diff --git a/.github/workflows/CICD.yml b/.github/workflows/CICD.yml
index 15c9b530269..9182c3a2c3e 100644
--- a/.github/workflows/CICD.yml
+++ b/.github/workflows/CICD.yml
@@ -2,9 +2,9 @@ name: CICD
 
 # spell-checker:ignore (abbrev/names) CACHEDIR CICD CodeCOV MacOS MinGW MSVC musl taiki
 # spell-checker:ignore (env/flags) Awarnings Ccodegen Coverflow Cpanic Dwarnings RUSTDOCFLAGS RUSTFLAGS Zpanic CARGOFLAGS CLEVEL nodocs
-# spell-checker:ignore (jargon) SHAs deps dequote softprops subshell toolchain fuzzers dedupe devel profdata
+# spell-checker:ignore (jargon) SHAs deps dequote softprops subshell toolchain fuzzers dedupe devel profdata profraw
 # spell-checker:ignore (people) Peltoche rivy Anson dawidd
-# spell-checker:ignore (shell/tools) binutils choco clippy dmake esac fakeroot fdesc fdescfs gmake grcov halium lcov libclang libcrypto libfuse libssl limactl nextest nocross pacman popd printf pushd redoxer rsync rustc rustfmt rustup shopt sccache utmpdump xargs zstd
+# spell-checker:ignore (shell/tools) binutils choco clippy dmake esac fakeroot fdesc fdescfs gmake grcov halium lcov libclang libcrypto libfuse libssl limactl nextest nocross pacman popd printf pushd redoxer rsync rustc rustfmt rustup shopt sccache setfacl utmpdump xargs zstd
 # spell-checker:ignore (misc) aarch alnum armhf bindir busytest coreutils defconfig DESTDIR gecos getenforce gnueabihf issuecomment maint manpages msys multisize noconfirm nofeatures nullglob onexitbegin onexitend pell runtest tempfile testsuite toybox uutils libsystemd codspeed wasip libexecinfo
 
 env:
@@ -772,8 +772,9 @@ jobs:
         case '${{ matrix.job.os }}' in
           ubuntu-latest)
             # selinux and systemd headers needed to build tests
+            # acl: setfacl for coverage profile-trace dir default ACL (umask 0777 tests)
             sudo apt-get -y update
-            sudo apt-get -y install libselinux1-dev libsystemd-dev
+            sudo apt-get -y install libselinux1-dev libsystemd-dev acl
             # pinky is a tool to show logged-in users from utmp, and gecos fields from /etc/passwd.
             # In GitHub Action *nix VMs, no accounts log in, even the "runner" account that runs the commands, and "system boot" entry is missing.
             # The account also has empty gecos fields.
diff --git a/util/build-run-test-coverage-linux.sh b/util/build-run-test-coverage-linux.sh
index 83faf107280..4dd1d7e94d9 100755
--- a/util/build-run-test-coverage-linux.sh
+++ b/util/build-run-test-coverage-linux.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 # spell-checker:ignore (env/flags) Ccodegen Cinstrument Coverflow Cpanic Zpanic
-# spell-checker:ignore PROFDATA PROFRAW coreutil librairies nextest profdata profraw rustlib
+# spell-checker:ignore PROFDATA PROFRAW coreutil librairies nextest profdata profraw rustlib setfacl
 
 # This script will build, run and generate coverage reports for the whole
 # testsuite.
@@ -53,7 +53,37 @@ PROFDATA_DIR="${COVERAGE_DIR}/data"
 REPORT_DIR="${COVERAGE_DIR}/report"
 REPORT_PATH="${REPORT_DIR}/total.lcov.info"
 
-rm -rf "${PROFRAW_DIR}" && mkdir -p "${PROFRAW_DIR}"
+# Some tests set umask(0777) via uutests pre_exec. LLVM profile files created
+# under that umask can be mode 000; later writes fail with EACCES and the error
+# lands on utility stderr (breaks exact asserts, e.g. mkfifo).
+# Default ACL keeps new .profraw files owner-writable. Keep LLVM's bounded
+# online-merge pool (%4m) instead of one file per process (%p-%m).
+prepare_profraw_dir() {
+    rm -rf "${PROFRAW_DIR}"
+    mkdir -p "${PROFRAW_DIR}"
+    chmod 700 "${PROFRAW_DIR}"
+    if ! command -v setfacl >/dev/null 2>&1; then
+        if [ -n "${CI:-}" ]; then
+            echo "error: setfacl required for coverage profraw dir (install acl)" >&2
+            exit 1
+        fi
+        return 0
+    fi
+    if ! setfacl -d -m u::rw,g::---,o::---,m::rw "${PROFRAW_DIR}"; then
+        if [ -n "${CI:-}" ]; then
+            echo "error: setfacl default ACL failed on ${PROFRAW_DIR}" >&2
+            exit 1
+        fi
+    fi
+    if ! setfacl -m u::rwx,g::---,o::---,m::rwx "${PROFRAW_DIR}"; then
+        if [ -n "${CI:-}" ]; then
+            echo "error: setfacl access ACL failed on ${PROFRAW_DIR}" >&2
+            exit 1
+        fi
+    fi
+}
+
+prepare_profraw_dir
 rm -rf "${PROFDATA_DIR}" && mkdir -p "${PROFDATA_DIR}"
 rm -rf "${REPORT_DIR}" && mkdir -p "${REPORT_DIR}"
 
@@ -108,7 +138,7 @@ for UTIL in ${UTIL_LIST}; do
     fi
 
     echo "## Clear the trace directory to free up space"
-    rm -rf "${PROFRAW_DIR}" && mkdir -p "${PROFRAW_DIR}"
+    prepare_profraw_dir
 done;
 
 echo "Running coverage tests over uucore"