diff --git a/spindle/engines/nixery/engine.go b/spindle/engines/nixery/engine.go
index cb46edc9..847693ef 100644
--- a/spindle/engines/nixery/engine.go
+++ b/spindle/engines/nixery/engine.go
@@ -374,25 +374,25 @@ func (e *Engine) RunStep(ctx context.Context, wid models.WorkflowId, w *models.W
 		tailDone <- e.tailStep(ctx, wfLogger, mkExecResp.ID, idx)
 	}()
 
+	// prefer tailDone over ctx.Done() to avoid false positives
+	// when step completes at the same moment the deadline expires
 	select {
 	case <-tailDone:
+	default:
+		select {
+		case <-tailDone:
 
-	case <-ctx.Done():
-		// cleanup will be handled by DestroyWorkflow, since
-		// Docker doesn't provide an API to kill an exec run
-		// (sure, we could grab the PID and kill it ourselves,
-		// but that's wasted effort)
-		e.l.Warn("step timed out", "step", step.Name())
+		case <-ctx.Done():
+			// cleanup will be handled by DestroyWorkflow, since
+			// Docker doesn't provide an API to kill an exec run
+			// (sure, we could grab the PID and kill it ourselves,
+			// but that's wasted effort)
+			e.l.Warn("step timed out", "step", step.Name())
 
-		<-tailDone
+			<-tailDone
 
-		return engine.ErrTimedOut
-	}
-
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	default:
+			return engine.ErrTimedOut
+		}
 	}
 
 	execInspectResp, err := e.docker.ContainerExecInspect(ctx, mkExecResp.ID)