diff --git a/scripts/ci/sandboxed_web_e2e.py b/scripts/ci/sandboxed_web_e2e.py
index ae0c3105a..5f6c4ddb5 100644
--- a/scripts/ci/sandboxed_web_e2e.py
+++ b/scripts/ci/sandboxed_web_e2e.py
@@ -102,7 +102,7 @@ def start_service(label: str, command: str, cwd: Path, env: dict[str, str], logs
     """Start a service command in its own process group."""
     log_path = logs_dir / f"{label}.log"
     log_file = log_path.open("w", encoding="utf-8")
-    process = subprocess.Popen(
+    process = subprocess.Popen(  # nosec B603
         shlex.split(command),
         cwd=cwd,
         env=env,
@@ -110,6 +110,7 @@ def start_service(label: str, command: str, cwd: Path, env: dict[str, str], logs
         stdout=log_file,
         stderr=subprocess.STDOUT,
         start_new_session=True,
+        shell=False,
     )
     log_file.close()
     return Service(label=label, command=command, process=process, log_path=log_path)
@@ -137,7 +138,7 @@ def wait_for_url(url: str, timeout: int, service: Service) -> bool:
 
 def run_shell(command: str, cwd: Path, env: dict[str, str], timeout: int) -> subprocess.CompletedProcess[str]:
     """Run a shell command and capture its output."""
-    return subprocess.run(
+    return subprocess.run(  # nosec B603
         shlex.split(command),
         cwd=cwd,
         env=env,
@@ -146,6 +147,7 @@ def run_shell(command: str, cwd: Path, env: dict[str, str], timeout: int) -> sub
         stderr=subprocess.PIPE,
         timeout=timeout,
         check=False,
+        shell=False,
     )
 
 
diff --git a/tests/test_sandboxed_web_e2e.py b/tests/test_sandboxed_web_e2e.py
index 6e092c293..a51051f27 100644
--- a/tests/test_sandboxed_web_e2e.py
+++ b/tests/test_sandboxed_web_e2e.py
@@ -181,13 +181,13 @@ def fake_run(*args, **kwargs):
     assert service.command == "npm run dev"
     assert service.log_path == tmp_path / "backend.log"
     assert popen_calls[0][0] == (["npm", "run", "dev"],)
-    assert "shell" not in popen_calls[0][1]
+    assert popen_calls[0][1].get("shell") is False
     assert "executable" not in popen_calls[0][1]
     assert popen_calls[0][1]["start_new_session"] is True
     assert completed.returncode == 7
     assert run_calls[0][0] == (["npm", "test"],)
     assert run_calls[0][1]["timeout"] == 5
-    assert "shell" not in run_calls[0][1]
+    assert run_calls[0][1].get("shell") is False
     assert "executable" not in run_calls[0][1]