diff --git a/scripts/check-pins.sh b/scripts/check-pins.sh
index e2b4203..072df71 100755
--- a/scripts/check-pins.sh
+++ b/scripts/check-pins.sh
@@ -11,7 +11,9 @@
 # tags composed from the pins (catches hand-edited image references).
 #
 # Pure shell + sed: no mise, docker or elixir needed, so it runs in CI and in
-# sandboxes before the toolchain is installed.
+# sandboxes before the toolchain is installed. Keep regexes POSIX-BRE: GNU
+# extensions like \+ silently break under /usr/bin/sed on macOS (it treats
+# \+ as a literal plus), which false-fails every pin as "not found".
 set -euo pipefail
 
 root=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
@@ -35,9 +37,9 @@ grab() { # grab <description> <key-regex> <file>
 
 mise_elixir=$(grab 'mise elixir' 'elixir' "$mise_toml")
 mise_erlang=$(grab 'mise erlang' 'erlang' "$mise_toml")
-d_elixir=$(grab 'Dockerfile ELIXIR_VERSION' 'ARG[[:space:]]\+ELIXIR_VERSION' "$dockerfile")
-d_otp=$(grab 'Dockerfile OTP_VERSION' 'ARG[[:space:]]\+OTP_VERSION' "$dockerfile")
-d_debian=$(grab 'Dockerfile DEBIAN_VERSION' 'ARG[[:space:]]\+DEBIAN_VERSION' "$dockerfile")
+d_elixir=$(grab 'Dockerfile ELIXIR_VERSION' 'ARG[[:space:]]\{1,\}ELIXIR_VERSION' "$dockerfile")
+d_otp=$(grab 'Dockerfile OTP_VERSION' 'ARG[[:space:]]\{1,\}OTP_VERSION' "$dockerfile")
+d_debian=$(grab 'Dockerfile DEBIAN_VERSION' 'ARG[[:space:]]\{1,\}DEBIAN_VERSION' "$dockerfile")
 
 if [ $status -eq 0 ]; then
 	mise_elixir_ver=${mise_elixir%%-otp-*}
@@ -59,7 +61,7 @@ if [ $status -eq 0 ]; then
 
 	# BUILDER_IMAGE must expand to the tag composed from the pins.
 	expected_builder="docker.io/hexpm/elixir:${d_elixir}-erlang-${d_otp}-debian-${d_debian}"
-	d_builder=$(grab 'Dockerfile BUILDER_IMAGE' 'ARG[[:space:]]\+BUILDER_IMAGE' "$dockerfile")
+	d_builder=$(grab 'Dockerfile BUILDER_IMAGE' 'ARG[[:space:]]\{1,\}BUILDER_IMAGE' "$dockerfile")
 	expanded_builder=$(printf '%s' "$d_builder" |
 		sed -e "s/\${ELIXIR_VERSION}/$d_elixir/" \
 			-e "s/\${OTP_VERSION}/$d_otp/" \
@@ -69,7 +71,7 @@ if [ $status -eq 0 ]; then
 
 	# RUNNER_IMAGE must expand to the Debian pin.
 	expected_runner="docker.io/debian:${d_debian}"
-	d_runner=$(grab 'Dockerfile RUNNER_IMAGE' 'ARG[[:space:]]\+RUNNER_IMAGE' "$dockerfile")
+	d_runner=$(grab 'Dockerfile RUNNER_IMAGE' 'ARG[[:space:]]\{1,\}RUNNER_IMAGE' "$dockerfile")
 	expanded_runner=${d_runner/\$\{DEBIAN_VERSION\}/$d_debian}
 	[ "$expanded_runner" = "$expected_runner" ] ||
 		die "RUNNER_IMAGE expands to $expanded_runner, expected $expected_runner"