diff --git a/mise.lock b/mise.lock
index 664d8f0d9..a02f45dc9 100644
--- a/mise.lock
+++ b/mise.lock
@@ -18,6 +18,7 @@ url = "https://github.com/bats-core/bats-core/archive/refs/tags/v1.13.0.tar.gz"
 url = "https://github.com/bats-core/bats-core/archive/refs/tags/v1.13.0.tar.gz"
 
 [tools.bats."platforms.macos-arm64"]
+checksum = "blake3:d34af9fd0f9101d5309b2de31f3d1699e56a574d7d4b5e6380580a9e758a9744"
 url = "https://github.com/bats-core/bats-core/archive/refs/tags/v1.13.0.tar.gz"
 
 [tools.bats."platforms.macos-x64"]
diff --git a/shell/lib/docker/authn/aws-ecr.sh b/shell/lib/docker/authn/aws-ecr.sh
index 27fd7aacc..7128af166 100644
--- a/shell/lib/docker/authn/aws-ecr.sh
+++ b/shell/lib/docker/authn/aws-ecr.sh
@@ -14,7 +14,9 @@ ecr_auth() {
   region="$(echo "$registry" | cut -d. -f4)"
   info_sub "Authenticating with AWS ECR in $registry"
   # See: https://docs.aws.amazon.com/AmazonECR/latest/userguide/registry_auth.html#registry-auth-token
-  aws ecr get-login-password --region "$region" | docker login --username AWS --password-stdin "$registry"
+  # Capture the password first to avoid pipe stdin issues in non-TTY CI environments.
+  ecr_password="$(aws ecr get-login-password --region "$region")"
+  docker login --username AWS --password-stdin "$registry" <<<"$ecr_password"
 }
 
 # ensure_ecr_repository ensures that an ECR repository exists.