diff --git a/.github/actions/run-appinspect/action.yml b/.github/actions/run-appinspect/action.yml
index 15f7c052..1895dc4c 100644
--- a/.github/actions/run-appinspect/action.yml
+++ b/.github/actions/run-appinspect/action.yml
@@ -19,4 +19,15 @@ runs:
         tar -czf mock_app.tgz --exclude="__pycache__" bin default metadata
     - name: Validate the mock app with AppInspect
       shell: bash
-      run: uvx splunk-appinspect inspect ./tests/system/test_apps/generating_app/mock_app.tgz --included-tags cloud
+      run: |
+        # AppInspect doesn't follow UNIX conventions, gotta handle their exit codes explicitly
+        # https://dev.splunk.com/enterprise/reference/appinspect/appinspectcliref#inspect
+        uvx splunk-appinspect inspect \
+          ./tests/system/test_apps/generating_app/mock_app.tgz \
+          --included-tags cloud --ci || exit_code=$?
+        case "${exit_code:-0}" in
+          0)   ;;  # all checks passed
+          103) ;;  # warnings (--ci)
+          104) ;;  # future-tag warnings (--ci)
+          *)   exit "${exit_code}" ;;  # 101=failures, 1=packaging, 2=exception, 3=error, etc.
+        esac