diff --git a/.changeset/patch-fix-gh-aw-binary-detection.md b/.changeset/patch-fix-gh-aw-binary-detection.md
new file mode 100644
index 00000000000..eba879119d8
--- /dev/null
+++ b/.changeset/patch-fix-gh-aw-binary-detection.md
@@ -0,0 +1,5 @@
+---
+"gh-aw": patch
+---
+
+Fix `gh-aw` binary detection in generated MCP setup steps so workflow runs do not fail under `bash -e` and `set -o pipefail` when the extension binary is installed outside `$PATH`.
diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index e43e6f6a8f1..25c05a14ffd 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -488,7 +488,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index 6ab9984ad2d..31adbf78859 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -492,7 +492,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/agentic-observability-kit.lock.yml b/.github/workflows/agentic-observability-kit.lock.yml
index c7b45e0d820..85bbc85294a 100644
--- a/.github/workflows/agentic-observability-kit.lock.yml
+++ b/.github/workflows/agentic-observability-kit.lock.yml
@@ -525,7 +525,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/agentic-optimization-kit.lock.yml b/.github/workflows/agentic-optimization-kit.lock.yml
index 2a088dc8eda..234b32048f0 100644
--- a/.github/workflows/agentic-optimization-kit.lock.yml
+++ b/.github/workflows/agentic-optimization-kit.lock.yml
@@ -474,7 +474,7 @@ jobs:
       - env:
           GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
         name: Install gh-aw extension
-        run: "# Install gh-aw if not already available\nif ! gh aw --version >/dev/null 2>&1; then\n  echo \"Installing gh-aw extension...\"\n  curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash\nfi\ngh aw --version\n# Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization\nmkdir -p \"${RUNNER_TEMP}/gh-aw\"\nGH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)\nif [ -n \"$GH_AW_BIN\" ] && [ -f \"$GH_AW_BIN\" ]; then\n  cp \"$GH_AW_BIN\" \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n  chmod +x \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n  echo \"Copied gh-aw binary to ${RUNNER_TEMP}/gh-aw/gh-aw\"\nelse\n  echo \"::error::Failed to find gh-aw binary for MCP server\"\n  exit 1\nfi\n"
+        run: "# Install gh-aw if not already available\nif ! gh aw --version >/dev/null 2>&1; then\n  echo \"Installing gh-aw extension...\"\n  curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash\nfi\ngh aw --version\n# Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization\nmkdir -p \"${RUNNER_TEMP}/gh-aw\"\nGH_AW_BIN=\"\"\nGH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true\nif [ -z \"$GH_AW_BIN\" ]; then\n  GH_AW_BIN=$(find \"${HOME}/.local/share/gh/extensions/gh-aw\" -name 'gh-aw' -type f 2>/dev/null | head -1) || true\nfi\nif [ -n \"$GH_AW_BIN\" ] && [ -f \"$GH_AW_BIN\" ]; then\n  cp \"$GH_AW_BIN\" \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n  chmod +x \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n  echo \"Copied gh-aw binary to ${RUNNER_TEMP}/gh-aw/gh-aw\"\nelse\n  echo \"::error::Failed to find gh-aw binary for MCP server\"\n  exit 1\nfi\n"
       - name: Setup Python environment
         run: "mkdir -p /tmp/gh-aw/python/{data,charts,artifacts}\n# Create a virtual environment for proper package isolation (avoids --break-system-packages)\nif [ ! -d /tmp/gh-aw/venv ]; then\n  python3 -m venv /tmp/gh-aw/venv\nfi\necho \"/tmp/gh-aw/venv/bin\" >> \"$GITHUB_PATH\"\n/tmp/gh-aw/venv/bin/pip install --quiet numpy pandas matplotlib seaborn scipy\n"
       - if: always()
diff --git a/.github/workflows/api-consumption-report.lock.yml b/.github/workflows/api-consumption-report.lock.yml
index 3e157e978a9..b5293771e5d 100644
--- a/.github/workflows/api-consumption-report.lock.yml
+++ b/.github/workflows/api-consumption-report.lock.yml
@@ -534,7 +534,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
index 4f2729721f3..0a489536408 100644
--- a/.github/workflows/audit-workflows.lock.yml
+++ b/.github/workflows/audit-workflows.lock.yml
@@ -555,7 +555,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/aw-failure-investigator.lock.yml b/.github/workflows/aw-failure-investigator.lock.yml
