diff --git a/tools/desktop-release.ts b/tools/desktop-release.ts
index 44f3993..54cf8e7 100644
--- a/tools/desktop-release.ts
+++ b/tools/desktop-release.ts
@@ -773,7 +773,8 @@ async function publish(argv: string[]): Promise<void> {
     const lines = seed.map(x => { if (!/^[A-Za-z0-9._-]+$/.test(x.file) || !/^https:\/\/[A-Za-z0-9./_%-]+$/.test(x.url)) fail(`seed: unexpected ${x.file} ${x.url}`); return `curl -fsSL --max-time 900 -o '${dir}/${x.file}' '${x.url}' && echo '${x.sha256}  ${dir}/${x.file}' | sha256sum -c --quiet`; });
     say(`server: fetch ${seed.length} files from the Forgejo release`);
     // in parallel on the server; any failed download or hash fails the step
-    run(['ssh', host, `pids=''; ${lines.map(l => `(${l}) & pids="$pids $!"`).join('; ')}; for p in $pids; do wait $p || exit 1; done`], { stdio: ['ignore', 'inherit', 'inherit'] });
+    // the script goes to bash on stdin: the server's login shell may be zsh, which does not split "$pids"
+    run(['ssh', host, 'bash', '-s'], { input: `pids=''\n${lines.map(l => `(${l}) & pids="$pids $!"`).join('\n')}\nfor p in $pids; do wait $p || exit 1; done\n`, stdio: ['pipe', 'inherit', 'inherit'] });
   }
   say(`rsync (only what the server does not have yet) ...`);
   run(rsync, { stdio: ['ignore', 'inherit', 'inherit'] });