diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c856c3a..5e7c3fc 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -123,6 +123,10 @@ jobs:
       - name: Shell config loads without errors
         run: docker run --rm -e DEVCONTAINER=1 squarebox:test bash --noprofile --rcfile /home/dev/.bashrc -ic 'command -v starship && command -v zoxide'
 
+      - name: Default shell is exported for child processes
+        run: |
+          test "$(docker run --rm squarebox:test env | awk -F= '$1 == "SHELL" { print $2 }')" = /bin/bash
+
       - name: Aliases resolve correctly
         run: |
           docker run --rm -e DEVCONTAINER=1 squarebox:test bash -lic '
diff --git a/Dockerfile b/Dockerfile
index 8e9817f..262d838 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -216,6 +216,9 @@ LABEL org.opencontainers.image.version="$SQUAREBOX_VERSION"
 # the running process is `dev` — identical to a plain `USER dev` image. PUID/
 # PGID are declared here so docker-compose / Unraid template UIs surface them.
 ENV HOME=/home/dev
+# Keep child processes launched via `docker exec` on the same interactive shell
+# path as the image's default CMD, even when the runtime does not export SHELL.
+ENV SHELL=/bin/bash
 ENV SQUAREBOX=1
 ENV PUID=1000
 ENV PGID=1000