diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index dea420e7..b464af41 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   detect-changes:
-    uses: ppat/github-workflows/.github/workflows/detect-changed-files.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/detect-changed-files.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       # yamllint disable-line rule:indentation
       files_yaml: |
@@ -71,11 +71,11 @@ jobs:
           TF_DIRS="[]"
           echo "No Terraform changes detected"
         fi
-        echo "dirs=$TF_DIRS" >> $GITHUB_OUTPUT
+        echo "dirs=$TF_DIRS" >> "$GITHUB_OUTPUT"
 
   commit-messages:
     if: ${{ github.event_name == 'pull_request' }}
-    uses: ppat/github-workflows/.github/workflows/lint-commit-messages.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-commit-messages.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref }}
       fetch_depth: ${{ github.event.pull_request.commits || 0 }}
@@ -85,7 +85,7 @@ jobs:
   github-actions:
     needs: [detect-changes]
     if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).actions_any_changed == 'true' }}
-    uses: ppat/github-workflows/.github/workflows/lint-github-actions.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-github-actions.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
       files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).actions_all_changed_files }}
@@ -93,7 +93,7 @@ jobs:
   markdown:
     needs: [detect-changes]
     if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).markdown_any_changed == 'true' }}
-    uses: ppat/github-workflows/.github/workflows/lint-markdown.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-markdown.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
       files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).markdown_all_changed_files }}
@@ -101,21 +101,21 @@ jobs:
   docker-files:
     needs: [detect-changes]
     if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).docker_any_changed == 'true' }}
-    uses: ppat/github-workflows/.github/workflows/lint-hadolint.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-hadolint.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
       files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).docker_all_changed_files }}
       hadolint_config: .hadolint.yaml
 
   pre-commit:
-    uses: ppat/github-workflows/.github/workflows/lint-pre-commit.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-pre-commit.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
 
   renovate-config-check:
     needs: [detect-changes]
     if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).renovate_any_changed == 'true' }}
-    uses: ppat/github-workflows/.github/workflows/lint-renovate-config-check.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-renovate-config-check.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
       files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).renovate_all_changed_files }}
@@ -123,7 +123,7 @@ jobs:
   shellcheck:
     needs: [detect-changes]
     if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).shellscripts_any_changed == 'true' }}
-    uses: ppat/github-workflows/.github/workflows/lint-shellcheck.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-shellcheck.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
       files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).shellscripts_all_changed_files }}
@@ -131,7 +131,7 @@ jobs:
   terraform:
     needs: [terraform-dirs]
     if: ${{ github.event_name != 'pull_request' || needs.terraform-dirs.outputs.terraform_dirs != '[]' }}
-    uses: ppat/github-workflows/.github/workflows/lint-terraform.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-terraform.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
       tf_dirs: ${{ needs.terraform-dirs.outputs.terraform_dirs }}
@@ -139,7 +139,7 @@ jobs:
   yaml:
     needs: [detect-changes]
     if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).yaml_any_changed == 'true' }}
-    uses: ppat/github-workflows/.github/workflows/lint-yaml.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-yaml.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
       files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).yaml_all_changed_files }}
@@ -147,6 +147,6 @@ jobs:
   zizmor:
     needs: [detect-changes]
     if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).actions_any_changed == 'true' }}
-    uses: ppat/github-workflows/.github/workflows/lint-zizmor.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/lint-zizmor.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       git_ref: ${{ github.head_ref || github.ref }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 9b4e1aab..19ed3a67 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -29,7 +29,7 @@ env:
 
 jobs:
   create-release:
-    uses: ppat/github-workflows/.github/workflows/release-semantic.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/release-semantic.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       dry_run: ${{ (github.event_name == 'pull_request') || (github.event_name == 'workflow_dispatch' && github.event.inputs.test_publish == 'true') }}
       release_branch: ${{ github.head_ref || github.ref_name }}
@@ -39,7 +39,7 @@ jobs:
 
   publish-image:
     needs: [create-release]
-    uses: ppat/github-workflows/.github/workflows/build-docker-image.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/build-docker-image.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       image_context_path: images/homelab-workspace
       label_title: "Homelab Workspace"
@@ -85,7 +85,7 @@ jobs:
       shell: bash
       # yamllint disable-line rule:indentation
       run: |
-        while ! curl -fsSL ${CODER_URL} > /dev/null; do
+        while ! curl -fsSL "${CODER_URL}" > /dev/null; do
           echo "Waiting for coder service to be ready... sleep 5s!"
           sleep 5
         done
@@ -93,7 +93,8 @@ jobs:
         echo
 
