diff --git a/.github/workflows/mirror-oss.yml b/.github/workflows/mirror-oss.yml
index 71ded3d..159a24c 100644
--- a/.github/workflows/mirror-oss.yml
+++ b/.github/workflows/mirror-oss.yml
@@ -128,7 +128,22 @@ jobs:
             --endpoint "${OSS_ENDPOINT}" \
             --output-format json > bucket-versioning.json
           python - <<'PY'
-          from scripts.ossutil_json import load_ossutil_json
+          import json
+          import re
+          from pathlib import Path
+
+          def load_ossutil_json(path: str) -> object:
+              raw = Path(path).read_text(encoding="utf-8")
+              document = raw.lstrip("\ufeff \t\r\n")
+              if not document.startswith(("{", "[")):
+                  raise ValueError(
+                      "ossutil output does not start with a JSON object or array"
+                  )
+              value, end = json.JSONDecoder().raw_decode(document)
+              trailing = document[end:].strip()
+              if trailing and not re.fullmatch(r"\d+(?:\.\d+)?\(s\) elapsed", trailing):
+                  raise ValueError("unexpected output after ossutil JSON document")
+              return value
 
           value = load_ossutil_json("bucket-versioning.json")
 
@@ -186,9 +201,23 @@ jobs:
               --endpoint "${OSS_ENDPOINT}" \
               --output-format json > "${metadata}"
             METADATA_PATH="${metadata}" python - <<'PY'
+          import json
           import os
           import re
-          from scripts.ossutil_json import load_ossutil_json
+          from pathlib import Path
+
+          def load_ossutil_json(path: str) -> object:
+              raw = Path(path).read_text(encoding="utf-8")
+              document = raw.lstrip("\ufeff \t\r\n")
+              if not document.startswith(("{", "[")):
+                  raise ValueError(
+                      "ossutil output does not start with a JSON object or array"
+                  )
+              value, end = json.JSONDecoder().raw_decode(document)
+              trailing = document[end:].strip()
+              if trailing and not re.fullmatch(r"\d+(?:\.\d+)?\(s\) elapsed", trailing):
+                  raise ValueError("unexpected output after ossutil JSON document")
+              return value
 
           value = load_ossutil_json(os.environ["METADATA_PATH"])
 
diff --git a/tests/test_workflow_contract.py b/tests/test_workflow_contract.py
index a617f46..88f7fdc 100644
--- a/tests/test_workflow_contract.py
+++ b/tests/test_workflow_contract.py
@@ -74,7 +74,8 @@ def test_oss_workflow_has_no_moving_alias_and_uses_reviewed_shared_bucket() -> N
     assert "oss-version-ids.json" in workflow
     assert 'active != {"enabled"}' in workflow
     assert "load_ossutil_json" in workflow
-    assert "scripts.ossutil_json" in workflow
+    assert workflow.count("JSONDecoder().raw_decode") == 2
+    assert workflow.count("unexpected output after ossutil JSON document") == 2
 
 
 def test_all_external_actions_are_pinned_to_full_commit_sha() -> None: