diff --git a/.woodpecker/ci-manifests-test.yml b/.woodpecker/ci-manifests-test.yml
index 7f137d84..9e625c29 100644
--- a/.woodpecker/ci-manifests-test.yml
+++ b/.woodpecker/ci-manifests-test.yml
@@ -32,8 +32,29 @@ steps:
     commands:
       - |
         set -eu
+        # NOT `find -printf '%h\n'`: that is a GNU findutils extension and this
+        # image ships BusyBox find (v1.37.0), which rejects it outright with
+        # "find: unrecognized: -printf". Because the result feeds a command
+        # substitution used as a word list, the failure is SILENT — empty output,
+        # zero loop iterations, fail=0, step exits green having validated
+        # nothing. That is exactly what this pipeline shipped in its first
+        # revision, and CI reported it as passing.
+        dirs=$(find kubernetes -name kustomization.yaml | sed 's|/kustomization.yaml$||' | sort)
+
+        # Assert the discovery actually found something. Without this, any future
+        # breakage of the find/sed above degrades back into a green no-op rather
+        # than a failure — the specific trap that made the first revision of this
+        # step useless while looking healthy.
+        count=$(printf '%s\n' "$dirs" | grep -c . || true)
+        if [ "$count" -lt 50 ]; then
+          echo "FAIL: found only $count kustomizations; expected ~60."
+          echo "      Discovery is broken — refusing to report success."
+          exit 1
+        fi
+        echo "discovered $count kustomizations"
+
         fail=0
-        for d in $(find kubernetes -name kustomization.yaml -printf '%h\n' | sort); do
+        for d in $dirs; do
           if kubectl kustomize "$d" >/dev/null 2>/tmp/err; then
             echo "ok    $d"
           else
@@ -81,8 +102,18 @@ steps:
     commands:
       - |
         set -eu
+        files=$(find kubernetes -name '*.sh' | sort)
+        # Same no-op guard as kustomize-build: if discovery ever returns nothing,
+        # fail loudly instead of passing having checked no files.
+        count=$(printf '%s\n' "$files" | grep -c . || true)
+        if [ "$count" -lt 1 ]; then
+          echo "FAIL: no shell scripts found under kubernetes/ — discovery is broken."
+          exit 1
+        fi
+        echo "discovered $count shell scripts"
+
         fail=0
-        for f in $(find kubernetes -name '*.sh' | sort); do
+        for f in $files; do
           if shellcheck -S error "$f"; then
             echo "ok    $f"
           else