diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml
index f122ad35239..067d018d73f 100644
--- a/.github/workflows/ingest.yml
+++ b/.github/workflows/ingest.yml
@@ -52,7 +52,7 @@ jobs:
         run: brew advisory-match --all --verbose --output advisories --no-history
 
       - name: Concatenate advisories
-        run: rake advisories:concat
+        run: bundle exec rake advisories:concat
 
       - name: Open pull request
         env:
diff --git a/.github/workflows/regenerate.yml b/.github/workflows/regenerate.yml
index c7af23cdec8..de70e5940b1 100644
--- a/.github/workflows/regenerate.yml
+++ b/.github/workflows/regenerate.yml
@@ -40,7 +40,7 @@ jobs:
         run: brew generate-vulns-advisories advisories
 
       - name: Concatenate advisories
-        run: rake advisories:concat
+        run: bundle exec rake advisories:concat
 
       - name: Open pull request
         env:
diff --git a/spec/workflows_spec.rb b/spec/workflows_spec.rb
new file mode 100644
index 00000000000..739fc16e8c1
--- /dev/null
+++ b/spec/workflows_spec.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require "yaml"
+
+RSpec.describe "workflow commands" do
+  %w[ingest regenerate].each do |workflow_name|
+    it "runs #{workflow_name} advisory concatenation with Bundler" do
+      path = File.expand_path("../.github/workflows/#{workflow_name}.yml", __dir__)
+      workflow = YAML.safe_load_file(path, aliases: true)
+      steps = workflow.fetch("jobs").values.flat_map { |job| job.fetch("steps", []) }
+      concat_step = steps.find { |step| step["name"] == "Concatenate advisories" }
+
+      expect(concat_step.fetch("run")).to eq "bundle exec rake advisories:concat"
+    end
+  end
+end