diff --git a/.github/workflows/rust-release-windows.yml b/.github/workflows/rust-release-windows.yml
index 49e627c1bed6..b8f4a9e58676 100644
--- a/.github/workflows/rust-release-windows.yml
+++ b/.github/workflows/rust-release-windows.yml
@@ -306,6 +306,8 @@ jobs:
           # ${{ matrix.target }}
           dest="dist/${{ matrix.target }}"
           repo_root=$PWD
+          target="${{ matrix.target }}"
+          export dest repo_root target
 
           # For compatibility with environments that lack the `zstd` tool we
           # additionally create a `.tar.gz` and `.zip` for every Windows binary.
@@ -313,33 +315,38 @@ jobs:
           #   codex-<target>.zst
           #   codex-<target>.tar.gz
           #   codex-<target>.zip
-          for f in "$dest"/*; do
+          # Variables in the single-quoted script expand in the child shell.
+          # shellcheck disable=SC2016
+          printf '%s\0' "$dest"/* |
+            xargs -0 -n1 -P2 bash -c '
+            set -euo pipefail
+            f=$1
             base="$(basename "$f")"
-            # Skip files that are already archives (shouldn't happen, but be
+            # Skip files that are already archives (should not happen, but be
             # safe).
             if [[ "$base" == *.tar.gz || "$base" == *.tar.zst || "$base" == *.zip || "$base" == *.dmg ]]; then
-              continue
+              exit 0
             fi
 
-            # Don't try to compress signature bundles.
+            # Do not try to compress signature bundles.
             if [[ "$base" == *.sigstore ]]; then
-              continue
+              exit 0
             fi
 
             # Create per-binary tar.gz
             tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base"
 
             # Create zip archive for Windows binaries.
-            # Must run from inside the dest dir so 7z won't embed the
+            # Must run from inside the dest dir so 7z does not embed the
             # directory path inside the zip.
-            if [[ "$base" == "codex-${{ matrix.target }}.exe" ]]; then
+            if [[ "$base" == "codex-${target}.exe" ]]; then
               # Bundle the sandbox helper binaries into the main codex zip so
               # WinGet installs include the required helpers next to codex.exe.
               # Fall back to the single-binary zip if the helpers are missing
               # to avoid breaking releases.
               bundle_dir="$(mktemp -d)"
-              runner_src="$dest/codex-command-runner-${{ matrix.target }}.exe"
-              setup_src="$dest/codex-windows-sandbox-setup-${{ matrix.target }}.exe"
+              runner_src="$dest/codex-command-runner-${target}.exe"
+              setup_src="$dest/codex-windows-sandbox-setup-${target}.exe"
               if [[ -f "$runner_src" && -f "$setup_src" ]]; then
                 cp "$dest/$base" "$bundle_dir/$base"
                 cp "$runner_src" "$bundle_dir/codex-command-runner.exe"
@@ -359,7 +366,7 @@ jobs:
 
             # Keep raw executables and produce .zst alongside them.
             "${GITHUB_WORKSPACE}/.github/workflows/zstd" -T0 -19 "$dest/$base"
-          done
+          ' _
 
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with: