diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 8c01b0592c2e..dc827d62ba71 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -72,7 +72,9 @@ jobs:
 
       - name: Start the CI
         run: |
+          read -r -a numbers <<< "$PULL_REQUESTS"
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
-          | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
+          | sh -s -- "${numbers[@]}"
         env:
           GH_TOKEN: ${{ github.token }}
+          PULL_REQUESTS: ${{ needs.get-prs-for-ci.outputs.numbers }}
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 924feb42725e..7f10917e238a 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -47,7 +47,9 @@ jobs:
     steps:
       - name: Mark token input as sensitive
         if: inputs.token != ''
-        run: echo "::add-mask::${{ inputs.token }}"
+        run: printf '::add-mask::%s\n' "$COMMENT_TOKEN"
+        env:
+          COMMENT_TOKEN: ${{ inputs.token }}
       - name: Add link to the current run
         id: comment
         run: |
@@ -155,7 +157,7 @@ jobs:
         run: |
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
-            --pure --keep FILTER --keep LC_ALL --keep LANG \
+            --pure --keep CATEGORIES --keep FILTER --keep RUNS --keep LC_ALL --keep LANG \
             --arg loadJSBuiltinsDynamically false \
             --arg ccache 'null' \
             --arg icu 'null' \
@@ -163,11 +165,12 @@ jobs:
             --arg devTools '[]' \
             --run '
                 set -o pipefail
+                read -r -a categories <<< "$CATEGORIES"
                 ./base_node benchmark/compare.js \
                   --filter "$FILTER" \
-                  --runs ${{ inputs.runs }} \
+                  --runs "$RUNS" \
                   --old ./base_node --new ./node \
-                  -- ${{ inputs.category }} \
+                  -- "${categories[@]}" \
                 | tee /dev/stderr \
                 > ${{ matrix.system }}.csv
                 echo "> [!WARNING] "
@@ -185,7 +188,9 @@ jobs:
                 echo "> using a dedicated machine, e.g. Jenkins CI."
             ' | tee /dev/stderr >> "$GITHUB_STEP_SUMMARY"
         env:
+          CATEGORIES: ${{ inputs.category }}
           FILTER: ${{ inputs.filter }}
+          RUNS: ${{ inputs.runs }}
 
       - name: Upload raw benchmark results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -246,7 +251,9 @@ jobs:
             ' | tee /dev/stderr ${{ inputs.post-comment && 'body.txt' || '' }} >> "$GITHUB_STEP_SUMMARY"
       - name: Mark token input as sensitive
         if: inputs.token != ''
-        run: echo "::add-mask::${{ inputs.token }}"
+        run: printf '::add-mask::%s\n' "$COMMENT_TOKEN"
+        env:
+          COMMENT_TOKEN: ${{ inputs.token }}
       - name: Edit comment
         if: inputs.post-comment
         run: |
diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
index e173d4a544e0..045bd3ae93c2 100644
--- a/.github/workflows/build-tarball.yml
+++ b/.github/workflows/build-tarball.yml
@@ -104,13 +104,8 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          persist-credentials: false
-          sparse-checkout: .github/actions/install-clang
-          sparse-checkout-cone-mode: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
-        uses: ./.github/actions/install-clang
+        uses: $/.github/actions/install-clang
         with:
           clang-version: ${{ env.CLANG_VERSION }}
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0b83c888ecdc..10a9e299145b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,6 +25,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 600dadc17bc4..83f921838b30 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -188,6 +188,7 @@ jobs:
           # to be set here because `checkout` configures GitHub authentication
           # for push as well.
           token: ${{ secrets.GH_USER_TOKEN }}
+          persist-credentials: true
 
