diff --git a/hack/ci/pr-should-include-tests b/hack/ci/pr-should-include-tests
index 9cca62ba3b..ef6aa4156e 100755
--- a/hack/ci/pr-should-include-tests
+++ b/hack/ci/pr-should-include-tests
@@ -40,7 +40,7 @@ if [[ -n "$PR_NUMBER" ]]; then
     for var in GITHUB_TOKEN GITHUB_REPOSITORY; do
         if [[ -z "${!var}" ]]; then
             echo "$ME: cannot query github: \$$var is undefined" >&2
-            return 1
+            exit 1
         fi
     done
 
diff --git a/hack/ci/pr-should-include-tests.t b/hack/ci/pr-should-include-tests.t
index a0b9a02e51..1964faaa17 100755
--- a/hack/ci/pr-should-include-tests.t
+++ b/hack/ci/pr-should-include-tests.t
@@ -89,6 +89,12 @@ function run_test_script() {
 rc=0
 testnum=0
 
+# This harness may run in CI, where PR_NUMBER is set in the environment. The
+# cases below only exercise the local git-diff logic, not the github override-
+# label lookup (which needs real credentials), so ensure the script under test
+# never enters that path.
+unset PR_NUMBER
+
 while read expected_rc parent_sha  commit_sha pr rest; do
     # Skip blank lines
     test -z "$expected_rc" && continue