diff --git a/.github/workflows/api-compat.yaml b/.github/workflows/api-compat.yaml
index 9f677470..4d3b8ef7 100644
--- a/.github/workflows/api-compat.yaml
+++ b/.github/workflows/api-compat.yaml
@@ -90,9 +90,13 @@ jobs:
 
       - name: Download previous .nupkg + extract
         shell: bash
+        # The resolved version arrives through env rather than template expansion, so a step
+        # output is never spliced into the script body (zizmor template-injection).
+        env:
+          PREV_VERSION: ${{ steps.nuget.outputs.version }}
         run: |
           set -euo pipefail
-          v='${{ steps.nuget.outputs.version }}'
+          v="$PREV_VERSION"
           mkdir -p ./previous
           curl -fsSL "https://api.nuget.org/v3-flatcontainer/wolfgang.trypattern/$v/wolfgang.trypattern.$v.nupkg" \
             -o "./previous/wolfgang.trypattern.$v.nupkg"