diff --git a/.github/workflows/build-balena-disk-image.yaml b/.github/workflows/build-balena-disk-image.yaml
index dde9498d4..a35e49ef4 100644
--- a/.github/workflows/build-balena-disk-image.yaml
+++ b/.github/workflows/build-balena-disk-image.yaml
@@ -37,15 +37,15 @@ jobs:
       - name: Get base board
         run: |
           if [ "${{ matrix.board }}" == 'pi1' ]; then
-            echo "BALENA_IMAGE=raspberry-pi" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberry-pi" >> "$GITHUB_ENV"
           elif [ "${{ matrix.board }}" == 'pi2' ]; then
-            echo "BALENA_IMAGE=raspberry-pi2" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberry-pi2" >> "$GITHUB_ENV"
           elif [ "${{ matrix.board }}" == 'pi3' ]; then
-            echo "BALENA_IMAGE=raspberrypi3" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberrypi3" >> "$GITHUB_ENV"
           elif [ "${{ matrix.board }}" == 'pi4' ]; then
-            echo "BALENA_IMAGE=raspberrypi4-64" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberrypi4-64" >> "$GITHUB_ENV"
           elif [ "${{ matrix.board }}" == 'pi5' ]; then
-            echo "BALENA_IMAGE=raspberrypi5" >> $GITHUB_ENV
+            echo "BALENA_IMAGE=raspberrypi5" >> "$GITHUB_ENV"
           fi
 
       - name: balena CLI Action - download
diff --git a/.github/workflows/build-webview.yaml b/.github/workflows/build-webview.yaml
index b18fd034e..29bd864f7 100644
--- a/.github/workflows/build-webview.yaml
+++ b/.github/workflows/build-webview.yaml
@@ -33,13 +33,14 @@ jobs:
       - name: Set buildx arguments
         id: prepare
         run: |
-          echo ::set-output name=buildx_args::\
-            --cache-from "screenly/ose-qt-builder:latest" \
-            --output "type=image,push=true" \
-            --build-arg "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
-            --build-arg "GIT_HASH=$GITHUB_SHA" \
-            --build-arg "GIT_SHORT_HASH=$(git rev-parse --short HEAD)" \
-            --build-arg "GIT_BRANCH=$GITHUB_REF_NAME"
+          {
+            echo "buildx_args=--cache-from \"screenly/ose-qt-builder:latest\" \
+            --output \"type=image,push=true\" \
+            --build-arg \"BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')\" \
+            --build-arg \"GIT_HASH=$GITHUB_SHA\" \
+            --build-arg \"GIT_SHORT_HASH=$(git rev-parse --short HEAD)\" \
+            --build-arg \"GIT_BRANCH=$GITHUB_REF_NAME\""
+          } >> "$GITHUB_OUTPUT"
 
       - name: Building container
         run: |
diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index 01a4bea5b..38737ae4a 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -109,27 +109,26 @@ jobs:
 
       - name: Set Docker tag
         run: |
-          echo "GIT_SHORT_HASH=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
+          echo "GIT_SHORT_HASH=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
 
           if [ "${{ matrix.board }}" == "pi4" ]; then
-            echo "BOARD=${{ matrix.board }}-64" >> $GITHUB_ENV
+            echo "BOARD=${{ matrix.board }}-64" >> "$GITHUB_ENV"
           else
-            echo "BOARD=${{ matrix.board }}" >> $GITHUB_ENV
+            echo "BOARD=${{ matrix.board }}" >> "$GITHUB_ENV"
           fi
 
-          echo "SHM_SIZE=256mb" >> $GITHUB_ENV
+          echo "SHM_SIZE=256mb" >> "$GITHUB_ENV"
 
       - name: Prepare Balena file
         run: |
-          # Generage a docker-compose file for Balena with the correct board
+          # Generate a docker-compose file for Balena with the correct board
           mkdir -p balena-deploy
 
           # Copy in the Balena yaml file
           cp balena.yml balena-deploy/
 
           # Generate the docker-compose file
-          cat docker-compose.balena.yml.tmpl | \
-            envsubst > balena-deploy/docker-compose.yml
+          envsubst < docker-compose.balena.yml.tmpl > balena-deploy/docker-compose.yml
 
           # Remove bind mounts to `/dev/vchiq` for Raspberry Pi 5
           if [ "${{ matrix.board }}" == "pi5" ]; then
diff --git a/.github/workflows/generate-openapi-schema.yml b/.github/workflows/generate-openapi-schema.yml
index cec8a3854..640c3ceac 100644
--- a/.github/workflows/generate-openapi-schema.yml
+++ b/.github/workflows/generate-openapi-schema.yml
@@ -39,7 +39,6 @@ on:
         description: 'Upload the OpenAPI schema as a release artifact'
         required: true
         type: boolean
-        default: false
       tag:
         description: 'Tag to be used for the release'
         required: true
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
new file mode 100644
index 000000000..5fbeecde3
--- /dev/null
+++ b/.github/workflows/lint-workflows.yml
@@ -0,0 +1,33 @@
+name: Lint GitHub Workflows
+
+on:
+  pull_request:
+    branches:
+      - master
+    paths:
+      - '**/*.yml'
+      - '**/*.yaml'
+      - '.github/workflows/lint-workflows.yml'
+  push:
+    branches:
+      - master
+    paths:
+      - '**/*.yml'
+      - '**/*.yaml'
+      - '.github/workflows/lint-workflows.yml'
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install actionlint
+        run: |
+          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        shell: bash
+
+      - name: Run actionlint
+        run: ./actionlint -color
+        shell: bash
\ No newline at end of file