diff --git a/.gitea/workflows/build_and_test.yml b/.gitea/workflows/build_and_test.yml
index 01b7ed1b3..b69ad25e5 100644
--- a/.gitea/workflows/build_and_test.yml
+++ b/.gitea/workflows/build_and_test.yml
@@ -294,7 +294,9 @@ jobs:
           # rugnux is in an archive of its own, not in the app
           find "$app" -name rugnux > /tmp/jfjv.extra
           if [ -s /tmp/jfjv.extra ]; then cat /tmp/jfjv.extra; echo "the bundle carries another program"; exit 1; fi
-          codesign -d --verbose=2 "$app" 2>&1 | grep -q "flags=.*runtime" || { echo "no hardened runtime"; exit 1; }
+          # to a file, not piped into `grep -q` (see "Verify rugnux is self-contained" above)
+          codesign -d --verbose=2 "$app" > /tmp/jfjv.sig 2>&1
+          if ! grep -q "flags=.*runtime" /tmp/jfjv.sig; then cat /tmp/jfjv.sig; echo "no hardened runtime"; exit 1; fi
           echo "self-contained and validly signed"
       - name: Verify rugnux is self-contained
         shell: bash
@@ -311,7 +313,8 @@ jobs:
           if ! grep -qi "usage" /tmp/rgxm.out; then cat /tmp/rgxm.out; echo "rugnux did not start"; exit 1; fi
           # and carries the Developer ID signature with the hardened runtime that notarization demands
           codesign --verify --strict "$bin"
-          codesign -d --verbose=2 "$bin" 2>&1 | grep -q "flags=.*runtime" || { echo "no hardened runtime"; exit 1; }
+          codesign -d --verbose=2 "$bin" > /tmp/rgxm.sig 2>&1
+          if ! grep -q "flags=.*runtime" /tmp/rgxm.sig; then cat /tmp/rgxm.sig; echo "no hardened runtime"; exit 1; fi
           echo "self-contained, runs and is validly signed"
       # Every push, not only a release: a rejection by Apple (a library macdeployqt left unsigned, an
       # entitlement the hardened runtime needs) should show up when the change is made, not when the