diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 498694a..5056e9a 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -35,12 +35,6 @@ on:
 # tightens rules in a way that flags previously-passing workflows.
 env:
   ACTIONLINT_VERSION: "1.7.7"
-  # Scope shellcheck to warning+ severity. The gate's job is to catch
-  # input-contract regressions and real shell bugs (SC2086 quoting,
-  # SC2046 word-splitting, etc.); info/style nitpicks (SC2295, SC2001,
-  # SC2129) in long-standing `run:` blocks aren't worth blocking PRs
-  # over. Drop this once the existing scripts are tidied up.
-  SHELLCHECK_OPTS: "-S warning"
 
 jobs:
   actionlint:
diff --git a/.github/workflows/chart-release.yml b/.github/workflows/chart-release.yml
index f8a1a71..58b220f 100644
--- a/.github/workflows/chart-release.yml
+++ b/.github/workflows/chart-release.yml
@@ -73,7 +73,7 @@ jobs:
             if [ -z "$latest" ]; then
               candidate="0.0.1"
             else
-              version="${latest#${prefix}}"
+              version="${latest#"${prefix}"}"
               IFS='.' read -r major minor patch <<< "$version"
               candidate="${major}.${minor}.$((patch + 1))"
             fi
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 3a75a10..5cdac18 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -134,7 +134,7 @@ jobs:
           if [ -z "$latest_tag" ]; then
             major=0; minor=0; patch=0
           else
-            version="${latest_tag#${prefix}}"
+            version="${latest_tag#"${prefix}"}"
             IFS='.' read -r major minor patch <<< "$version"
           fi
           patch=$((patch + 1))
diff --git a/.github/workflows/tag-config.yml b/.github/workflows/tag-config.yml
index ed0d61c..0baaf40 100644
--- a/.github/workflows/tag-config.yml
+++ b/.github/workflows/tag-config.yml
@@ -78,10 +78,14 @@ jobs:
           fi
 
           echo "Services to tag:"
-          echo "$services" | sed 's/^/  - /'
-          echo "list<<EOF" >> "$GITHUB_OUTPUT"
-          echo "$services" >> "$GITHUB_OUTPUT"
-          echo "EOF" >> "$GITHUB_OUTPUT"
+          while IFS= read -r svc; do
+            echo "  - $svc"
+          done <<< "$services"
+          {
+            echo "list<<EOF"
+            echo "$services"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Compute and push tags
         if: steps.changed.outputs.list != ''
@@ -100,7 +104,7 @@ jobs:
               next="v0.0.1+${svc}"
             else
               version="${latest#v}"
-              version="${version%+${svc}}"
+              version="${version%+"${svc}"}"
               IFS='.' read -r major minor patch <<< "$version"
               next="v${major}.${minor}.$((patch + 1))+${svc}"
             fi