diff --git a/.github/workflows/back-merge-pr.yml b/.github/workflows/back-merge-pr.yml
index cec0f26..67cb2ef 100644
--- a/.github/workflows/back-merge-pr.yml
+++ b/.github/workflows/back-merge-pr.yml
@@ -26,6 +26,7 @@ jobs:
       - name: Open back-merge PR if needed
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           git fetch origin development master
@@ -38,7 +39,7 @@ jobs:
             exit 0
           fi
 
-          EXISTING=$(gh pr list --repo "${{ github.repository }}" \
+          EXISTING=$(gh pr list --repo "$REPO" \
             --base development \
             --head master \
             --state open \
@@ -50,7 +51,7 @@ jobs:
             exit 0
           fi
 
-          gh pr create --repo "${{ github.repository }}" \
+          gh pr create --repo "$REPO" \
             --base development \
             --head master \
             --title "chore: back-merge master into development" \
diff --git a/.github/workflows/check-version-bump.yml b/.github/workflows/check-version-bump.yml
index 51e052c..5f7d844 100644
--- a/.github/workflows/check-version-bump.yml
+++ b/.github/workflows/check-version-bump.yml
@@ -14,13 +14,14 @@ jobs:
           fetch-depth: 0
       - name: Validate version and changelog updates
         shell: bash
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
 
           VERSION_FILE="package.json"
           CHANGELOG_FILE="CHANGELOG.md"
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
-          HEAD_SHA="${{ github.event.pull_request.head.sha }}"
 
           mapfile -t CHANGED_FILES < <(git diff --name-only "$BASE_SHA" "$HEAD_SHA")
           if [ "${#CHANGED_FILES[@]}" -eq 0 ]; then
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bc11dca..3cbd0e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,9 @@ jobs:
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
-        run: npm publish --access public --tag ${{ github.event.release.prerelease && 'beta' || 'latest' }}
+        env:
+          NPM_TAG: ${{ github.event.release.prerelease && 'beta' || 'latest' }}
+        run: npm publish --access public --tag "$NPM_TAG"
 
   publish-github:
     if: ${{ startsWith(github.event.release.tag_name, 'v') && !github.event.release.draft }}
@@ -64,6 +66,7 @@ jobs:
       - name: Update npm
         run: npm install -g npm@latest
       - name: Release
-        run: npm publish --access public --tag ${{ github.event.release.prerelease && 'beta' || 'latest' }}
+        run: npm publish --access public --tag "$NPM_TAG"
         env:
+          NPM_TAG: ${{ github.event.release.prerelease && 'beta' || 'latest' }}
           NODE_AUTH_TOKEN: ${{ github.token }}