diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2b6f948..fe1cc6d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -72,7 +72,15 @@ jobs:
     if: github.actor != 'release-please[bot]'
     services:
       ollama:
-        image: ollama/ollama:latest
+        # Pin the embedding runtime. The lang E2E suite (TestLang_*) asserts on
+        # committed embedding snapshots (testdata/snapshots/), so all-minilm must
+        # return identical vectors run-to-run. The `:latest` tag drifted from
+        # 0.24.0 to a newer build between 2026-05-20 and 2026-06-04, which shifted
+        # the ranked results and broke every snapshot. 0.24.0 is the last runtime
+        # the snapshots were verified green against (== the multi-arch index
+        # digest that `docker pull` resolves the 0.24.0 tag to:
+        # sha256:a6149234667efc71d37766d61c1a16f24c33e4cd7a0bf4125c44a7e47e2419c4).
+        image: ollama/ollama:0.24.0
         ports:
           - 11434:11434
     steps:
diff --git a/scripts/run b/scripts/run
index b0bda40..d569d9e 100755
--- a/scripts/run
+++ b/scripts/run
@@ -14,11 +14,20 @@ case "$ARCH" in
   aarch64) ARCH="arm64" ;;
 esac
 
+# Normalize Windows-flavored uname. Git Bash/MSYS2/Cygwin report uname -s as
+# mingw*/msys*/cygwin* (and embed the Windows build number), not "windows", and
+# their binaries carry a .exe suffix. Without this the loop below misses the
+# bundled bin/lumen-windows-amd64.exe and falls through to a doomed download.
+EXT=""
+case "$OS" in
+  mingw*|msys*|cygwin*|windows*) OS="windows"; EXT=".exe" ;;
+esac
+
 # Find binary: check bin/ first, then goreleaser dist/ output, then download
 BINARY=""
 for candidate in \
-  "${PLUGIN_ROOT}/bin/lumen" \
-  "${PLUGIN_ROOT}/bin/lumen-${OS}-${ARCH}"; do
+  "${PLUGIN_ROOT}/bin/lumen${EXT}" \
+  "${PLUGIN_ROOT}/bin/lumen-${OS}-${ARCH}${EXT}"; do
   if [ -x "$candidate" ]; then
     BINARY="$candidate"
     break
@@ -27,7 +36,7 @@ done
 
 # Download on first run if no binary found
 if [ -z "$BINARY" ]; then
-  BINARY="${PLUGIN_ROOT}/bin/lumen-${OS}-${ARCH}"
+  BINARY="${PLUGIN_ROOT}/bin/lumen-${OS}-${ARCH}${EXT}"
 
   REPO="ory/lumen"