diff --git a/.github/workflows/deploy-workers.yml b/.github/workflows/deploy-workers.yml
index aabad3ea..59423c91 100644
--- a/.github/workflows/deploy-workers.yml
+++ b/.github/workflows/deploy-workers.yml
@@ -50,7 +50,11 @@ jobs:
         working-directory: ${{ matrix.worker.directory }}
         run: |
           if [ -n "$BUILD_ENV" ]; then
-            export ${BUILD_ENV}
+            while IFS='=' read -r name value; do
+              if [ -n "$name" ]; then
+                export "$name=$value"
+              fi
+            done <<< "$BUILD_ENV"
           fi
           pnpm build
         env:
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b5e056d6..5621b22c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -43,7 +43,7 @@ jobs:
 
       - name: Create or update release pull request
         id: changesets
-        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # 06245a4e0a36c064a573d4150030f5ec548e4fcc
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
           commitMode: github-api
           title: 'chore: version packages'
@@ -65,7 +65,7 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # 11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
@@ -75,7 +75,7 @@ jobs:
           skip-cache: 'true' # avoid cache poisoning attacks
 
       - name: Publish to npm
-        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # 06245a4e0a36c064a573d4150030f5ec548e4fcc
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1.8.0
         with:
           publish: pnpm changeset:publish
         env:
diff --git a/.github/workflows/scan-github-actions.yml b/.github/workflows/scan-github-actions.yml
new file mode 100644
index 00000000..733031a5
--- /dev/null
+++ b/.github/workflows/scan-github-actions.yml
@@ -0,0 +1,24 @@
+name: Scan GitHub Actions
+
+on:
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+  schedule:
+    - cron: "17 9 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  scan:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'tempoxyz/accounts' }}
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@512158c4e90e42eef8aa7fc3fc3186a79b5b4648 # main
+    permissions:
+      actions: read
+      contents: read
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 21d4bf80..fb0f842a 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -89,7 +89,7 @@ jobs:
 
       - name: Run tests
         run: |
-          if [[ "${{ matrix.tag }}" == sha-* ]]; then
+          if [[ "$VITE_NODE_TAG" == sha-* ]]; then
             pnpm test src/server/internal/handlers/multisig.localnet.test.ts --bail=1
           else
             pnpm test --bail=1