       - name: Start the Commit Queue
         if: steps.get_mergeable_prs.outputs.numbers != ''
@@ -195,6 +196,8 @@ jobs:
           git config --local user.email "github-bot@iojs.org"
           git config --local user.name "Node.js GitHub Bot"
           ncu-config set token "$GH_TOKEN"
-          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
+          read -r -a numbers <<< "$PULL_REQUESTS"
+          ./tools/actions/commit-queue.sh "${numbers[@]}"
         env:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.numbers }}
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
index 7a73d69b70ec..a98492ec668e 100644
--- a/.github/workflows/coverage-linux-without-intl.yml
+++ b/.github/workflows/coverage-linux-without-intl.yml
@@ -54,7 +54,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
-        uses: ./.github/actions/install-clang
+        uses: $/.github/actions/install-clang
         with:
           clang-version: ${{ env.CLANG_VERSION }}
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
index 79c6eaaebc91..4ba373b790a2 100644
--- a/.github/workflows/coverage-linux.yml
+++ b/.github/workflows/coverage-linux.yml
@@ -54,7 +54,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
-        uses: ./.github/actions/install-clang
+        uses: $/.github/actions/install-clang
         with:
           clang-version: ${{ env.CLANG_VERSION }}
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
index 043de271faa9..d15f21010cd9 100644
--- a/.github/workflows/daily-wpt-fyi.yml
+++ b/.github/workflows/daily-wpt-fyi.yml
@@ -105,33 +105,15 @@ jobs:
           else
             echo "UNDICI_WPT=legacy" >> $GITHUB_ENV
           fi
-      # Checkout composite actions from the default branch since the
-      # version-specific checkout above overwrites .github/actions/
-      - name: Checkout undici WPT actions
-        if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-        with:
-          sparse-checkout: |
-            .github/actions/undici-wpt-current
-            .github/actions/undici-wpt-legacy
-          sparse-checkout-cone-mode: false
-          persist-credentials: false
-          path: _wpt_actions
-          clean: false
-      - name: Place undici WPT actions
-        if: ${{ env.WPT_REPORT != '' }}
-        run: |
-          mkdir -p .github/actions
-          cp -r _wpt_actions/.github/actions/undici-wpt-* .github/actions/
       - name: Run undici WPT (current)
         if: ${{ env.UNDICI_WPT == 'current' }}
-        uses: ./.github/actions/undici-wpt-current
+        uses: $/.github/actions/undici-wpt-current
         with:
           undici-version: ${{ env.UNDICI_VERSION }}
           wpt-report: ${{ env.WPT_REPORT }}
       - name: Run undici WPT (legacy)
         if: ${{ env.UNDICI_WPT == 'legacy' }}
-        uses: ./.github/actions/undici-wpt-legacy
+        uses: $/.github/actions/undici-wpt-legacy
         with:
           undici-version: ${{ env.UNDICI_VERSION }}
           wpt-report: ${{ env.WPT_REPORT }}
@@ -140,7 +122,9 @@ jobs:
       - name: Clone report for upload
         if: ${{ env.WPT_REPORT != '' }}
         working-directory: out/wpt
-        run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json
+        run: cp wptreport.json "wptreport-$NODE_VERSION.json"
+        env:
+          NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
       - name: Upload GitHub Actions artifact
         if: ${{ env.WPT_REPORT != '' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -151,12 +135,13 @@ jobs:
       - name: Upload WPT Report to wpt.fyi API
         if: ${{ env.WPT_REPORT != '' }}
         env:
+          NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
           WPT_FYI_USERNAME: ${{ vars.WPT_FYI_USERNAME }}
           WPT_FYI_PASSWORD: ${{ secrets.WPT_FYI_PASSWORD }}
         working-directory: out/wpt
         run: |
           gzip wptreport.json
-          echo "## Node.js ${{ steps.setup-node.outputs.node-version }}" >> $GITHUB_STEP_SUMMARY
+          echo "## Node.js $NODE_VERSION" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "WPT Revision: [\`${WPT_REVISION:0:7}\`](https://github.com/web-platform-tests/wpt/commits/$WPT_REVISION)" >> $GITHUB_STEP_SUMMARY
           for WPT_FYI_ENDPOINT in "https://wpt.fyi/api/results/upload" "https://staging.wpt.fyi/api/results/upload"
diff --git a/.github/workflows/notify-on-push.yml b/.github/workflows/notify-on-push.yml
index 16bd91bccd2a..25421b8447d8 100644
--- a/.github/workflows/notify-on-push.yml
+++ b/.github/workflows/notify-on-push.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           SLACK_COLOR: '#DE512A'
           SLACK_ICON: https://github.com/nodejs.png?size=48
@@ -50,7 +50,7 @@ jobs:
           COMMITS: ${{ toJSON(github.event.commits) }}
       - name: Slack Notification
         if: ${{ failure() && steps.commit-check.conclusion == 'failure' && github.repository == 'nodejs/node' }}
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           SLACK_COLOR: '#DE512A'
           SLACK_ICON: https://github.com/nodejs.png?size=48
diff --git a/.github/workflows/notify-on-review-wanted.yml b/.github/workflows/notify-on-review-wanted.yml
index 2f1f3af8139b..effc6c209eb1 100644
--- a/.github/workflows/notify-on-review-wanted.yml
+++ b/.github/workflows/notify-on-review-wanted.yml
@@ -34,7 +34,7 @@ jobs:
           fi
 
