diff --git a/.github/workflows/gitops-prd.yml b/.github/workflows/gitops-prd.yml
index 6815b229..5a3d279e 100644
--- a/.github/workflows/gitops-prd.yml
+++ b/.github/workflows/gitops-prd.yml
@@ -106,7 +106,7 @@ jobs:
 
       - name: get tag name
         id: get-tag-name
-        run: echo tag-name="${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
+        run: echo tag-name="${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
 
       - name: Update image-tags
         working-directory: dreamkast-infra/ecspresso/prod
diff --git a/.github/workflows/reviewapp-cleanup.yml b/.github/workflows/reviewapp-cleanup.yml
index b5145f77..c99380ab 100644
--- a/.github/workflows/reviewapp-cleanup.yml
+++ b/.github/workflows/reviewapp-cleanup.yml
@@ -43,8 +43,8 @@ jobs:
           PREFIX: ui-
         shell: bash -xe {0}
         run: |
-          set -e
-          EXPECTED="$(gh pr list --repo ${{ github.repository }} --label 'reviewapps' --json number --jq '.[].number' | sed 's/^\(.*\)$/'$PREFIX'\1/g')"
+          EXPECTED="$(gh pr list --repo ${{ github.repository }} --label 'reviewapps' --json number --jq '.[].number' | sed 's/^\(.*\)$/'"$PREFIX"'\1/g')"
+          # shellcheck disable=SC2010,SC2086
           ACTUAL="$(ls | grep -E ^$PREFIX)"
 
           # If present only in ACTUAL, cleanup
@@ -53,9 +53,9 @@ jobs:
             for exp in $EXPECTED; do
               [ "$act" = "$exp" ] && EXIST=true
             done
-            [ $EXIST = true ] && continue
-            bash -x $act/cleanup.sh
-            rm -rf $act
+            [ "$EXIST" = "true" ] && continue
+            bash -x "$act/cleanup.sh"
+            rm -rf "$act"
           done
 
       - name: Commit files