diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
index cb174cc..b381d18 100644
--- a/.github/workflows/style.yml
+++ b/.github/workflows/style.yml
@@ -7,9 +7,9 @@ on: [push, pull_request]
 
 jobs:
   drift:
-    uses: tap/taphouse/.github/workflows/drift-check.yml@v6
+    uses: tap/taphouse/.github/workflows/drift-check.yml@v7
     with:
-      ref: v6
+      ref: v7
       icon: MuTap
 
   clang-tidy:
diff --git a/scripts/tidy.sh b/scripts/tidy.sh
index 45fc009..fecc294 100755
--- a/scripts/tidy.sh
+++ b/scripts/tidy.sh
@@ -63,7 +63,13 @@ echo "== clang-tidy ($tidy) over ${#files[@]} file(s) =="
 fail=0
 for f in "${files[@]}"; do
     out="$("$tidy" -p "$build" "$f" 2>/dev/null || true)"
-    if printf '%s\n' "$out" | grep -qE "warning:|error:"; then
+    # Test the captured output in-process, never through a pipe. Under pipefail,
+    # `printf '%s\n' "$out" | grep -q …` fails whenever grep quits at its first
+    # match while printf still has more than a pipe buffer to write (SIGPIPE) —
+    # and the `if` then took the CLEAN branch over real warnings. TapHouse's
+    # scripts/test-tidy.sh feeds this script multi-megabyte output to prove the
+    # verdict holds.
+    if [[ "$out" =~ (warning:|error:) ]]; then
         printf '%s\n' "$out"
         fail=1
     fi