diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 958d9b67bdf9b..8971f18afc828 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,9 @@ name: CI
   pull_request:
     branches:
       - "**"
+defaults:
+  run:
+    shell: "python src/ci/exec-with-shell.py {0}"
 jobs:
   pr:
     name: PR
@@ -68,79 +71,60 @@ jobs:
         run: src/ci/scripts/setup-environment.sh
         env:
           EXTRA_VARIABLES: "${{ toJson(matrix.env) }}"
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: decide whether to skip this job
         run: src/ci/scripts/should-skip-this.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: collect CPU statistics
         run: src/ci/scripts/collect-cpu-stats.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: show the current environment
         run: src/ci/scripts/dump-environment.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install awscli
         run: src/ci/scripts/install-awscli.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install sccache
         run: src/ci/scripts/install-sccache.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install clang
         run: src/ci/scripts/install-clang.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install WIX
         run: src/ci/scripts/install-wix.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install InnoSetup
         run: src/ci/scripts/install-innosetup.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: ensure the build happens on a partition with enough space
         run: src/ci/scripts/symlink-build-dir.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: disable git crlf conversion
         run: src/ci/scripts/disable-git-crlf-conversion.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MSYS2
         run: src/ci/scripts/install-msys2.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MSYS2 packages
         run: src/ci/scripts/install-msys2-packages.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MinGW
         run: src/ci/scripts/install-mingw.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install ninja
         run: src/ci/scripts/install-ninja.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: enable ipv6 on Docker
         run: src/ci/scripts/enable-docker-ipv6.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: disable git crlf conversion
         run: src/ci/scripts/disable-git-crlf-conversion.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: checkout submodules
         run: src/ci/scripts/checkout-submodules.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: ensure line endings are correct
         run: src/ci/scripts/verify-line-endings.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: run the build
         run: src/ci/scripts/run-build-from-ci.sh
@@ -148,7 +132,6 @@ jobs:
           AWS_ACCESS_KEY_ID: "${{ env.CACHES_AWS_ACCESS_KEY_ID }}"
           AWS_SECRET_ACCESS_KEY: "${{ secrets[format('AWS_SECRET_ACCESS_KEY_{0}', env.CACHES_AWS_ACCESS_KEY_ID)] }}"
           TOOLSTATE_REPO_ACCESS_TOKEN: "${{ secrets.TOOLSTATE_REPO_ACCESS_TOKEN }}"
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: upload artifacts to S3
         run: src/ci/scripts/upload-artifacts.sh
@@ -156,7 +139,6 @@ jobs:
           AWS_ACCESS_KEY_ID: "${{ env.ARTIFACTS_AWS_ACCESS_KEY_ID }}"
           AWS_SECRET_ACCESS_KEY: "${{ secrets[format('AWS_SECRET_ACCESS_KEY_{0}', env.ARTIFACTS_AWS_ACCESS_KEY_ID)] }}"
         if: "success() && !env.SKIP_JOB && (github.event_name == 'push' || env.DEPLOY == '1' || env.DEPLOY_ALT == '1')"
-        shell: "python src/ci/exec-with-shell.py {0}"
   try:
     name: try
     env:
@@ -201,79 +183,60 @@ jobs:
         run: src/ci/scripts/setup-environment.sh
         env:
           EXTRA_VARIABLES: "${{ toJson(matrix.env) }}"
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: decide whether to skip this job
         run: src/ci/scripts/should-skip-this.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: collect CPU statistics
         run: src/ci/scripts/collect-cpu-stats.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: show the current environment
         run: src/ci/scripts/dump-environment.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install awscli
         run: src/ci/scripts/install-awscli.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install sccache
         run: src/ci/scripts/install-sccache.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install clang
         run: src/ci/scripts/install-clang.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install WIX
         run: src/ci/scripts/install-wix.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install InnoSetup
         run: src/ci/scripts/install-innosetup.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: ensure the build happens on a partition with enough space
         run: src/ci/scripts/symlink-build-dir.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: disable git crlf conversion
         run: src/ci/scripts/disable-git-crlf-conversion.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MSYS2
         run: src/ci/scripts/install-msys2.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MSYS2 packages
         run: src/ci/scripts/install-msys2-packages.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MinGW
         run: src/ci/scripts/install-mingw.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install ninja
