diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bfd58ac..cbfe351 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,6 +40,12 @@ jobs:
       - name: Build Download Notebooks (sphinx-tojupyter)
         shell: bash -l {0}
         run: |
+          # `shell: bash -l {0}` is a custom shell spec, so GitHub does not inject
+          # `-eo pipefail` (it only does that for the bare `shell: bash` shorthand).
+          # Without this, a failing `jb build` would be masked by the trailing
+          # mkdir/cp, whose exit code becomes the step's — and `--keep-going`
+          # guarantees the .ipynb files exist for `cp` to succeed on.
+          set -eo pipefail
           jb build lectures --path-output ./ --builder=custom --custom-builder=jupyter -n -W --keep-going
           mkdir -p _build/html/_notebooks
           cp -u _build/jupyter/*.ipynb _build/html/_notebooks