diff --git a/.github/workflows/lagoon-cli.yaml b/.github/workflows/lagoon-cli.yaml
index 330263ab..e0efc652 100644
--- a/.github/workflows/lagoon-cli.yaml
+++ b/.github/workflows/lagoon-cli.yaml
@@ -48,15 +48,15 @@ jobs:
         if: "!startsWith(github.ref, 'refs/tags/')"
         id: version_tag_build
         run: |
-          VERSION=$(echo $(git describe --abbrev=0 --tags)+$(git rev-parse --short=8 HEAD))
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          VERSION="$(git describe --abbrev=0 --tags)+$(git rev-parse --short=8 HEAD)"
+          echo "VERSION=$VERSION" >> "$GITHUB_ENV"
           echo "tag is $VERSION"
       -
         name: Set tag version for tag
         if: "startsWith(github.ref, 'refs/tags/')"
         id: version_tag
         run: |
-          echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
+          echo "VERSION=${GITHUB_REF#refs/tags/}" >> "$GITHUB_ENV"
           echo "tag is $VERSION"
       -
         name: Docker meta
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 3c5cf144..51c4328e 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -25,4 +25,4 @@ jobs:
     - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
     - uses: docker://rhysd/actionlint:1.7.0@sha256:601d6faeefa07683a4a79f756f430a1850b34d575d734b1d1324692202bf312e # v1.7.0
       with:
-        args: -color -shellcheck=
+        args: -color
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index c8f9ecbf..a742bec9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -24,11 +24,11 @@ jobs:
         make test
     - name: Compile CLI
       run: |
-        make VERSION=${GITHUB_REF##*/} build-linux
-        make VERSION=${GITHUB_REF##*/} build-darwin
+        make VERSION="${GITHUB_REF##*/}" build-linux
+        make VERSION="${GITHUB_REF##*/}" build-darwin
         # create the archived versions and remove anything not required for the release
         rm ./builds/README.md ./builds/release_template.md
-        for BUILD in $(ls builds); do tar --transform="flags=r;s|${BUILD}|lagoon|" -czf builds/${BUILD}.tar.gz -C builds ${BUILD}; done
+        for BUILD in builds/*; do tar --transform="flags=r;s|${BUILD#builds/}|lagoon|" -czf "$BUILD.tar.gz" -C builds "${BUILD#builds/}"; done
     - name: Generate SBOM from Github API
       uses: advanced-security/sbom-generator-action@375dee8e6144d9fd0ec1f5667b4f6fb4faacefed # v0.0.1
       id: sbom