diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index a164d16fbf..46b2863080 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -28,7 +28,7 @@ jobs:
         uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
       # https://docs.github.com/en/free-pro-team@latest/actions/reference/workflow-commands-for-github-actions#setting-an-environment-variable
       - name: Set the $COVERITY_SCAN_NOTIFICATION_EMAIL env variable
-        run: echo "COVERITY_SCAN_NOTIFICATION_EMAIL=$(git log -1 ${{ github.sha }} --pretty=\"%aE\")" >> $GITHUB_ENV
+        run: echo "COVERITY_SCAN_NOTIFICATION_EMAIL=$(git log -1 ${{ github.sha }} --pretty=\"%aE\")" >> "$GITHUB_ENV"
       - name: Install Coverity tools
         run: tools/get-coverity.sh
       # Reuse the setup phase of the unit test script to avoid code duplication
diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index 4d72a9829f..14b3343796 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -44,3 +44,4 @@ jobs:
           MULTI_STATUS: true
           VALIDATE_ALL_CODEBASE: false
           VALIDATE_BASH: true
+          VALIDATE_GITHUB_ACTIONS: true
diff --git a/.github/workflows/mkosi.yml b/.github/workflows/mkosi.yml
index 966e364f71..daf009a3b1 100644
--- a/.github/workflows/mkosi.yml
+++ b/.github/workflows/mkosi.yml
@@ -58,7 +58,7 @@ jobs:
         sudo apt build-dep systemd
         meson build
         ninja -C build
-        sudo ln -svf $PWD/build/systemd-nspawn `which systemd-nspawn`
+        sudo ln -svf "$PWD/build/systemd-nspawn" "$(which systemd-nspawn)"
         systemd-nspawn --version
 
     - name: Build ${{ matrix.distro }}