diff --git a/.github/scripts/windows/test_task.bat b/.github/scripts/windows/test_task.bat
index 41731c1d..97f899d3 100644
--- a/.github/scripts/windows/test_task.bat
+++ b/.github/scripts/windows/test_task.bat
@@ -26,7 +26,10 @@ if exist "%DEPS_DIR%\bin" (
     echo WARNING: %DEPS_DIR%\bin missing — DLLs may be unresolved
 )
 
+REM protect_memory is process-global page protection toggled outside the compile
+REM lock; the threaded worker pool shares one address space and races on it. Off.
 %PHP_BUILD_DIR%\php.exe run-tests.php ^
+    -d opcache.protect_memory=0 ^
     -P -q -j2 ^
     -g FAIL,BORK,LEAK,XLEAK ^
     --no-progress ^
diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index 9ce93597..7152109d 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -522,7 +522,13 @@ jobs:
         working-directory: http-server
         run: |
           ulimit -c unlimited
+          # opcache.protect_memory=1 (a run-tests default) is process-global
+          # mprotect toggled outside the compile lock; the threaded worker pool
+          # shares one address space so it races across workers and SIGBUS on
+          # SHM writes. Off here — production defaults it off and real
+          # compilation is serialized by the SHM lock.
           /usr/local/bin/php "$GITHUB_WORKSPACE/php-src/run-tests.php" \
+            -d opcache.protect_memory=0 \
             -P -q -j"$(nproc)" \
             -g FAIL,BORK,LEAK,XLEAK \
             --no-progress \
diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index b5311c72..9d417942 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -139,7 +139,14 @@ jobs:
       - name: Run http_server phpt suite
         working-directory: http-server
         run: |
+          # opcache.protect_memory=1 (a run-tests default) is process-global
+          # mprotect and is toggled outside the compile lock; with the threaded
+          # worker pool sharing one address space it races across workers and
+          # SIGBUS on SHM writes (opcache admits "mprotect() is process-global
+          # and races", ZendAccelerator.c). Not a production concern — the flag
+          # defaults off and real compilation is serialized by the SHM lock.
           /usr/local/bin/php "$GITHUB_WORKSPACE/php-src/run-tests.php" \
+            -d opcache.protect_memory=0 \
             -P -q -j"$(sysctl -n hw.logicalcpu)" \
             -g FAIL,BORK,LEAK,XLEAK \
             --no-progress \
diff --git a/.github/workflows/chaos.yml b/.github/workflows/chaos.yml
index 9f5f8a0b..0c857990 100644
--- a/.github/workflows/chaos.yml
+++ b/.github/workflows/chaos.yml
@@ -254,6 +254,7 @@ jobs:
             echo "::group::TRUE_ASYNC_SCHED=$sched"
             if ! TRUE_ASYNC_SCHED="$sched" /usr/local/bin/php \
                  "$GITHUB_WORKSPACE/php-src/run-tests.php" \
+                 -d opcache.protect_memory=0 \
                  -P -q -j"$(nproc)" \
                  -g FAIL,BORK,LEAK,XLEAK \
                  --no-progress --offline --show-diff --set-timeout 120 \
diff --git a/.github/workflows/debug-macos-workers.yml b/.github/workflows/debug-macos-workers.yml
index a0b27b43..22a80964 100644
--- a/.github/workflows/debug-macos-workers.yml
+++ b/.github/workflows/debug-macos-workers.yml
@@ -124,7 +124,10 @@ jobs:
         working-directory: http-server
         run: |
           set +e
+          # protect_memory=1 is process-global mprotect — races across the
+          # threaded worker pool (false SIGBUS). Off; unused in production.
           "$PHP_PREFIX/bin/php" "$PHP_PREFIX/bin/run-tests.php" \
+            -d opcache.protect_memory=0 \
             -P -q -p "$PHP_PREFIX/bin/php" \
             --show-diff --show-out \
             --set-timeout 60 \