diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index dcc6653659..bd3016b57c 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -112,8 +112,10 @@ jobs:
       - name: Export digest
         run: |
           mkdir -p ${{ runner.temp }}/digests
-          digest="${{ steps.build.outputs.digest }}"
+          digest="$BUILD_DIGEST"
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
+        env:
+          BUILD_DIGEST: ${{ steps.build.outputs.digest }}
 
       - name: Upload digest
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 4331b3e6ba..93a8831637 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -68,7 +68,9 @@ jobs:
           mdbook-version: '0.5.2'
 
       - name: Set version of docs
-        run: echo 'window.SYNAPSE_VERSION = "${{ needs.pre.outputs.branch-version }}";' > ./docs/website_files/version.js
+        run: echo 'window.SYNAPSE_VERSION = "${NEEDS_PRE_OUTPUTS_BRANCH_VERSION}";' > ./docs/website_files/version.js
+        env:
+          NEEDS_PRE_OUTPUTS_BRANCH_VERSION: ${{ needs.pre.outputs.branch-version }}
 
       - name: Setup python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
diff --git a/.github/workflows/push_complement_image.yml b/.github/workflows/push_complement_image.yml
index 5d26a2f2fe..730d0741f5 100644
--- a/.github/workflows/push_complement_image.yml
+++ b/.github/workflows/push_complement_image.yml
@@ -74,9 +74,12 @@ jobs:
         run: scripts-dev/complement.sh --build-only
       - name: Tag and push generated image
         run: |
-          for TAG in ${{ join(fromJson(steps.meta.outputs.json).tags, ' ') }}; do 
+          while IFS= read -r TAG; do
+            [ -n "$TAG" ] || continue
             echo "tag and push $TAG"
             # `localhost/complement-synapse` should match the image created by `scripts-dev/complement.sh`
-            docker tag localhost/complement-synapse $TAG
-            docker push $TAG
-          done
+            docker tag localhost/complement-synapse "$TAG"
+            docker push "$TAG"
+          done <<< "$DOCKER_METADATA_OUTPUT_TAGS"
+        env:
+          DOCKER_METADATA_OUTPUT_TAGS: ${{ steps.meta.outputs.tags }}
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 7352382128..50a940a81a 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -96,9 +96,11 @@ jobs:
             --docker-build-arg=--cache-to=type=local,mode=max,dest=/tmp/.buildx-cache-new \
             --docker-build-arg=--progress=plain \
             --docker-build-arg=--load \
-            "${{ matrix.distro }}"
+            "${MATRIX_DISTRO}"
           rm -rf /tmp/.buildx-cache
           mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+        env:
+          MATRIX_DISTRO: ${{ matrix.distro }}
 
       - name: Artifact name
         id: artifact-name
@@ -217,7 +219,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "${GITHUB_REF_NAME}" \
             Sdist/* \
             Wheel*/* \
             debs.tar.xz \
diff --git a/.github/workflows/twisted_trunk.yml b/.github/workflows/twisted_trunk.yml
index 991d3d3aeb..63d06a98ac 100644
--- a/.github/workflows/twisted_trunk.yml
+++ b/.github/workflows/twisted_trunk.yml
@@ -63,8 +63,10 @@ jobs:
           poetry-version: "2.4.1"
       - run: |
           poetry remove twisted
-          poetry add --extras tls git+https://github.com/twisted/twisted.git#${{ inputs.twisted_ref || 'trunk' }}
+          poetry add --extras tls "git+https://github.com/twisted/twisted.git#${TWISTED_REF}"
           poetry install --no-interaction --extras "all test"
+        env:
+          TWISTED_REF: ${{ inputs.twisted_ref || 'trunk' }}
       - name: Remove unhelpful options from mypy config
         run: sed -e '/warn_unused_ignores = True/d' -e '/warn_redundant_casts = True/d' -i mypy.ini
       - run: poetry run mypy