env:
           RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
@@ -119,6 +120,7 @@ jobs:
           # doing this explicitly to avoid issue in Windows where `mv` does not overwrite existing file
           rm Cargo.toml
           mv Cargo.toml.tmp Cargo.toml
+        shell: bash
         env:
           NEEDS_VALIDATE_RELEASE_TAG_OUTPUTS_CARGO_VERSION: ${{ needs.validate-release-tag.outputs.cargo-version }}
 
@@ -161,6 +163,7 @@ jobs:
       - name: Set cargo version for RC
         if: ${{ needs.validate-release-tag.outputs.is-rc == 'true' }}
         working-directory: "bindings/python"
+        shell: bash
         env:
           CARGO_VERSION: ${{ needs.validate-release-tag.outputs.cargo-version }}
         run: |