diff --git a/.github/workflows/annotate.yml b/.github/workflows/annotate.yml
index 3b6e80af7116..9693e5085c02 100644
--- a/.github/workflows/annotate.yml
+++ b/.github/workflows/annotate.yml
@@ -6,6 +6,10 @@ on:
     types:
       - completed
 
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
 jobs:
   annotate:
     if: github.repository_owner == 'trinodb'
@@ -35,7 +39,7 @@ jobs:
               fs.writeFileSync('${{github.workspace}}/' + artifact.name + '.zip', Buffer.from(download.data));
             }
       - run: |
-          set -xeuo pipefail
+          set -x
           pwd
           ls
           for archive in *.zip; do
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 693624b1cfa9..031077a8af86 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,6 +8,10 @@ on:
     paths-ignore:
       - 'docs/**'
 
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
 env:
   # An envar that signals to tests we are executing in the CI environment
   CONTINUOUS_INTEGRATION: true
@@ -747,7 +751,7 @@ jobs:
           testing/bin/ptl suite run \
             --suite ${{ matrix.suite }} \
             --config config-${{ matrix.config }} \
-            $PTL_OPTS \
+            ${PTL_OPTS:-} \
             --bind=off --logs-dir logs/ --timeout 2h
       - name: Upload test logs and results
         uses: actions/upload-artifact@v2
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index ab5bc97bb2de..5bc17fdcddb3 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -5,6 +5,10 @@ on:
     paths:
       - 'docs/**'
 
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
 env:
   # An envar that signals to tests we are executing in the CI environment
   CONTINUOUS_INTEGRATION: true
diff --git a/.github/workflows/milestone.yml b/.github/workflows/milestone.yml
index bd6f184b2194..d0cede2e5a27 100644
--- a/.github/workflows/milestone.yml
+++ b/.github/workflows/milestone.yml
@@ -4,6 +4,10 @@ on:
   push:
     branches: [master]
 
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
 jobs:
   set-milestone:
     if: github.repository_owner == 'trinodb'