         run: src/ci/scripts/install-ninja.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: enable ipv6 on Docker
         run: src/ci/scripts/enable-docker-ipv6.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: disable git crlf conversion
         run: src/ci/scripts/disable-git-crlf-conversion.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: checkout submodules
         run: src/ci/scripts/checkout-submodules.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: ensure line endings are correct
         run: src/ci/scripts/verify-line-endings.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: run the build
         run: src/ci/scripts/run-build-from-ci.sh
@@ -281,7 +244,6 @@ jobs:
           AWS_ACCESS_KEY_ID: "${{ env.CACHES_AWS_ACCESS_KEY_ID }}"
           AWS_SECRET_ACCESS_KEY: "${{ secrets[format('AWS_SECRET_ACCESS_KEY_{0}', env.CACHES_AWS_ACCESS_KEY_ID)] }}"
           TOOLSTATE_REPO_ACCESS_TOKEN: "${{ secrets.TOOLSTATE_REPO_ACCESS_TOKEN }}"
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: upload artifacts to S3
         run: src/ci/scripts/upload-artifacts.sh
@@ -289,7 +251,6 @@ jobs:
           AWS_ACCESS_KEY_ID: "${{ env.ARTIFACTS_AWS_ACCESS_KEY_ID }}"
           AWS_SECRET_ACCESS_KEY: "${{ secrets[format('AWS_SECRET_ACCESS_KEY_{0}', env.ARTIFACTS_AWS_ACCESS_KEY_ID)] }}"
         if: "success() && !env.SKIP_JOB && (github.event_name == 'push' || env.DEPLOY == '1' || env.DEPLOY_ALT == '1')"
-        shell: "python src/ci/exec-with-shell.py {0}"
   auto:
     name: auto
     env:
@@ -631,79 +592,60 @@ jobs:
         run: src/ci/scripts/setup-environment.sh
         env:
           EXTRA_VARIABLES: "${{ toJson(matrix.env) }}"
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: decide whether to skip this job
         run: src/ci/scripts/should-skip-this.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: collect CPU statistics
         run: src/ci/scripts/collect-cpu-stats.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: show the current environment
         run: src/ci/scripts/dump-environment.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install awscli
         run: src/ci/scripts/install-awscli.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install sccache
         run: src/ci/scripts/install-sccache.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install clang
         run: src/ci/scripts/install-clang.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install WIX
         run: src/ci/scripts/install-wix.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install InnoSetup
         run: src/ci/scripts/install-innosetup.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: ensure the build happens on a partition with enough space
         run: src/ci/scripts/symlink-build-dir.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: disable git crlf conversion
         run: src/ci/scripts/disable-git-crlf-conversion.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MSYS2
         run: src/ci/scripts/install-msys2.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MSYS2 packages
         run: src/ci/scripts/install-msys2-packages.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install MinGW
         run: src/ci/scripts/install-mingw.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: install ninja
         run: src/ci/scripts/install-ninja.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: enable ipv6 on Docker
         run: src/ci/scripts/enable-docker-ipv6.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: disable git crlf conversion
         run: src/ci/scripts/disable-git-crlf-conversion.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: checkout submodules
         run: src/ci/scripts/checkout-submodules.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: ensure line endings are correct
         run: src/ci/scripts/verify-line-endings.sh
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: run the build
         run: src/ci/scripts/run-build-from-ci.sh
@@ -711,7 +653,6 @@ jobs:
           AWS_ACCESS_KEY_ID: "${{ env.CACHES_AWS_ACCESS_KEY_ID }}"
           AWS_SECRET_ACCESS_KEY: "${{ secrets[format('AWS_SECRET_ACCESS_KEY_{0}', env.CACHES_AWS_ACCESS_KEY_ID)] }}"
           TOOLSTATE_REPO_ACCESS_TOKEN: "${{ secrets.TOOLSTATE_REPO_ACCESS_TOKEN }}"
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
       - name: upload artifacts to S3
         run: src/ci/scripts/upload-artifacts.sh
@@ -719,7 +660,6 @@ jobs:
           AWS_ACCESS_KEY_ID: "${{ env.ARTIFACTS_AWS_ACCESS_KEY_ID }}"
           AWS_SECRET_ACCESS_KEY: "${{ secrets[format('AWS_SECRET_ACCESS_KEY_{0}', env.ARTIFACTS_AWS_ACCESS_KEY_ID)] }}"
         if: "success() && !env.SKIP_JOB && (github.event_name == 'push' || env.DEPLOY == '1' || env.DEPLOY_ALT == '1')"
-        shell: "python src/ci/exec-with-shell.py {0}"
   master:
     name: master
     runs-on: ubuntu-latest
@@ -741,7 +681,6 @@ jobs:
         run: src/ci/publish_toolstate.sh
         env:
           TOOLSTATE_REPO_ACCESS_TOKEN: "${{ secrets.TOOLSTATE_REPO_ACCESS_TOKEN }}"
-        shell: "python src/ci/exec-with-shell.py {0}"
         if: success() && !env.SKIP_JOB
   try-success:
     needs:
diff --git a/src/ci/github-actions/ci.yml b/src/ci/github-actions/ci.yml
index df1467ea73a12..88ef6b42f106d 100644
--- a/src/ci/github-actions/ci.yml
+++ b/src/ci/github-actions/ci.yml
@@ -70,21 +70,6 @@ x--expand-yaml-anchors--remove:
   - &step
     if: success() && !env.SKIP_JOB
 
