diff --git a/yaml/github-actions/security/curl-eval.test.yaml b/yaml/github-actions/security/curl-eval.test.yaml
index f63db6e3e7..8c70e69bd0 100644
--- a/yaml/github-actions/security/curl-eval.test.yaml
+++ b/yaml/github-actions/security/curl-eval.test.yaml
@@ -23,3 +23,17 @@ jobs:
         run: |
           CONTENTS=$(curl https://blah.com)
           eval $CONTENTS
+      - name: Explicit Bash shell
+        shell: bash
+        # ruleid: curl-eval
+        run: |
+          CONTENTS=$(curl https://blah.com)
+          eval $CONTENTS
+      - name: Prepare Windows cache
+        shell: pwsh
+        # ok: curl-eval
+        run: |
+          $cacheDirs = @("D:\cache")
+          foreach ($dir in $cacheDirs) {
+            New-Item -ItemType Directory -Path $dir -Force | Out-Null
+          }
diff --git a/yaml/github-actions/security/curl-eval.yaml b/yaml/github-actions/security/curl-eval.yaml
index 3560c4aaee..2e2e4e5647 100644
--- a/yaml/github-actions/security/curl-eval.yaml
+++ b/yaml/github-actions/security/curl-eval.yaml
@@ -29,9 +29,23 @@ rules:
     confidence: LOW
   patterns:
   - pattern-inside: 'steps: [...]'
-  - pattern-inside: |
-      - run: ...
-        ...
+  - pattern-either:
+    - patterns:
+      - pattern-inside: |
+          - run: ...
+            ...
+      - pattern-not-inside: |
+          - run: ...
+            shell: ...
+            ...
+    - patterns:
+      - pattern-inside: |
+          - run: ...
+            shell: $STEP_SHELL
+            ...
+      - metavariable-regex:
+          metavariable: $STEP_SHELL
+          regex: '^(bash|sh)(\s+.*)?$'
   - pattern: 'run: $SHELL'
   - metavariable-pattern:
       language: bash
diff --git a/yaml/github-actions/security/gha-curl-pipe-shell.test.yaml b/yaml/github-actions/security/gha-curl-pipe-shell.test.yaml
index cc5b2fb509..f6e671f502 100644
--- a/yaml/github-actions/security/gha-curl-pipe-shell.test.yaml
+++ b/yaml/github-actions/security/gha-curl-pipe-shell.test.yaml
@@ -32,6 +32,10 @@ jobs:
       # ruleid: gha-curl-pipe-shell
       - run: wget -qO- https://example.com/setup.sh | bash
 
+      - shell: bash
+        # ruleid: gha-curl-pipe-shell
+        run: curl -fsSL https://example.com/install.sh | bash
+
       - name: multiline curl pipe bash
         # ruleid: gha-curl-pipe-shell
         run: |
@@ -57,3 +61,12 @@ jobs:
           curl -fsSL https://example.com/install.sh -o /tmp/install.sh
           sha256sum /tmp/install.sh
           bash /tmp/install.sh
+
+      - name: Prepare Windows cache
+        shell: pwsh
+        # ok: gha-curl-pipe-shell
+        run: |
+          $cacheDirs = @("D:\cache")
+          foreach ($dir in $cacheDirs) {
+            New-Item -ItemType Directory -Path $dir -Force | Out-Null
+          }
diff --git a/yaml/github-actions/security/gha-curl-pipe-shell.yaml b/yaml/github-actions/security/gha-curl-pipe-shell.yaml
index 228fd49c6c..df538964a2 100644
--- a/yaml/github-actions/security/gha-curl-pipe-shell.yaml
+++ b/yaml/github-actions/security/gha-curl-pipe-shell.yaml
@@ -30,9 +30,23 @@ rules:
     confidence: HIGH
   patterns:
   - pattern-inside: 'steps: [...]'
-  - pattern-inside: |
-      - run: ...
-        ...
+  - pattern-either:
+    - patterns:
+      - pattern-inside: |
+          - run: ...
+            ...
+      - pattern-not-inside: |
+          - run: ...
+            shell: ...
+            ...
+    - patterns:
+      - pattern-inside: |
+          - run: ...
+            shell: $STEP_SHELL
+            ...
+      - metavariable-regex:
+          metavariable: $STEP_SHELL
+          regex: '^(bash|sh)(\s+.*)?$'
   - pattern: 'run: $SHELL'
   - metavariable-pattern:
       language: bash