index 7b834dfb188..f81bc90066c 100644
--- a/.github/workflows/aw-failure-investigator.lock.yml
+++ b/.github/workflows/aw-failure-investigator.lock.yml
@@ -462,7 +462,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index 050aab7d616..93d68184ceb 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -647,7 +647,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/copilot-token-audit.lock.yml b/.github/workflows/copilot-token-audit.lock.yml
index 825af18dd7c..7036768bf91 100644
--- a/.github/workflows/copilot-token-audit.lock.yml
+++ b/.github/workflows/copilot-token-audit.lock.yml
@@ -472,7 +472,7 @@ jobs:
       - env:
           GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
         name: Install gh-aw extension
-        run: "# Install gh-aw if not already available\nif ! gh aw --version >/dev/null 2>&1; then\n  echo \"Installing gh-aw extension...\"\n  curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash\nfi\ngh aw --version\n# Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization\nmkdir -p \"${RUNNER_TEMP}/gh-aw\"\nGH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)\nif [ -n \"$GH_AW_BIN\" ] && [ -f \"$GH_AW_BIN\" ]; then\n  cp \"$GH_AW_BIN\" \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n  chmod +x \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n  echo \"Copied gh-aw binary to ${RUNNER_TEMP}/gh-aw/gh-aw\"\nelse\n  echo \"::error::Failed to find gh-aw binary for MCP server\"\n  exit 1\nfi\n"
+        run: "# Install gh-aw if not already available\nif ! gh aw --version >/dev/null 2>&1; then\n  echo \"Installing gh-aw extension...\"\n  curl -fsSL https://raw.githubusercontent.com/github/gh-aw/refs/heads/main/install-gh-aw.sh | bash\nfi\ngh aw --version\n# Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization\nmkdir -p \"${RUNNER_TEMP}/gh-aw\"\nGH_AW_BIN=\"\"\nGH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true\nif [ -z \"$GH_AW_BIN\" ]; then\n  GH_AW_BIN=$(find \"${HOME}/.local/share/gh/extensions/gh-aw\" -name 'gh-aw' -type f 2>/dev/null | head -1) || true\nfi\nif [ -n \"$GH_AW_BIN\" ] && [ -f \"$GH_AW_BIN\" ]; then\n  cp \"$GH_AW_BIN\" \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n  chmod +x \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n  echo \"Copied gh-aw binary to ${RUNNER_TEMP}/gh-aw/gh-aw\"\nelse\n  echo \"::error::Failed to find gh-aw binary for MCP server\"\n  exit 1\nfi\n"
       - name: Setup Python environment
         run: "# Create working directory for Python scripts\nmkdir -p /tmp/gh-aw/python\nmkdir -p /tmp/gh-aw/python/data\nmkdir -p /tmp/gh-aw/python/charts\nmkdir -p /tmp/gh-aw/python/artifacts\n\necho \"Python environment setup complete\"\necho \"Working directory: /tmp/gh-aw/python\"\necho \"Data directory: /tmp/gh-aw/python/data\"\necho \"Charts directory: /tmp/gh-aw/python/charts\"\necho \"Artifacts directory: /tmp/gh-aw/python/artifacts\"\n"
       - name: Install Python scientific libraries
diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml
index 78e5a6bf1ba..4154d8a7288 100644
--- a/.github/workflows/daily-cli-tools-tester.lock.yml
+++ b/.github/workflows/daily-cli-tools-tester.lock.yml
@@ -479,7 +479,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index b5930b84a5d..30f0a04ec2d 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -528,7 +528,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/daily-integrity-analysis.lock.yml b/.github/workflows/daily-integrity-analysis.lock.yml
index aaf61f20f96..00d62237278 100644
--- a/.github/workflows/daily-integrity-analysis.lock.yml
+++ b/.github/workflows/daily-integrity-analysis.lock.yml
@@ -542,7 +542,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml
index 053a667f532..470455a0317 100644
--- a/.github/workflows/daily-observability-report.lock.yml
+++ b/.github/workflows/daily-observability-report.lock.yml
@@ -488,7 +488,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
@@ -1309,18 +1313,18 @@ jobs:
           DOCKER_SOCK_GID=$(stat -c '%g' /var/run/docker.sock 2>/dev/null || echo '0')
           export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e CODEX_HOME -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.3.0'
           
