diff --git a/.github/workflows/docker_release.yml b/.github/workflows/docker_release.yml
index 5a2e256..9a0824d 100644
--- a/.github/workflows/docker_release.yml
+++ b/.github/workflows/docker_release.yml
@@ -52,21 +52,21 @@ jobs:
           # workflow_dispatch uses the selected platforms input
 
           if [[ "${{ github.event_name }}" == "release" ]]; then
-            echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest"},{"platform":"linux/arm64","runner":"ubuntu-24.04-arm"}]}' >> $GITHUB_OUTPUT
-            echo "is_multi_arch=true" >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest"},{"platform":"linux/arm64","runner":"ubuntu-24.04-arm"}]}' >> "$GITHUB_OUTPUT"
+            echo "is_multi_arch=true" >> "$GITHUB_OUTPUT"
           elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
             PLATFORMS="${{ inputs.platforms }}"
             if [[ "$PLATFORMS" == *"arm64"* ]]; then
-              echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest"},{"platform":"linux/arm64","runner":"ubuntu-24.04-arm"}]}' >> $GITHUB_OUTPUT
-              echo "is_multi_arch=true" >> $GITHUB_OUTPUT
+              echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest"},{"platform":"linux/arm64","runner":"ubuntu-24.04-arm"}]}' >> "$GITHUB_OUTPUT"
+              echo "is_multi_arch=true" >> "$GITHUB_OUTPUT"
             else
-              echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest"}]}' >> $GITHUB_OUTPUT
-              echo "is_multi_arch=false" >> $GITHUB_OUTPUT
+              echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest"}]}' >> "$GITHUB_OUTPUT"
+              echo "is_multi_arch=false" >> "$GITHUB_OUTPUT"
             fi
           else
             # Push to master - only amd64 for faster dev builds
-            echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest"}]}' >> $GITHUB_OUTPUT
-            echo "is_multi_arch=false" >> $GITHUB_OUTPUT
+            echo 'matrix={"include":[{"platform":"linux/amd64","runner":"ubuntu-latest"}]}' >> "$GITHUB_OUTPUT"
+            echo "is_multi_arch=false" >> "$GITHUB_OUTPUT"
           fi
 
   build:
@@ -79,9 +79,9 @@ jobs:
     steps:
       - name: Prepare environment
         run: |
-          platform=${{ matrix.platform }}
-          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
-          echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
+          platform="${{ matrix.platform }}"
+          echo "PLATFORM_PAIR=${platform//\//-}" >> "$GITHUB_ENV"
+          echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
 
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -137,7 +137,7 @@ jobs:
     steps:
       - name: Prepare environment
         run: |
-          echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
+          echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV"
 
       - name: Download digests
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
@@ -172,6 +172,7 @@ jobs:
       - name: Create manifest list and push
         working-directory: /tmp/digests
         run: |
+          # shellcheck disable=SC2046
           docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
             $(printf '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@sha256:%s ' *)
 
diff --git a/flake.nix b/flake.nix
index 3ec5475..2cb3998 100644
--- a/flake.nix
+++ b/flake.nix
@@ -30,6 +30,7 @@
           docker-compose
           opencode
           typos
+          actionlint
           nodejs_22
           yarn
           erlang_28
diff --git a/lefthook.yml b/lefthook.yml
index 2f2d30e..7e65091 100644
--- a/lefthook.yml
+++ b/lefthook.yml
@@ -9,3 +9,6 @@ pre-commit:
       run: mix format --check-formatted
     - name: typos
       run: typos {staged_files}
+    - name: actionlint
+      glob: '.github/workflows/*.{yml,yaml}'
+      run: actionlint {staged_files}