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # 2.4.0
+        uses: rtCamp/action-slack-notify@33ca3be66c6f378fe1610fd1d5258632dbed5e58  # v2.4.0
         env:
           MSG_MINIMAL: actions url
           SLACK_COLOR: '#3d85c6'
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index a33cf81eaed4..0f17615671cd 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -60,7 +60,7 @@ jobs:
           path: node
       - name: Install Clang ${{ env.CLANG_VERSION }}
         if: runner.os == 'Linux'
-        uses: ./node/.github/actions/install-clang
+        uses: $/.github/actions/install-clang
         with:
           clang-version: ${{ env.CLANG_VERSION }}
       - name: Set up Xcode ${{ env.XCODE_VERSION }}
diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
index 497d5156fec9..672893a999aa 100644
--- a/.github/workflows/test-internet.yml
+++ b/.github/workflows/test-internet.yml
@@ -59,7 +59,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
-        uses: ./.github/actions/install-clang
+        uses: $/.github/actions/install-clang
         with:
           clang-version: ${{ env.CLANG_VERSION }}
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/test-linux-perfetto.yml b/.github/workflows/test-linux-perfetto.yml
index 3dc533720d43..e300ee59aa86 100644
--- a/.github/workflows/test-linux-perfetto.yml
+++ b/.github/workflows/test-linux-perfetto.yml
@@ -42,7 +42,7 @@ jobs:
           persist-credentials: false
           path: node
       - name: Install Clang ${{ env.CLANG_VERSION }}
-        uses: ./node/.github/actions/install-clang
+        uses: $/.github/actions/install-clang
         with:
           clang-version: ${{ env.CLANG_VERSION }}
       - name: Install Rust ${{ env.RUSTC_VERSION }}
diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml
index 7c77d4668dc6..eca8521a310e 100644
--- a/.github/workflows/test-linux-quic.yml
+++ b/.github/workflows/test-linux-quic.yml
@@ -52,7 +52,7 @@ jobs:
           persist-credentials: false
           path: node
       - name: Install Clang ${{ env.CLANG_VERSION }}
-        uses: ./node/.github/actions/install-clang
+        uses: $/.github/actions/install-clang
         with:
           clang-version: ${{ env.CLANG_VERSION }}
       - name: Install Rust ${{ env.RUSTC_VERSION }}
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
index acd1e04a04ab..65aead07b923 100644
--- a/.github/workflows/test-linux.yml
+++ b/.github/workflows/test-linux.yml
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
           path: node
       - name: Install Clang ${{ env.CLANG_VERSION }}
-        uses: ./node/.github/actions/install-clang
+        uses: $/.github/actions/install-clang
         with:
           clang-version: ${{ env.CLANG_VERSION }}
       - name: Install Rust ${{ env.RUSTC_VERSION }}
diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index f7483103016f..be3c22face09 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -159,7 +159,7 @@ jobs:
           - runner: macos-latest
             system: aarch64-darwin
     name: '${{ matrix.system }}: with shared libraries${{ matrix.perfetto && '' and perfetto'' || '''' }}'
-    uses: ./.github/workflows/build-shared.yml
+    uses: $/.github/workflows/build-shared.yml
     with:
       runner: ${{ matrix.runner }}
       with-sccache: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
@@ -250,7 +250,7 @@ jobs:
       matrix:
         openssl: ${{ fromJSON(needs.build-aarch64-linux-v8.outputs.matrix) }}
     name: 'aarch64-linux: with shared ${{ matrix.openssl.name }}'
-    uses: ./.github/workflows/build-shared.yml
+    uses: $/.github/workflows/build-shared.yml
     with:
       runner: ubuntu-24.04-arm
       v8-nar: ${{ needs.build-aarch64-linux-v8.outputs.local-cache && 'libv8-aarch64-linux.nar' }}
diff --git a/.github/workflows/timezone-update.yml b/.github/workflows/timezone-update.yml
index 481c20da4e05..abe4516db4a7 100644
--- a/.github/workflows/timezone-update.yml
+++ b/.github/workflows/timezone-update.yml
@@ -40,14 +40,14 @@ jobs:
 
       - name: Compare versions
         run: |
-          echo "Comparing current version ${{ env.current_version }} to new version ${{ env.new_version }}"
+          echo "Comparing current version $current_version to new version $new_version"
 
       - run: ./tools/dep_updaters/update-timezone.mjs
         if: ${{ env.new_version != env.current_version }}
 
       - name: Update the expected timezone version in test
         if: ${{ env.new_version != env.current_version }}
-        run: echo "${{ env.new_version }}" > test/fixtures/tz-version.txt
+        run: printf '%s\n' "$new_version" > test/fixtures/tz-version.txt
 
       - name: Open Pull Request
         if: ${{ env.new_version != env.current_version }}
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index e204c6b43140..b70bc4c34f70 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -329,7 +329,7 @@ jobs:
       - name: Generate commit message if not set
         if: env.COMMIT_MSG == '' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
         run: |
-          echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to ${{ env.NEW_VERSION }}" >> "$GITHUB_ENV"
+          echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to $NEW_VERSION" >> "$GITHUB_ENV"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         # Creates a PR or update the Action's existing PR, or