-          cat > "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" << GH_AW_MCP_CONFIG_7c30bc9f53ccd42f_EOF
+          cat > "${RUNNER_TEMP}/gh-aw/mcp-config/config.toml" << GH_AW_MCP_CONFIG_3c598095e22dad2c_EOF
           [history]
           persistence = "none"
           
           [shell_environment_policy]
           inherit = "core"
           include_only = ["CODEX_API_KEY", "HOME", "OPENAI_API_KEY", "PATH"]
-          GH_AW_MCP_CONFIG_7c30bc9f53ccd42f_EOF
+          GH_AW_MCP_CONFIG_3c598095e22dad2c_EOF
           
           # Generate JSON config for MCP gateway
           GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
-          cat << GH_AW_MCP_CONFIG_e7a0814a85020495_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
+          cat << GH_AW_MCP_CONFIG_cdd8152942b1db40_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
           {
             "mcpServers": {
             },
@@ -1331,11 +1335,11 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_e7a0814a85020495_EOF
+          GH_AW_MCP_CONFIG_cdd8152942b1db40_EOF
           
           # Sync converter output to writable CODEX_HOME for Codex
           mkdir -p /tmp/gh-aw/mcp-config
-          cat > "/tmp/gh-aw/mcp-config/config.toml" << GH_AW_CODEX_SHELL_POLICY_f01deed294199434_EOF
+          cat > "/tmp/gh-aw/mcp-config/config.toml" << GH_AW_CODEX_SHELL_POLICY_642d534dcaee7f48_EOF
           model_provider = "openai-proxy"
           [model_providers.openai-proxy]
           name = "OpenAI AWF proxy"
@@ -1345,7 +1349,7 @@ jobs:
           [shell_environment_policy]
           inherit = "core"
           include_only = ["CODEX_API_KEY", "HOME", "OPENAI_API_KEY", "PATH"]
-          GH_AW_CODEX_SHELL_POLICY_f01deed294199434_EOF
+          GH_AW_CODEX_SHELL_POLICY_642d534dcaee7f48_EOF
           awk '
             BEGIN { skip_openai_proxy = 0 }
             /^[[:space:]]*model_provider[[:space:]]*=/ { next }
diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
index 6ea1fd16f71..b88ba8a4437 100644
--- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml
+++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
@@ -516,7 +516,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index c8f837884ce..68743846c16 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -522,7 +522,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index fe36933fb71..5f5740d9adc 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -540,7 +540,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index 42e63d3fc6c..052e66670b6 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -489,7 +489,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml
index 79b0814f9d4..b3527d956aa 100644
--- a/.github/workflows/example-workflow-analyzer.lock.yml
+++ b/.github/workflows/example-workflow-analyzer.lock.yml
@@ -478,7 +478,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 33fb5ed9d5c..4b18776875d 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -601,7 +601,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/metrics-collector.lock.yml b/.github/workflows/metrics-collector.lock.yml
index 165d02e2c36..4ab0fb00a2b 100644
--- a/.github/workflows/metrics-collector.lock.yml
+++ b/.github/workflows/metrics-collector.lock.yml
@@ -463,7 +463,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml
index 04db438f44e..aeabae3b00e 100644
--- a/.github/workflows/prompt-clustering-analysis.lock.yml
+++ b/.github/workflows/prompt-clustering-analysis.lock.yml
@@ -563,7 +563,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index 98be0d7fc0a..5be1c5616e5 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -511,7 +511,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 7eea2a6f4a1..01eb6d8b21c 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -613,7 +613,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml
index 57adbe31467..2d4c9036016 100644
--- a/.github/workflows/safe-output-health.lock.yml
+++ b/.github/workflows/safe-output-health.lock.yml
@@ -509,7 +509,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index c8058ce7a1e..a9836634fb9 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -545,7 +545,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/shared/mcp/gh-aw.md b/.github/workflows/shared/mcp/gh-aw.md
