diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 85298e575..5f13500d6 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -80,7 +80,12 @@ jobs:
           checked=0
 
           while IFS= read -r sha; do
-            if git show -s --format='%B' "$sha" | grep -qiE "$DISALLOWED_TRAILER_PATTERN"; then
+            # grep -c, not grep -q. Under pipefail, grep -q exits on its first
+            # match while git is still writing, git takes SIGPIPE and returns
+            # 141, and the pipeline result turns a real match into a miss for
+            # any message larger than the pipe buffer. grep -c reads to the end,
+            # so the writer always finishes (z-shell/.github#587).
+            if [ "$(git show -s --format='%B' "$sha" | grep -ciE "$DISALLOWED_TRAILER_PATTERN")" -gt 0 ]; then
               echo "::error::Bot/agent Co-authored-by trailer found (${sha:0:7}): remove before merging. A human co-author is fine; only bot/AI-agent identities are banned (AGENTS.md). A squash merge without an explicit --subject/--body can also reintroduce one — see runbooks/branch-protection.md."
               errors=$((errors + 1))
             fi