diff --git a/TODO.md b/TODO.md
index e386516..1f225f7 100644
--- a/TODO.md
+++ b/TODO.md
@@ -18,6 +18,12 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-06: `script/test` runs the tests with the race detector, a 30-second
+  timeout per package and coverage, as `REPO_POLICIES.md` requires
+  (https://git.eeqj.de/sneak/secret/issues/32). When they fail, it reruns them
+  verbosely for the details and then fails anyway, so a test that fails once and
+  passes on the retry no longer gives a green build. `go vet` still runs first,
+  and every `go test` keeps `-count=1`.
 - 2026-10-06: `make test` in `script/cibuild` no longer compiles the standard
   library and every dependency from nothing on every build
   (https://git.eeqj.de/sneak/secret/issues/124). The `Dockerfile` runs it and
diff --git a/script/test b/script/test
index 7a48c8b..f2a4ff4 100755
--- a/script/test
+++ b/script/test
@@ -1,5 +1,6 @@
 #!/bin/sh
-# script/test: run the test suite (vet first, verbose rerun on failure).
+# script/test: run the test suite (vet first, then the tests with the race
+# detector; a verbose rerun on failure).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -10,8 +11,12 @@ main() {
     export CGO_ENABLED=1
     go vet ./...
     # -count=1: run every test, never take a result from Go's test cache,
-    # which the Dockerfile keeps between builds
-    go test -count=1 ./... || go test -count=1 -v ./...
+    # which the Dockerfile keeps between builds. The rerun only prints
+    # details: `exit 1` keeps the script failing even if a flaky test
+    # passes on the second attempt.
+    go test -count=1 -timeout 30s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -count=1 -timeout 30s -race -v ./...; exit 1; }
 }
 
 main "$@"