diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4943927..217f286 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -484,7 +484,19 @@ jobs:
         run: sudo apt-get update -qq && sudo apt-get install -y -qq doxygen graphviz
 
       - name: Generate, with documentation warnings as errors
-        run: tools/udd.sh | tee udd.log
+        run: |
+          # `set -o pipefail`, and it is not decoration: GitHub runs these
+          # steps with `bash -e` and NOT pipefail, so `tools/udd.sh | tee`
+          # reported tee's exit status and swallowed the script's. This gate
+          # had been green on those terms for as long as it has existed, and
+          # the release workflow -- which runs udd.sh without a pipe -- is
+          # what found the Doxygen failure this job could not fail on.
+          #
+          # The same mistake as the `|| true` that hid the QEMU job's three
+          # different failures. A gate that cannot fail is worse than no gate,
+          # because it is counted as evidence.
+          set -o pipefail
+          tools/udd.sh | tee udd.log
 
       - name: Summarise what the document covers
         if: always()
diff --git a/firmware/supervisor/doc/00-mainpage.dox b/firmware/supervisor/doc/00-mainpage.dox
index 4f5b464..0421fbf 100644
--- a/firmware/supervisor/doc/00-mainpage.dox
+++ b/firmware/supervisor/doc/00-mainpage.dox
@@ -82,7 +82,7 @@ documented in @ref selfcheck.h :
 
 @section udd_diagrams The two diagrams
 
-Both are drawn from `\dot` blocks in the headers beside the code they
+Both are drawn from @c \\dot blocks in the headers beside the code they
 describe, so they are versioned with it and cannot drift from it the way a
 picture in another document does:
 
diff --git a/tools/udd.sh b/tools/udd.sh
index fa414d5..a69c1ca 100755
--- a/tools/udd.sh
+++ b/tools/udd.sh
@@ -33,6 +33,14 @@ for arg in "$@"; do
     esac
 done
 
+# Named in the output because the version matters and has bitten: Ubuntu's
+# doxygen 1.9 treats a bare \dot in prose as the start of a dot block where
+# 1.18 does not, so the same sources passed here and failed in CI. A log that
+# does not say which tool produced it cannot show that.
+if command -v doxygen >/dev/null 2>&1; then
+    echo "doxygen:  $(doxygen --version)"
+fi
+
 if ! command -v doxygen >/dev/null 2>&1; then
     echo "doxygen is not installed." >&2
     echo "  macOS:  brew install doxygen" >&2