diff --git a/.github/scripts/npm-e2e.sh b/.github/scripts/npm-e2e.sh
index e10b2ffe..e3948e49 100755
--- a/.github/scripts/npm-e2e.sh
+++ b/.github/scripts/npm-e2e.sh
@@ -282,7 +282,10 @@ mkdir -p "$work/yarn-project"
   python3 "$work/answer.py" Username "$admin_user" Password "$admin_password" -- \
     node "$yarn_js" npm login > "$work/yarn-login.out" 2>&1 \
     || fail "yarn npm login: $(cat "$work/yarn-login.out")"
-  node "$yarn_js" npm whoami | grep -q "$admin_user" || fail "yarn npm whoami"
+  # Read the output whole: a `| grep -q` that exits at its match leaves Yarn
+  # writing into a closed pipe, which it dies of (EPIPE).
+  who=$(node "$yarn_js" npm whoami 2>&1) || fail "yarn npm whoami: $who"
+  [[ "$who" == *"$admin_user"* ]] || fail "yarn npm whoami: $who"
 )
 grep -q npmAuthToken "$HOME/.yarnrc.yml" || fail "yarn stored no token"
 # A wrong password is refused.
@@ -298,7 +301,7 @@ code=$(curl -sS -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $throwa
 [ "$code" = 401 ] || fail "a logged-out token answered $code"
 
 step "the group keeps the internal scope internal"
-npm view @acme/ui version --registry "$(reg npm-proxy)" | grep -qx 9.9.9 \
+[ "$(npm view @acme/ui version --registry "$(reg npm-proxy)")" = 9.9.9 ] \
   || fail "the proxy does not see the upstream's @acme/ui"
 if npm view @acme/ui --registry "$(reg npm-all)" > "$work/guard.out" 2>&1; then
   fail "the group served the upstream's @acme/ui: $(cat "$work/guard.out")"
@@ -325,7 +328,7 @@ package "$work/src/pnpm-made" pnpm-made 1.0.0
 # Through the group: it lands in the writable member.
 (cd "$work/src/acme-core" && npm publish --registry "$(reg npm-all)") >/dev/null
 (cd "$work/src/pnpm-made" && pnpm publish --no-git-checks --registry "$(reg npm-hosted)") >/dev/null
-npm view @acme/core version --registry "$(reg npm-hosted)" | grep -qx 1.0.0 \
+[ "$(npm view @acme/core version --registry "$(reg npm-hosted)")" = 1.0.0 ] \
   || fail "a publish through the group did not land in npm-hosted"
 # --force: npm 11 refuses a version the registry lists by itself; the
 # server must refuse it too.
@@ -406,7 +409,8 @@ grep -qx 'latest: 1.1.0' "$work/tags.out" && grep -qx 'legacy: 1.0.0' "$work/tag
 (cd "$work/use-hosted" && npm install e2e-hosted@legacy) >/dev/null
 [ "$(version_of "$work/use-hosted/node_modules/e2e-hosted")" = 1.0.0 ] || fail "install by dist-tag"
 npm dist-tag rm e2e-hosted legacy "${hosted[@]}" >/dev/null
-npm dist-tag ls e2e-hosted "${hosted[@]}" | grep -q legacy && fail "dist-tag rm"
+tags=$(npm dist-tag ls e2e-hosted "${hosted[@]}") || fail "npm dist-tag ls"
+[[ "$tags" != *legacy* ]] || fail "dist-tag rm: $tags"
 npm deprecate e2e-hosted@1.0.0 "use 1.1.0" "${hosted[@]}" >/dev/null
 [ "$(npm view e2e-hosted@1.0.0 deprecated "${hosted[@]}")" = "use 1.1.0" ] || fail "npm deprecate"
 rm -rf "$work/use-hosted/node_modules"