diff --git a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
index c6f7279e8516..31ba95a9e757 100644
--- a/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
+++ b/.github/workflows/openclaw-live-and-e2e-checks-reusable.yml
@@ -851,7 +851,12 @@ jobs:
         run: |
           set -euo pipefail
           export OPENSHELL_VERSION=v0.0.68
-          curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/d64542f69d06694cbd203b64929d286dd0533bbb/install.sh | sh
+          installer_path="$(mktemp "${RUNNER_TEMP}/openshell-install.XXXXXX")"
+          trap 'rm -f "$installer_path"' EXIT
+          curl -LsSf --connect-timeout 10 --max-time 120 \
+            -o "$installer_path" \
+            https://raw.githubusercontent.com/NVIDIA/OpenShell/d64542f69d06694cbd203b64929d286dd0533bbb/install.sh
+          sh "$installer_path"
           openshell --version
 
       - name: Bootstrap OpenShell gateway
diff --git a/test/scripts/test-install-sh-docker.test.ts b/test/scripts/test-install-sh-docker.test.ts
index ede9255a908a..955316e46299 100644
--- a/test/scripts/test-install-sh-docker.test.ts
+++ b/test/scripts/test-install-sh-docker.test.ts
@@ -835,6 +835,27 @@ printf 'status=%s\\n' "$status"
     expect(workflow).toContain("reachable from an OpenClaw branch or release tag");
   });
 
+  it("downloads the OpenShell installer completely before execution", () => {
+    const workflow = parse(readFileSync(LIVE_E2E_WORKFLOW_PATH, "utf8"));
+    const steps = workflow.jobs.validate_special_e2e.steps as Array<{
+      name?: string;
+      run?: string;
+    }>;
+    const installStep = expectDefined(
+      steps.find((step) => step.name === "Install OpenShell CLI"),
+      "OpenShell install step",
+    );
+    const run = expectDefined(installStep.run, "OpenShell install command");
+
+    expect(run).toContain('installer_path="$(mktemp "${RUNNER_TEMP}/openshell-install.XXXXXX")"');
+    expect(run).toContain("curl -LsSf --connect-timeout 10 --max-time 120 \\");
+    expect(run).toContain('-o "$installer_path"');
+    expect(run).toContain('sh "$installer_path"');
+    expect(run).toContain("trap 'rm -f \"$installer_path\"' EXIT");
+    expect(run.indexOf('-o "$installer_path"')).toBeLessThan(run.indexOf('sh "$installer_path"'));
+    expect(run).not.toContain("install.sh | sh");
+  });
+
   it("prints package size audits for release smoke tarballs", () => {
     const script = readFileSync(SCRIPT_PATH, "utf8");