diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 76090a4dbe3a..c954737a424e 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,3 +1,8 @@
 self-hosted-runner:
   labels:
     - pulumi-ubuntu-8core
+
+paths:
+  ".github/workflows/build-test.yml":
+    ignore:
+      - 'property "esc-secrets" is not defined in object type {}'
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index feccb222a877..baaee4d7b689 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -17,6 +17,6 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Lint actions
-        uses: reviewdog/action-actionlint@v1.57.0
+        uses: reviewdog/action-actionlint@v1.67.0
         with:
           actionlint_flags: "-config-file .actionlint.yml"
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index 7252f2c6fb1b..0fd35088d066 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -240,6 +240,8 @@ jobs:
         env:
           # specifying this id will cause the OIDC test(s) to run against this AD application
           OIDC_ARM_CLIENT_ID: ${{ inputs.oidc_arm_client_id }}
+          ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
+          ARM_CLIENT_CERTIFICATE_PASSWORD_FOR_TEST: ${{ steps.esc-secrets.outputs.ARM_CLIENT_CERTIFICATE_PASSWORD }}
         run: |
           set -euo pipefail
           cd examples && go test -cover -timeout 2h -tags=${{ matrix.language }} -skip TestPulumiExamples -parallel 16 . 2>&1 | tee /tmp/gotest.log
@@ -296,6 +298,8 @@ jobs:
         env:
           # specifying this id will cause the OIDC test(s) to run against this AD application
           OIDC_ARM_CLIENT_ID: ${{ inputs.oidc_arm_client_id }}
+          ARM_CLIENT_SECRET: ${{ steps.esc-secrets.outputs.ARM_CLIENT_SECRET }}
+          ARM_CLIENT_CERTIFICATE_PASSWORD_FOR_TEST: ${{ steps.esc-secrets.outputs.ARM_CLIENT_CERTIFICATE_PASSWORD }}
         run: |
           set -euo pipefail
           cd examples && \