diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 0a2a8013c05..14f5fa7060d 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -10,7 +10,7 @@ jobs:
     - name: go-version
       id: go-version
       run: |
-        echo go-version="$(awk '/GO_VERSION:/ { print $2 }' .github/workflows/main.yml | tr -d \')" >> ${GITHUB_OUTPUT}
+        echo go-version="$(awk '/GO_VERSION:/ { print $2 }' .github/workflows/main.yml | tr -d \')" >> "${GITHUB_OUTPUT}"
     - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753
       with:
         go-version: ${{ steps.go-version.outputs.go-version }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index edadd26476b..0f30b108960 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -138,8 +138,8 @@ jobs:
         go run . --version
     - name: install-age
       run: |
-        cd $(mktemp -d)
-        curl -fsSL https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-darwin-amd64.tar.gz | tar xzf -
+        cd "$(mktemp -d)"
+        curl -fsSL "https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-darwin-amd64.tar.gz" | tar xzf -
         sudo install -m 755 age/age /usr/local/bin
         sudo install -m 755 age/age-keygen /usr/local/bin
     - name: test
@@ -168,8 +168,8 @@ jobs:
         go run . --version
     - name: install-age
       run: |
-        cd $(mktemp -d)
-        curl -fsSL https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-linux-amd64.tar.gz | tar xzf -
+        cd "$(mktemp -d)"
+        curl -fsSL "https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-linux-amd64.tar.gz" | tar xzf -
         sudo install -m 755 age/age /usr/local/bin
         sudo install -m 755 age/age-keygen /usr/local/bin
     - name: test
@@ -194,8 +194,8 @@ jobs:
         sudo apt-get --no-install-suggests --no-install-recommends --quiet --yes install musl-tools snapcraft
         # https://github.com/goreleaser/goreleaser/issues/1715
         # https://bugs.launchpad.net/snapcraft/+bug/1889741
-        mkdir -p $HOME/.cache/snapcraft/download
-        mkdir -p $HOME/.cache/snapcraft/stage-packages
+        mkdir -p "${HOME}/.cache/snapcraft/download"
+        mkdir -p "${HOME}/.cache/snapcraft/stage-packages"
     - name: create-syso
       run: |
         make create-syso
@@ -248,8 +248,8 @@ jobs:
     - name: install-age
       if: github.event_name == 'push' || needs.changes.outputs.code == 'true'
       run: |
-        cd $(mktemp -d)
-        curl -fsSL https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-linux-amd64.tar.gz | tar xzf -
+        cd "$(mktemp -d)"
+        curl -fsSL "https://github.com/FiloSottile/age/releases/download/v${AGE_VERSION}/age-v${AGE_VERSION}-linux-amd64.tar.gz" | tar xzf -
         sudo install -m 755 age/age /usr/local/bin
         sudo install -m 755 age/age-keygen /usr/local/bin
     - name: build
@@ -349,7 +349,7 @@ jobs:
         go run ./internal/cmds/lint-whitespace
     - name: lint-txtar
       run: |
-        find . -name \*.txtar | xargs go run ./internal/cmds/lint-txtar
+        find . -name '*.txtar' -print0 | xargs -0 go run ./internal/cmds/lint-txtar
     - name: findtypos
       run: |
         go install github.com/twpayne/findtypos@v0.0.1
@@ -391,8 +391,8 @@ jobs:
         sudo apt-get --no-install-suggests --no-install-recommends --quiet --yes install musl-tools snapcraft
         # https://github.com/goreleaser/goreleaser/issues/1715
         # https://bugs.launchpad.net/snapcraft/+bug/1889741
-        mkdir -p $HOME/.cache/snapcraft/download
-        mkdir -p $HOME/.cache/snapcraft/stage-packages
+        mkdir -p "${HOME}/.cache/snapcraft/download"
+        mkdir -p "${HOME}/.cache/snapcraft/stage-packages"
     - name: check-snapcraft-credentials
       run: snapcraft whoami
       env: