diff --git a/.github/actions/run-argument-comment-lint/action.yml b/.github/actions/run-argument-comment-lint/action.yml
index 80fb23d417..b5e8462167 100644
--- a/.github/actions/run-argument-comment-lint/action.yml
+++ b/.github/actions/run-argument-comment-lint/action.yml
@@ -32,7 +32,7 @@ runs:
       shell: bash
       run: |
         bazel_targets="$(./tools/argument-comment-lint/list-bazel-targets.sh)"
-        ./.github/scripts/run-bazel-ci.sh \
+        ./.github/scripts/run_bazel_ci.py \
           -- \
           build \
           --config=argument-comment-lint \
diff --git a/.github/scripts/run-bazel-ci.sh b/.github/scripts/run-bazel-ci.sh
deleted file mode 100755
index ec859f443e..0000000000
--- a/.github/scripts/run-bazel-ci.sh
+++ /dev/null
@@ -1,5 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-exec "$(dirname "${BASH_SOURCE[0]}")/run_bazel_ci.py" "$@"
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index ffda87b8a5..2c19b54443 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -112,7 +112,7 @@ jobs:
             --test_verbose_timeout_warnings
             --build_metadata=COMMIT_SHA=${GITHUB_SHA}
           )
-          ./.github/scripts/run-bazel-ci.sh \
+          ./.github/scripts/run_bazel_ci.py \
             "${bazel_wrapper_args[@]}" \
             -- \
             "${bazel_test_args[@]}" \
@@ -224,7 +224,7 @@ jobs:
             --build_metadata=TAG_windows_test_shard=${BAZEL_TEST_SHARD}
           )
 
-          ./.github/scripts/run-bazel-ci.sh \
+          ./.github/scripts/run_bazel_ci.py \
             --print-failed-action-summary \
             --print-failed-test-logs \
             --windows-cross-compile \
@@ -313,7 +313,7 @@ jobs:
             --build_metadata=TAG_windows_native_main=true
           )
 
-          ./.github/scripts/run-bazel-ci.sh \
+          ./.github/scripts/run_bazel_ci.py \
             --print-failed-action-summary \
             --print-failed-test-logs \
             -- \
@@ -394,7 +394,7 @@ jobs:
             # Keep this aligned with the fast Windows Bazel test job: use
             # Linux RBE for clippy build actions while targeting Windows
             # gnullvm. Fork/community PRs without the BuildBuddy secret fall
-            # back inside `run-bazel-ci.sh` to the previous local Windows MSVC
+            # back inside `run_bazel_ci.py` to the previous local Windows MSVC
             # host-platform shape.
             bazel_wrapper_args+=(--windows-cross-compile)
             bazel_target_list_args+=(--windows-cross-compile)
@@ -412,7 +412,7 @@ jobs:
             bazel_targets+=("${target}")
           done <<< "${bazel_target_lines}"
 
-          ./.github/scripts/run-bazel-ci.sh \
+          ./.github/scripts/run_bazel_ci.py \
             --print-failed-action-summary \
             "${bazel_wrapper_args[@]}" \
             -- \
@@ -490,7 +490,7 @@ jobs:
             # This is build-only signal, so use the same Linux-RBE
             # cross-compile path as the fast Windows test and clippy jobs.
             # Fork/community PRs without the BuildBuddy secret fall back
-            # inside `run-bazel-ci.sh` to the previous local Windows MSVC
+            # inside `run_bazel_ci.py` to the previous local Windows MSVC
             # host-platform shape.
             bazel_wrapper_args+=(--windows-cross-compile)
           fi
@@ -510,7 +510,7 @@ jobs:
             bazel_targets+=("${target}")
           done <<< "${bazel_target_lines}"
 
-          ./.github/scripts/run-bazel-ci.sh \
+          ./.github/scripts/run_bazel_ci.py \
             "${bazel_wrapper_args[@]}" \
             -- \
             build \
@@ -524,7 +524,7 @@ jobs:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
         shell: bash
         run: |
-          ./.github/scripts/run-bazel-ci.sh \
+          ./.github/scripts/run_bazel_ci.py \
             --remote-download-toplevel \
             --print-failed-action-summary \
             -- \
diff --git a/.github/workflows/rust-ci-full.yml b/.github/workflows/rust-ci-full.yml
index 7ad1d4b3ad..30a655dc75 100644
--- a/.github/workflows/rust-ci-full.yml
+++ b/.github/workflows/rust-ci-full.yml
@@ -135,7 +135,7 @@ jobs:
         shell: bash
         run: |
           bazel_targets="$(./tools/argument-comment-lint/list-bazel-targets.sh)"
-          ./.github/scripts/run-bazel-ci.sh \
+          ./.github/scripts/run_bazel_ci.py \
             -- \
             build \
             --config=argument-comment-lint \
diff --git a/.github/workflows/sdk.yml b/.github/workflows/sdk.yml
index 3cf6d7c8c3..7639d3dc15 100644
--- a/.github/workflows/sdk.yml
+++ b/.github/workflows/sdk.yml
@@ -90,7 +90,7 @@ jobs:
           # BuildBuddy credentials are unavailable. This workflow needs the
           # built `codex` binary on disk afterwards, so ask the wrapper to
           # override CI's default remote_download_minimal behavior.
-          ./.github/scripts/run-bazel-ci.sh \
+          ./.github/scripts/run_bazel_ci.py \
             --remote-download-toplevel \
             -- \
             build \
@@ -103,7 +103,7 @@ jobs:
           # the build instead of guessing which Bazel convenience symlink is
           # available on the runner.
           cquery_output="$(
-            ./.github/scripts/run-bazel-ci.sh \
+            ./.github/scripts/run_bazel_ci.py \
               -- \
               cquery \
               --output=files \