-  - &step-run
-    <<: *step
-    # While on Linux and macOS builders it just forwards the arguments to the
-    # system bash, this wrapper allows switching from the host's bash.exe to
-    # the one we install along with MSYS2 mid-build on Windows.
-    #
-    # Once the step to install MSYS2 is executed, the CI_OVERRIDE_SHELL
-    # environment variable is set pointing to our MSYS2's bash.exe. From that
-    # moment the host's bash.exe will not be called anymore.
-    #
-    # This is needed because we can't launch our own bash.exe from the host
-    # bash.exe, as that would load two different cygwin1.dll in memory, causing
-    # "cygwin heap mismatch" errors.
-    shell: python src/ci/exec-with-shell.py {0}
-
   - &base-ci-job
     timeout-minutes: 600
     runs-on: "${{ matrix.os }}"
@@ -114,67 +99,67 @@ x--expand-yaml-anchors--remove:
           # are passed to the `setup-environment.sh` script encoded in JSON,
           # which then uses log commands to actually set them.
           EXTRA_VARIABLES: ${{ toJson(matrix.env) }}
-        <<: *step-run
+        <<: *step
 
       - name: decide whether to skip this job
         run: src/ci/scripts/should-skip-this.sh
-        <<: *step-run
+        <<: *step
 
       - name: collect CPU statistics
         run: src/ci/scripts/collect-cpu-stats.sh
-        <<: *step-run
+        <<: *step
 
       - name: show the current environment
         run: src/ci/scripts/dump-environment.sh
-        <<: *step-run
+        <<: *step
 
       - name: install awscli
         run: src/ci/scripts/install-awscli.sh
-        <<: *step-run
+        <<: *step
 
       - name: install sccache
         run: src/ci/scripts/install-sccache.sh
-        <<: *step-run
+        <<: *step
 
       - name: install clang
         run: src/ci/scripts/install-clang.sh
-        <<: *step-run
+        <<: *step
 
       - name: install WIX
         run: src/ci/scripts/install-wix.sh
-        <<: *step-run
+        <<: *step
 
       - name: install InnoSetup
         run: src/ci/scripts/install-innosetup.sh
-        <<: *step-run
+        <<: *step
 
       - name: ensure the build happens on a partition with enough space
         run: src/ci/scripts/symlink-build-dir.sh
-        <<: *step-run
+        <<: *step
 
