diff --git a/.github/workflows/forgetest-ci.yml b/.github/workflows/forgetest-ci.yml
index 8b87c92..68e02cd 100644
--- a/.github/workflows/forgetest-ci.yml
+++ b/.github/workflows/forgetest-ci.yml
@@ -143,10 +143,13 @@ jobs:
 
       - name: No undefined names (the live drills never execute on the host)
         working-directory: forgefirm/forgetest
+        # pyflakes exits 1 for any message, unused imports included, so the
+        # grep is the gate; any other status (a signal, a usage error) or a
+        # capture that cannot be written fails the step.
         run: |
           python -m pip install pyflakes
           python -B -m pyflakes --version
-          python -B -m pyflakes forgetest tests > pyflakes.txt 2>&1 || true
+          { python -B -m pyflakes forgetest tests || test $? -eq 1; } > pyflakes.txt 2>&1
           if grep -E "undefined name|Traceback" pyflakes.txt; then exit 1; fi
 
       - name: Shared UI files match forgectrl at its pinned revision