diff --git a/.github/workflows/chart-release.yaml b/.github/workflows/chart-release.yaml
index c572ab4aa..5e56a1d44 100644
--- a/.github/workflows/chart-release.yaml
+++ b/.github/workflows/chart-release.yaml
@@ -23,14 +23,14 @@ jobs:
       - name: Package helm chart
         id: helm
         run: |
-          HELM_PACKAGE_DIR=$(mktemp -d)
+          HELM_PACKAGE_DIR="$(mktemp -d)"
           helm dependency update ./helm
           helm package \
               --app-version="${{ github.event.release.tag_name }}" \
               --version="${{ github.event.release.tag_name }}" \
-              -d $HELM_PACKAGE_DIR \
+              -d "$HELM_PACKAGE_DIR" \
               helm
-          echo "package_dir=$HELM_PACKAGE_DIR" >> $GITHUB_OUTPUT
+          echo "package_dir=$HELM_PACKAGE_DIR" >> "$GITHUB_OUTPUT"
       - name: Upload attachment to GH release
         run: |
           gh release upload ${{ github.event.release.tag_name }} ${{ steps.helm.outputs.package_dir }}/collab-manager-*.tgz
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c6aacfdbe..8aeb3da65 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -23,7 +23,7 @@ jobs:
       - name: Install kubeconform
         run: |
           go install github.com/yannh/kubeconform/cmd/kubeconform@latest
-          echo "$HOME/go/bin" >> $GITHUB_PATH
+          echo "$HOME/go/bin" >> "$GITHUB_PATH"
       - name: Run helm dependency update
         run: |
           helm dependency update ./helm
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
index 39a6441b5..0cc8d31cc 100644
--- a/.github/workflows/push.yml
+++ b/.github/workflows/push.yml
@@ -58,7 +58,7 @@ jobs:
       - name: Extract metadata for Docker
         id: tag
         run: |
-          echo "branch=$(echo $GITHUB_REF_NAME | sed 's/[^a-zA-Z0-9.]/-/g')" >> "$GITHUB_OUTPUT"
+          echo "branch=${GITHUB_REF_NAME//[^a-zA-Z0-9.]/-}" >> "$GITHUB_OUTPUT"
           echo "sha=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
       - name: Build and push Docker image
         id: build-and-push
@@ -81,7 +81,7 @@ jobs:
       - name: Extract metadata for Docker
         id: tag
         run: |
-          echo "branch=$(echo $GITHUB_REF_NAME | sed 's/[^a-zA-Z0-9.]/-/g')" >> "$GITHUB_OUTPUT"
+          echo "branch=${GITHUB_REF_NAME//[^a-zA-Z0-9.]/-}" >> "$GITHUB_OUTPUT"
           echo "sha=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
       - name: Create k8s Kind Cluster
         uses: helm/kind-action@v1.10.0
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index aa9dfd980..c024c4699 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -55,7 +55,8 @@ jobs:
         run: |
           npm i -g @angular/cli
           npm ci
-          export CHROME_BIN=$(which chromium)
+          CHROME_BIN="$(which chromium)"
+          export CHROME_BIN
       - name: Run tests
         working-directory: frontend
         run: |
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index de83d5a91..8b69b5730 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -50,6 +50,10 @@ repos:
       - id: isort
         entry: bash -c "cd backend && isort ."
         types: [python]
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.2
+    hooks:
+      - id: actionlint-docker
   - repo: https://github.com/pre-commit/mirrors-mypy
     rev: v1.11.2
     hooks: