diff --git a/.github/workflows/reusable-ci.md b/.github/workflows/reusable-ci.md
index 838af17..405d3ec 100644
--- a/.github/workflows/reusable-ci.md
+++ b/.github/workflows/reusable-ci.md
@@ -89,3 +89,5 @@ The caller job should grant `contents: read` because the reusable workflow check
 | Job | Description |
 | --- | --- |
 | `ci` | Runs setup, then the enabled `pnpm` commands. |
+
+The build, post-build, lint, fmt, and typecheck script inputs are passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.
diff --git a/.github/workflows/reusable-ci.yaml b/.github/workflows/reusable-ci.yaml
index 4038542..4212b19 100644
--- a/.github/workflows/reusable-ci.yaml
+++ b/.github/workflows/reusable-ci.yaml
@@ -116,30 +116,30 @@ jobs:
 
       - name: build
         if: ${{ inputs.build }}
-        env:
-          BUILD_SCRIPT: ${{ inputs.build-script }}
-        run: pnpm $BUILD_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.build-script }}
 
       - name: post-build
         if: ${{ inputs.build && inputs.post-build-script != '' }}
-        env:
-          POST_BUILD_SCRIPT: ${{ inputs.post-build-script }}
-        run: pnpm $POST_BUILD_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.post-build-script }}
 
       - name: lint
         if: ${{ inputs.lint }}
-        env:
-          LINT_SCRIPT: ${{ inputs.lint-script }}
-        run: pnpm $LINT_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.lint-script }}
 
       - name: fmt
         if: ${{ inputs.fmt }}
-        env:
-          FMT_SCRIPT: ${{ inputs.fmt-script }}
-        run: pnpm $FMT_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.fmt-script }}
 
       - name: typecheck
         if: ${{ inputs.typecheck }}
-        env:
-          TYPECHECK_SCRIPT: ${{ inputs.typecheck-script }}
-        run: pnpm $TYPECHECK_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.typecheck-script }}
diff --git a/.github/workflows/reusable-release-npm.md b/.github/workflows/reusable-release-npm.md
index 757ea4e..93972eb 100644
--- a/.github/workflows/reusable-release-npm.md
+++ b/.github/workflows/reusable-release-npm.md
@@ -110,3 +110,5 @@ jobs:
 | Job | Description |
 | --- | --- |
 | `release` | Builds and publishes the package or workspace packages to npm. |
+
+The install, build, and publish arguments are passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.
diff --git a/.github/workflows/reusable-release-npm.yaml b/.github/workflows/reusable-release-npm.yaml
index da776d8..4d10e62 100644
--- a/.github/workflows/reusable-release-npm.yaml
+++ b/.github/workflows/reusable-release-npm.yaml
@@ -84,15 +84,15 @@ jobs:
         run: pnpx changelogithub
 
       - name: install dependencies
-        env:
-          INSTALL_ARGS: ${{ inputs.install-args }}
-        run: pnpm install --frozen-lockfile $INSTALL_ARGS
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: install --frozen-lockfile ${{ inputs.install-args }}
 
       - name: build
         if: ${{ inputs.build }}
-        env:
-          BUILD_SCRIPT: ${{ inputs.build-script }}
-        run: pnpm $BUILD_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.build-script }}
 
       - name: detect tag
         id: tag
@@ -108,17 +108,15 @@ jobs:
       - name: publish to npm (staging)
         if: ${{ inputs.stage }}
         env:
-          TAG: ${{ steps.tag.outputs.tag }}
           NPM_CONFIG_PROVENANCE: "true"
-          PUBLISH_ARGS: ${{ inputs.publish-args }}
-          RECURSIVE: ${{ inputs.recursive }}
-        run: pnpm stage publish ${{ env.RECURSIVE == 'true' && '-r' || '' }} --tag "$TAG" $PUBLISH_ARGS
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: stage publish ${{ inputs.recursive && '-r' || '' }} --tag ${{ steps.tag.outputs.tag }} ${{ inputs.publish-args }}
 
       - name: publish to npm
         if: ${{ !inputs.stage }}
         env:
-          TAG: ${{ steps.tag.outputs.tag }}
           NPM_CONFIG_PROVENANCE: "true"
-          PUBLISH_ARGS: ${{ inputs.publish-args }}
-          RECURSIVE: ${{ inputs.recursive }}
-        run: pnpm publish ${{ env.RECURSIVE == 'true' && '-r' || '' }} --tag "$TAG" $PUBLISH_ARGS
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: publish ${{ inputs.recursive && '-r' || '' }} --tag ${{ steps.tag.outputs.tag }} ${{ inputs.publish-args }}
diff --git a/.github/workflows/reusable-test-build-tools.md b/.github/workflows/reusable-test-build-tools.md
index a5ea453..704a912 100644
--- a/.github/workflows/reusable-test-build-tools.md
+++ b/.github/workflows/reusable-test-build-tools.md
@@ -94,4 +94,4 @@ The caller job should grant `contents: read` because the reusable workflow check
 
 The workflow modifies the checked out workspace by adding the selected build tool package before running commands. It does not commit or upload those changes.
 
-The build, test, and typecheck inputs are passed as arguments to `pnpm`, so callers should only pass trusted command names or arguments.
+The build, test, and typecheck inputs are passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.
diff --git a/.github/workflows/reusable-test-build-tools.yaml b/.github/workflows/reusable-test-build-tools.yaml
index efaa0b7..52779b7 100644
--- a/.github/workflows/reusable-test-build-tools.yaml
+++ b/.github/workflows/reusable-test-build-tools.yaml
@@ -102,16 +102,16 @@ jobs:
           pnpm add -Dw "$TOOL_NAME@$TOOL_VERSION"
 
       - name: build
-        env:
-          BUILD_SCRIPT: ${{ inputs.build-script }}
-        run: pnpm $BUILD_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.build-script }}
 
       - name: test
-        env:
-          TEST_SCRIPT: ${{ inputs.test-script }}
-        run: pnpm $TEST_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.test-script }}
 
       - name: typecheck
-        env:
-          TYPECHECK_SCRIPT: ${{ inputs.typecheck-script }}
-        run: pnpm $TYPECHECK_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.typecheck-script }}
diff --git a/.github/workflows/reusable-test.md b/.github/workflows/reusable-test.md
index f1d147f..8fd7f8b 100644
--- a/.github/workflows/reusable-test.md
+++ b/.github/workflows/reusable-test.md
@@ -78,3 +78,5 @@ The caller job should grant `contents: read` because the reusable workflow check
 | Job | Description |
 | --- | --- |
 | `test` | Runs setup, then runs the configured `pnpm` test command. |
+
+The test script input is passed to `pnpm` through `actions/run-pnpm` without shell re-interpretation.
diff --git a/.github/workflows/reusable-test.yaml b/.github/workflows/reusable-test.yaml
index 6585f7b..fe16dfe 100644
--- a/.github/workflows/reusable-test.yaml
+++ b/.github/workflows/reusable-test.yaml
@@ -75,6 +75,6 @@ jobs:
           install-args: ${{ inputs.install-args }}
 
       - name: test
-        env:
-          TEST_SCRIPT: ${{ inputs.test-script }}
-        run: pnpm $TEST_SCRIPT
+        uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+        with:
+          args: ${{ inputs.test-script }}
diff --git a/.github/workflows/update-action-refs.yaml b/.github/workflows/update-action-refs.yaml
index b4dbebe..08cf0a3 100644
--- a/.github/workflows/update-action-refs.yaml
+++ b/.github/workflows/update-action-refs.yaml
@@ -4,6 +4,7 @@ on:
   push:
     tags:
       - "actions/setup/v*"
+      - "actions/run-pnpm/v*"
 
 permissions: {}
 
@@ -44,19 +45,22 @@ jobs:
           TAG_REF: ${{ github.ref_name }}
           TAG_SHA: ${{ github.sha }}
         run: |
+          ACTION_PATH="${TAG_REF%/v*}"
           echo "tag=${TAG_REF}" >> "$GITHUB_OUTPUT"
           echo "sha=${TAG_SHA}" >> "$GITHUB_OUTPUT"
+          echo "action_path=${ACTION_PATH}" >> "$GITHUB_OUTPUT"
 
       - name: find and update workflow references
         id: update
         env:
           NEW_SHA: ${{ steps.resolve.outputs.sha }}
           NEW_TAG: ${{ steps.resolve.outputs.tag }}
+          ACTION_PATH: ${{ steps.resolve.outputs.action_path }}
         run: |
-          FILES=$(grep -rl "uses: luxass/shared-workflows/actions/setup@" .github/workflows/ --exclude="update-action-refs.yaml" || true)
+          FILES=$(grep -rl "uses: luxass/shared-workflows/${ACTION_PATH}@" .github/workflows/ actions/ --include="*.yaml" --exclude="update-action-refs.yaml" || true)
 
           if [ -z "$FILES" ]; then
-            echo "No workflow files reference actions/setup"
+            echo "No workflow files reference ${ACTION_PATH}"
             echo "changed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
@@ -64,7 +68,7 @@ jobs:
           echo "changed=true" >> "$GITHUB_OUTPUT"
 
           for file in $FILES; do
-            sed -i "s|uses: luxass/shared-workflows/actions/setup@[a-f0-9]\{40\}.*|uses: luxass/shared-workflows/actions/setup@${NEW_SHA} # ${NEW_TAG}|" "$file"
+            sed -i "s|uses: luxass/shared-workflows/${ACTION_PATH}@[a-f0-9]\{40\}.*|uses: luxass/shared-workflows/${ACTION_PATH}@${NEW_SHA} # ${NEW_TAG}|" "$file"
           done
 
           {
@@ -77,7 +81,7 @@ jobs:
         if: steps.update.outputs.changed == 'true'
         id: diff
         run: |
-          DIFF=$(git diff .github/workflows/)
+          DIFF=$(git diff .github/workflows/ actions/)
           {
             echo "content<<DIFF_EOF"
             echo "$DIFF"
@@ -90,13 +94,14 @@ jobs:
         env:
           TAG: ${{ steps.resolve.outputs.tag }}
           SHA: ${{ steps.resolve.outputs.sha }}
+          ACTION_PATH: ${{ steps.resolve.outputs.action_path }}
           DIFF: ${{ steps.diff.outputs.content }}
         with:
           token: ${{ steps.app-token.outputs.token }}
-          commit-message: "chore(deps): update actions/setup to ${{ steps.resolve.outputs.tag }}"
-          title: "chore(deps): update actions/setup to ${{ steps.resolve.outputs.tag }}"
+          commit-message: "chore(deps): update ${{ steps.resolve.outputs.action_path }} to ${{ steps.resolve.outputs.tag }}"
+          title: "chore(deps): update ${{ steps.resolve.outputs.action_path }} to ${{ steps.resolve.outputs.tag }}"
           body: |
-            Updates `actions/setup` references to SHA-pinned [`${{ env.TAG }}`](https://github.com/${{ github.repository }}/tree/${{ env.TAG }}).
+            Updates `${{ env.ACTION_PATH }}` references to SHA-pinned [`${{ env.TAG }}`](https://github.com/${{ github.repository }}/tree/${{ env.TAG }}).
 
             |         |                  |
             | ------- | ---------------- |
@@ -109,7 +114,9 @@ jobs:
             ${{ env.DIFF }}
             ```
           branch: "chore/update-action-refs"
-          add-paths: .github/workflows/
+          add-paths: |
+            .github/workflows/
+            actions/
           base: main
           committer: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
           author: "github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>"
diff --git a/actions/setup/action.yaml b/actions/setup/action.yaml
index cbd3258..9cb3cdc 100644
--- a/actions/setup/action.yaml
+++ b/actions/setup/action.yaml
@@ -66,7 +66,6 @@ runs:
         scope: ${{ inputs.scope }}
 
     - name: install dependencies
-      shell: bash
-      env:
-        INSTALL_ARGS: ${{ inputs.install-args }}
-      run: pnpm install --frozen-lockfile $INSTALL_ARGS
+      uses: luxass/shared-workflows/actions/run-pnpm@b735646b0a4a26710ba55662e060fc6c45560ed8 # unreleased
+      with:
+        args: install --frozen-lockfile ${{ inputs.install-args }}