diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 8c01b0592c2..dc827d62ba7 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -72,7 +72,9 @@ jobs:
 
       - name: Start the CI
         run: |
+          read -r -a numbers <<< "$PULL_REQUESTS"
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
-          | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
+          | sh -s -- "${numbers[@]}"
         env:
           GH_TOKEN: ${{ github.token }}
+          PULL_REQUESTS: ${{ needs.get-prs-for-ci.outputs.numbers }}
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 924feb42725..7f10917e238 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -47,7 +47,9 @@ jobs:
     steps:
       - name: Mark token input as sensitive
         if: inputs.token != ''
-        run: echo "::add-mask::${{ inputs.token }}"
+        run: printf '::add-mask::%s\n' "$COMMENT_TOKEN"
+        env:
+          COMMENT_TOKEN: ${{ inputs.token }}
       - name: Add link to the current run
         id: comment
         run: |
@@ -155,7 +157,7 @@ jobs:
         run: |
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
-            --pure --keep FILTER --keep LC_ALL --keep LANG \
+            --pure --keep CATEGORIES --keep FILTER --keep RUNS --keep LC_ALL --keep LANG \
             --arg loadJSBuiltinsDynamically false \
             --arg ccache 'null' \
             --arg icu 'null' \
@@ -163,11 +165,12 @@ jobs:
             --arg devTools '[]' \
             --run '
                 set -o pipefail
+                read -r -a categories <<< "$CATEGORIES"
                 ./base_node benchmark/compare.js \
                   --filter "$FILTER" \
-                  --runs ${{ inputs.runs }} \
+                  --runs "$RUNS" \
                   --old ./base_node --new ./node \
-                  -- ${{ inputs.category }} \
+                  -- "${categories[@]}" \
                 | tee /dev/stderr \
                 > ${{ matrix.system }}.csv
                 echo "> [!WARNING] "
@@ -185,7 +188,9 @@ jobs:
                 echo "> using a dedicated machine, e.g. Jenkins CI."
             ' | tee /dev/stderr >> "$GITHUB_STEP_SUMMARY"
         env:
+          CATEGORIES: ${{ inputs.category }}
           FILTER: ${{ inputs.filter }}
+          RUNS: ${{ inputs.runs }}
 
       - name: Upload raw benchmark results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -246,7 +251,9 @@ jobs:
             ' | tee /dev/stderr ${{ inputs.post-comment && 'body.txt' || '' }} >> "$GITHUB_STEP_SUMMARY"
       - name: Mark token input as sensitive
         if: inputs.token != ''
-        run: echo "::add-mask::${{ inputs.token }}"
+        run: printf '::add-mask::%s\n' "$COMMENT_TOKEN"
+        env:
+          COMMENT_TOKEN: ${{ inputs.token }}
       - name: Edit comment
         if: inputs.post-comment
         run: |
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 8f29a390c67..83f921838b3 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -196,6 +196,8 @@ jobs:
           git config --local user.email "github-bot@iojs.org"
           git config --local user.name "Node.js GitHub Bot"
           ncu-config set token "$GH_TOKEN"
-          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
+          read -r -a numbers <<< "$PULL_REQUESTS"
+          ./tools/actions/commit-queue.sh "${numbers[@]}"
         env:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.numbers }}
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
index 8901ecbcee4..d15f21010cd 100644
--- a/.github/workflows/daily-wpt-fyi.yml
+++ b/.github/workflows/daily-wpt-fyi.yml
@@ -122,7 +122,9 @@ jobs:
       - name: Clone report for upload
         if: ${{ env.WPT_REPORT != '' }}
         working-directory: out/wpt
-        run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json
+        run: cp wptreport.json "wptreport-$NODE_VERSION.json"
+        env:
+          NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
       - name: Upload GitHub Actions artifact
         if: ${{ env.WPT_REPORT != '' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -133,12 +135,13 @@ jobs:
       - name: Upload WPT Report to wpt.fyi API
         if: ${{ env.WPT_REPORT != '' }}
         env:
+          NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
           WPT_FYI_USERNAME: ${{ vars.WPT_FYI_USERNAME }}
           WPT_FYI_PASSWORD: ${{ secrets.WPT_FYI_PASSWORD }}
         working-directory: out/wpt
         run: |
           gzip wptreport.json
-          echo "## Node.js ${{ steps.setup-node.outputs.node-version }}" >> $GITHUB_STEP_SUMMARY
+          echo "## Node.js $NODE_VERSION" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "WPT Revision: [\`${WPT_REVISION:0:7}\`](https://github.com/web-platform-tests/wpt/commits/$WPT_REVISION)" >> $GITHUB_STEP_SUMMARY
           for WPT_FYI_ENDPOINT in "https://wpt.fyi/api/results/upload" "https://staging.wpt.fyi/api/results/upload"
diff --git a/.github/workflows/timezone-update.yml b/.github/workflows/timezone-update.yml
index 481c20da4e0..abe4516db4a 100644
--- a/.github/workflows/timezone-update.yml
+++ b/.github/workflows/timezone-update.yml
@@ -40,14 +40,14 @@ jobs:
 
       - name: Compare versions
         run: |
-          echo "Comparing current version ${{ env.current_version }} to new version ${{ env.new_version }}"
+          echo "Comparing current version $current_version to new version $new_version"
 
       - run: ./tools/dep_updaters/update-timezone.mjs
         if: ${{ env.new_version != env.current_version }}
 
       - name: Update the expected timezone version in test
         if: ${{ env.new_version != env.current_version }}
-        run: echo "${{ env.new_version }}" > test/fixtures/tz-version.txt
+        run: printf '%s\n' "$new_version" > test/fixtures/tz-version.txt
 
       - name: Open Pull Request
         if: ${{ env.new_version != env.current_version }}
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index e204c6b4314..b70bc4c34f7 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -329,7 +329,7 @@ jobs:
       - name: Generate commit message if not set
         if: env.COMMIT_MSG == '' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
         run: |
-          echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to ${{ env.NEW_VERSION }}" >> "$GITHUB_ENV"
+          echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to $NEW_VERSION" >> "$GITHUB_ENV"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         # Creates a PR or update the Action's existing PR, or