index d3eefbce857..995d496e4b0 100644
--- a/.github/workflows/shared/mcp/gh-aw.md
+++ b/.github/workflows/shared/mcp/gh-aw.md
@@ -24,7 +24,11 @@ steps:
       gh aw --version
       # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
       mkdir -p "${RUNNER_TEMP}/gh-aw"
-      GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+      GH_AW_BIN=""
+      GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+      if [ -z "$GH_AW_BIN" ]; then
+        GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+      fi
       if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
         cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
         chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 082a7186ea4..90157054a3a 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -986,7 +986,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index de7f30b6dd6..00398bd5891 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -610,7 +610,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index f510da95a5d..23ea7d8ba9b 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -613,7 +613,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml
index 10f6d64b039..68db82ec516 100644
--- a/.github/workflows/static-analysis-report.lock.yml
+++ b/.github/workflows/static-analysis-report.lock.yml
@@ -505,7 +505,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml
index 34f58faa3bc..94a023b5d87 100644
--- a/.github/workflows/weekly-blog-post-writer.lock.yml
+++ b/.github/workflows/weekly-blog-post-writer.lock.yml
@@ -487,7 +487,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index d8e279c4346..8aa2e84c6eb 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -460,7 +460,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p "${RUNNER_TEMP}/gh-aw"
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" "${RUNNER_TEMP}/gh-aw/gh-aw"
             chmod +x "${RUNNER_TEMP}/gh-aw/gh-aw"
diff --git a/pkg/workflow/mcp_setup_generator.go b/pkg/workflow/mcp_setup_generator.go
index c7d350a31fb..e4d2ab8e7c8 100644
--- a/pkg/workflow/mcp_setup_generator.go
+++ b/pkg/workflow/mcp_setup_generator.go
@@ -202,7 +202,11 @@ func generateAgenticWorkflowsInstallStep(yaml *strings.Builder, hasAgenticWorkfl
 	yaml.WriteString("          gh aw --version\n")
 	yaml.WriteString("          # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization\n")
 	yaml.WriteString("          mkdir -p \"${RUNNER_TEMP}/gh-aw\"\n")
-	yaml.WriteString("          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)\n")
+	yaml.WriteString("          GH_AW_BIN=\"\"\n")
+	yaml.WriteString("          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true\n")
+	yaml.WriteString("          if [ -z \"$GH_AW_BIN\" ]; then\n")
+	yaml.WriteString("            GH_AW_BIN=$(find \"${HOME}/.local/share/gh/extensions/gh-aw\" -name 'gh-aw' -type f 2>/dev/null | head -1) || true\n")
+	yaml.WriteString("          fi\n")
 	yaml.WriteString("          if [ -n \"$GH_AW_BIN\" ] && [ -f \"$GH_AW_BIN\" ]; then\n")
 	yaml.WriteString("            cp \"$GH_AW_BIN\" \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n")
 	yaml.WriteString("            chmod +x \"${RUNNER_TEMP}/gh-aw/gh-aw\"\n")
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden
index 26444c96db3..086421a7841 100644
--- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden
+++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/smoke-copilot.golden
@@ -436,7 +436,11 @@ jobs:
           gh aw --version
           # Copy the gh-aw binary to ${RUNNER_TEMP}/gh-aw for MCP server containerization
           mkdir -p ${RUNNER_TEMP}/gh-aw
-          GH_AW_BIN=$(which gh-aw 2>/dev/null || find ~/.local/share/gh/extensions/gh-aw -name 'gh-aw' -type f 2>/dev/null | head -1)
+          GH_AW_BIN=""
+          GH_AW_BIN=$(command -v gh-aw 2>/dev/null) || true
+          if [ -z "$GH_AW_BIN" ]; then
+            GH_AW_BIN=$(find "${HOME}/.local/share/gh/extensions/gh-aw" -name 'gh-aw' -type f 2>/dev/null | head -1) || true
+          fi
           if [ -n "$GH_AW_BIN" ] && [ -f "$GH_AW_BIN" ]; then
             cp "$GH_AW_BIN" ${RUNNER_TEMP}/gh-aw/gh-aw
             chmod +x ${RUNNER_TEMP}/gh-aw/gh-aw