diff --git a/ansible/roles/compiled/templates/cromwell_slurm.conf b/ansible/roles/compiled/templates/cromwell_slurm.conf
index 69fcf98..264f321 100644
--- a/ansible/roles/compiled/templates/cromwell_slurm.conf
+++ b/ansible/roles/compiled/templates/cromwell_slurm.conf
@@ -34,6 +34,10 @@ backend {
         # pull the image once into the user's Singularity cache, then run the task
         # inside it. Bash variables are written bare ($IMAGE), never with braces:
         # Cromwell interpolates the braced form itself before bash sees the script.
+        # Cromwell also wraps this string in a WDL command block, which the first
+        # closing brace that does not end one of its own references terminates
+        # ("Unrecognized token: sbatch"). So no bash brace groups or brace expansion
+        # anywhere in the string, shell comments included: use if/fi instead.
         submit-docker = """
             # Cache pulled images per user, on scratch rather than quota-limited $HOME.
             if [ -z "$SINGULARITY_CACHEDIR" ]; then
@@ -67,7 +71,11 @@ backend {
                   && mv $IMAGE.tmp $IMAGE \
                   && echo "successfully pulled ${docker}!"
               fi
-            ) 9>$LOCK_FILE || { echo "Failed to pull ${docker}" >&2; exit 1; }
+            ) 9>$LOCK_FILE
+            if [ $? -ne 0 ]; then
+              echo "Failed to pull ${docker}" >&2
+              exit 1
+            fi
 
             # Submit the script to SLURM. `singularity` here and above comes from the
             # unversioned `singularity` module that cromwell.lua loads; sbatch exports