diff --git a/.tangled/workflows/publish-image.yml b/.tangled/workflows/publish-image.yml
index 56357aa..566552a 100644
--- a/.tangled/workflows/publish-image.yml
+++ b/.tangled/workflows/publish-image.yml
@@ -28,6 +28,10 @@ steps:
   - name: "Publish image on VERSION bump"
     command: |
       set -euo pipefail
+      # NixOS /etc/bash_logout reads $__ETC_BASHLOGOUT_SOURCED unguarded; sourced on (login)
+      # shell exit under `set -u` it errors ("unbound variable") and corrupts the step's exit
+      # code to 1 even on success. Bind it (exported → also covers nix-shell child shells).
+      export __ETC_BASHLOGOUT_SOURCED=1
       version="$(tr -d '[:space:]' < VERSION)"
       image="docker.io/lgtmsupplyco/commerce"
       # Skip if this VERSION is already on Docker Hub — most pushes to main (docs, the
diff --git a/.tangled/workflows/release-pr.yml b/.tangled/workflows/release-pr.yml
index 0ae89ec..0855db5 100644
--- a/.tangled/workflows/release-pr.yml
+++ b/.tangled/workflows/release-pr.yml
@@ -20,6 +20,9 @@ steps:
   - name: "Maintain release PR branch"
     command: |
       set -euo pipefail
+      # See publish-image.yml: bind $__ETC_BASHLOGOUT_SOURCED so NixOS /etc/bash_logout doesn't
+      # error under `set -u` on shell exit and corrupt the step's exit code.
+      export __ETC_BASHLOGOUT_SOURCED=1
       if [ -z "${KNOT_DEPLOY_KEY:-}" ]; then
         echo "KNOT_DEPLOY_KEY unset — release-PR automation disabled; skipping."
         exit 0