       - name: disable git crlf conversion
         run: src/ci/scripts/disable-git-crlf-conversion.sh
-        <<: *step-run
+        <<: *step
 
       - name: install MSYS2
         run: src/ci/scripts/install-msys2.sh
-        <<: *step-run
+        <<: *step
 
       - name: install MSYS2 packages
         run: src/ci/scripts/install-msys2-packages.sh
-        <<: *step-run
+        <<: *step
 
       - name: install MinGW
         run: src/ci/scripts/install-mingw.sh
-        <<: *step-run
+        <<: *step
 
       - name: install ninja
         run: src/ci/scripts/install-ninja.sh
-        <<: *step-run
+        <<: *step
 
       - name: enable ipv6 on Docker
         run: src/ci/scripts/enable-docker-ipv6.sh
-        <<: *step-run
+        <<: *step
 
       # Disable automatic line ending conversion (again). On Windows, when we're
       # installing dependencies, something switches the git configuration directory or
@@ -183,15 +168,15 @@ x--expand-yaml-anchors--remove:
       # appropriate line endings.
       - name: disable git crlf conversion
         run: src/ci/scripts/disable-git-crlf-conversion.sh
-        <<: *step-run
+        <<: *step
 
       - name: checkout submodules
         run: src/ci/scripts/checkout-submodules.sh
-        <<: *step-run
+        <<: *step
 
       - name: ensure line endings are correct
         run: src/ci/scripts/verify-line-endings.sh
-        <<: *step-run
+        <<: *step
 
       - name: run the build
         run: src/ci/scripts/run-build-from-ci.sh
@@ -199,7 +184,7 @@ x--expand-yaml-anchors--remove:
           AWS_ACCESS_KEY_ID: ${{ env.CACHES_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets[format('AWS_SECRET_ACCESS_KEY_{0}', env.CACHES_AWS_ACCESS_KEY_ID)] }}
           TOOLSTATE_REPO_ACCESS_TOKEN: ${{ secrets.TOOLSTATE_REPO_ACCESS_TOKEN }}
-        <<: *step-run
+        <<: *step
 
       - name: upload artifacts to S3
         run: src/ci/scripts/upload-artifacts.sh
@@ -212,7 +197,7 @@ x--expand-yaml-anchors--remove:
         # deploying artifacts from a dist builder if the variables are misconfigured,
         # erroring about invalid credentials instead.
         if: success() && !env.SKIP_JOB && (github.event_name == 'push' || env.DEPLOY == '1' || env.DEPLOY_ALT == '1')
-        <<: *step-run
+        <<: *step
 
   # These snippets are used by the try-success, try-failure, auto-success and auto-failure jobs.
   # Check out their documentation for more information on why they're needed.
@@ -248,6 +233,21 @@ on:
     branches:
       - "**"
 
+defaults:
+  run:
+    # While on Linux and macOS builders it just forwards the arguments to the
+    # system bash, this wrapper allows switching from the host's bash.exe to
+    # the one we install along with MSYS2 mid-build on Windows.
+    #
+    # Once the step to install MSYS2 is executed, the CI_OVERRIDE_SHELL
+    # environment variable is set pointing to our MSYS2's bash.exe. From that
+    # moment the host's bash.exe will not be called anymore.
+    #
+    # This is needed because we can't launch our own bash.exe from the host
+    # bash.exe, as that would load two different cygwin1.dll in memory, causing
+    # "cygwin heap mismatch" errors.
+    shell: python src/ci/exec-with-shell.py {0}
+
 jobs:
   pr:
     <<: *base-ci-job
@@ -687,7 +687,7 @@ jobs:
         run: src/ci/publish_toolstate.sh
         env:
           TOOLSTATE_REPO_ACCESS_TOKEN: ${{ secrets.TOOLSTATE_REPO_ACCESS_TOKEN }}
-        <<: *step-run
+        <<: *step
 
   # These jobs don't actually test anything, but they're used to tell bors the
   # build completed, as there is no practical way to detect when a workflow is