diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c145ac947a3..ba8d9610fef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -132,9 +132,8 @@ jobs:
           ! GREP_COLORS='ms=30;48;5;214' grep --color=always -Ex -C 1000000 -e "$pattern" tree.txt
         continue-on-error: true
       - name: Check for unrecognized *-sys dependencies
-        # TODO: remove `libz-rs|` once https://github.com/rust-lang/flate2-rs/pull/520 is merged.
         run: |
-          ! grep -qP '(?<!\b(linux-raw|libz-rs|aws-lc))-sys\b' tree.txt
+          ! grep -qP '(?<!\b(linux-raw|aws-lc))-sys\b' tree.txt
       - name: Wrap cc1 (and cc1plus if present) to record calls
         run: |
           set -o noclobber  # Catch any collisions with existing entries in /usr/local.
@@ -259,7 +258,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        shell: bash
+        shell: bash  # Use `bash` on all OSes, for `set -e` behavior.
         run: |
           rustup update stable
           rustup default stable
@@ -275,6 +274,12 @@ jobs:
       - name: Test (nextest)
         env:
           GIX_TEST_CREATE_ARCHIVES_EVEN_ON_CI: '1'
+        # We deliberately let this step use different shells on different OSes, each the runner
+        # default: `bash` on Ubuntu and macOS, but `pwsh` on Windows. `bash` on Windows runners
+        # would use a modified ("Git Bash") environment that is in some ways nicer for our tests,
+        # due to being more in line with some Unix-oriented assumptions. So we need to verify that
+        # the test suite is compatible with being run even outside that environment, including that
+        # `gix-testtools` is still able to run fixture scripts with the `bash` shell as intended.
         run: |  # zizmor: ignore[template-injection]
           cargo nextest run --workspace --no-fail-fast -- ${{ matrix.test-args }}
       - name: Check that tracked archives are up to date
@@ -320,7 +325,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        shell: bash
+        shell: bash  # Use `bash` (not `pwsh`), for `set -e` behavior.
         run: |
           rustup update stable
           rustup default stable
@@ -435,7 +440,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Rust
-        shell: bash
+        shell: bash  # Use `bash` (not `pwsh`), for `$` expansion and `set -e` behavior.
         run: |
           rustup update stable
           rustup default stable