diff --git a/Library/Homebrew/sandbox.rb b/Library/Homebrew/sandbox.rb
index 571d540fe7..ab94abc9f8 100644
--- a/Library/Homebrew/sandbox.rb
+++ b/Library/Homebrew/sandbox.rb
@@ -97,29 +97,29 @@ class Sandbox
     seatbelt.close
     @start = Time.now
 
-    $stdin.raw! if $stdin.tty?
-    stdin_thread = T.let(nil, T.nilable(Thread))
-
     begin
       command = [SANDBOX_EXEC, "-f", seatbelt.path, *args]
       # Start sandbox in a pseudoterminal to prevent access of the parent terminal.
       T.unsafe(PTY).spawn(*command) do |r, w, pid|
-        if $stdout.tty?
-          w.winsize = $stdout.winsize
-          trap(:WINCH) { w.winsize = $stdout.winsize }
-        end
+        old_winch = trap(:WINCH) { w.winsize = $stdout.winsize if $stdout.tty? }
+        w.winsize = $stdout.winsize if $stdout.tty?
+
+        $stdin.raw! if $stdin.tty?
         stdin_thread = Thread.new { IO.copy_stream($stdin, w) }
+
         r.each_char { |c| print(c) }
+
         Process.wait(pid)
+      ensure
+        stdin_thread&.kill
+        $stdin.cooked! if $stdin.tty?
+        trap(:WINCH, old_winch)
       end
       raise ErrorDuringExecution.new(command, status: $CHILD_STATUS) unless $CHILD_STATUS.success?
     rescue
       @failed = true
       raise
     ensure
-      stdin_thread&.kill
-      $stdin.cooked! if $stdin.tty?
-
       seatbelt.unlink
       sleep 0.1 # wait for a bit to let syslog catch up the latest events.
       syslog_args = [