         echo "Generating authentication token..."
-        export CODER_SESSION_TOKEN=$(curl -X POST ${CODER_URL}/api/v2/users/login \
+        export CODER_SESSION_TOKEN
+        CODER_SESSION_TOKEN=$(curl -X POST "${CODER_URL}/api/v2/users/login" \
           -H 'Content-Type: application/json' \
           -H 'Accept: application/json' \
           --data '{"email": "'${{ secrets.CODER_EMAIL }}'", "password": "'${{ secrets.CODER_PASSWORD }}'"}' \
@@ -106,12 +107,13 @@ jobs:
         echo "Authentication token generated."
         echo
         echo "Determining coder version..."
-        export CODER_VERSION=$(curl -fsSL ${CODER_URL}/api/v2/buildinfo | jq -r .version | cut -d'+' -f1 | cut -d'v' -f2)
+        export CODER_VERSION
+        CODER_VERSION=$(curl -fsSL "${CODER_URL}/api/v2/buildinfo" | jq -r .version | cut -d'+' -f1 | cut -d'v' -f2)
         echo "Installing coder CLI..."
         curl -fsSL https://coder.com/install.sh | sh -s -- --method standalone --version "${CODER_VERSION}"
         echo
         echo "Logging into Coder..."
-        coder login --use-token-as-session ${CODER_URL}
+        coder login --use-token-as-session "${CODER_URL}"
 
     - name: Publish template
       id: publish-template
@@ -122,30 +124,33 @@ jobs:
       shell: bash
       # yamllint disable-line rule:indentation
       run: |
-        if echo $TEMPLATE_VERSION | grep -E '[0-9]+\.[0-9]+\.[0-9]+'; then
-          export TEMPLATE_NAME="$(echo ${TEMPLATE_DIR} | cut -d/ -f3)"
+        if echo "$TEMPLATE_VERSION" | grep -E '[0-9]+\.[0-9]+\.[0-9]+'; then
+          export TEMPLATE_NAME
+          TEMPLATE_NAME="$(echo "${TEMPLATE_DIR}" | cut -d/ -f3)"
           export RELEASE_MSG="[Release Notes](https://github.com/${{ github.repository }}/releases/tag/${TEMPLATE_VERSION})"
           export TEST_MODE=false
         else
-          export TEMPLATE_NAME="$(echo ${TEMPLATE_DIR} | cut -d/ -f3)-test"
+          export TEMPLATE_NAME
+          TEMPLATE_NAME="$(echo "${TEMPLATE_DIR}" | cut -d/ -f3)-test"
           export RELEASE_MSG="[Changes](https://github.com/${{ github.repository }}/commit/${TEMPLATE_VERSION})"
           export TEST_MODE=true
         fi
         echo "Publishing template ${TEMPLATE_DIR} as ${TEMPLATE_NAME}..."
         set -x
         coder template push \
-          --directory ${TEMPLATE_DIR} \
-          --var workspace_image=${WORKSPACE_IMAGE} \
+          --directory "${TEMPLATE_DIR}" \
+          --var "workspace_image=${WORKSPACE_IMAGE}" \
           --var test_mode=${TEST_MODE} \
-          --name ${TEMPLATE_VERSION} \
+          --name "${TEMPLATE_VERSION}" \
           --message "${RELEASE_MSG}" \
           --yes \
-          ${TEMPLATE_NAME}
+          "${TEMPLATE_NAME}"
         set +x
         echo
         echo "Confirming template has been published..."
         coder templates list --output json > /tmp/templates.json
-        export SELECTED_TEMPLATE=$(cat /tmp/templates.json | jq -r '.[] | select(.Template.name == "'${TEMPLATE_NAME}'")')
+        export SELECTED_TEMPLATE
+        SELECTED_TEMPLATE=$(cat /tmp/templates.json | jq -r '.[] | select(.Template.name == "'"${TEMPLATE_NAME}"'")')
         if [[ -z $SELECTED_TEMPLATE ]]; then
           echo "Could not find any template published as $TEMPLATE_NAME."
           exit 1
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 203d5d55..27a10114 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -16,7 +16,7 @@ concurrency:
 
 jobs:
   renovate:
-    uses: ppat/github-workflows/.github/workflows/renovate.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0
+    uses: ppat/github-workflows/.github/workflows/renovate.yaml@667d20d10c8756b11feeab1ee691825ccea8f991 # v5.0.1
     with:
       dry_run: ${{ github.event_name == 'pull_request' }}
       git_ref: ${{ github.head_ref || github.ref }}