diff --git a/.github/workflows/gitlint.yaml b/.github/workflows/gitlint.yaml
index 6fd0ec4ab..178f15aa4 100644
--- a/.github/workflows/gitlint.yaml
+++ b/.github/workflows/gitlint.yaml
@@ -22,4 +22,4 @@ jobs:
         pip install --upgrade gitlint
     - name: Lint git commit messages
       run: |
-        gitlint --commits origin/$GITHUB_BASE_REF..
+        gitlint --commits "origin/$GITHUB_BASE_REF.."
diff --git a/.github/workflows/integration-arm64.yaml b/.github/workflows/integration-arm64.yaml
index d0d696648..fc545c249 100644
--- a/.github/workflows/integration-arm64.yaml
+++ b/.github/workflows/integration-arm64.yaml
@@ -52,7 +52,7 @@ jobs:
           popd
           mkdir -p "$HOME/workloads"
           az storage blob download --container-name private-images --file "$IMG_GZ_PATH" --name "$IMG_GZ_BLOB_NAME" --connection-string "${{ secrets.CH_PRIVATE_IMAGES }}"
-          gzip -d $IMG_GZ_PATH
+          gzip -d "$IMG_GZ_PATH"
       - name: Run Windows guest integration tests
         if: ${{ github.event_name != 'pull_request' }}
         timeout-minutes: 30
diff --git a/.github/workflows/integration-vfio.yaml b/.github/workflows/integration-vfio.yaml
index 19d5cadba..b4f2ca2f9 100644
--- a/.github/workflows/integration-vfio.yaml
+++ b/.github/workflows/integration-vfio.yaml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Fix workspace permissions
         if: ${{ github.event_name != 'pull_request' }}
-        run: sudo chown -R github-runner:github-runner ${GITHUB_WORKSPACE}
+        run: sudo chown -R github-runner:github-runner "${GITHUB_WORKSPACE}"
       - name: Code checkout
         if: ${{ github.event_name != 'pull_request' }}
         uses: actions/checkout@v6
diff --git a/.github/workflows/mshv-infra.yaml b/.github/workflows/mshv-infra.yaml
index ad71f6904..22f5ddbe6 100644
--- a/.github/workflows/mshv-infra.yaml
+++ b/.github/workflows/mshv-infra.yaml
@@ -68,7 +68,7 @@ jobs:
           fi
           az --version
           echo "Logging into Azure CLI using Managed Identity"
-          az login --identity --client-id ${MI_CLIENT_ID}
+          az login --identity --client-id "${MI_CLIENT_ID}"
 
       - name: Get Location
         id: get-location
@@ -118,7 +118,7 @@ jobs:
           echo "Creating Resource Group: $RG"
           # Create the resource group
           echo "Creating resource group in location: ${LOCATION}"
-          az group create --name ${RG} --location ${LOCATION}
+          az group create --name "${RG}" --location "${LOCATION}"
           echo "RG_NAME=${RG}" >> $GITHUB_OUTPUT
           echo "Resource group created successfully."
 
@@ -130,7 +130,7 @@ jobs:
           set -e
           echo "Generating SSH key: $KEY"
           mkdir -p ~/.ssh
-          ssh-keygen -t rsa -b 4096 -f ~/.ssh/${KEY} -N ""
+          ssh-keygen -t rsa -b 4096 -f ~/.ssh/"${KEY}" -N ""
 
       - name: Create VM
         id: vm-setup
@@ -150,7 +150,7 @@ jobs:
 
           # Extract subnet ID from the runner VM
           echo "Retrieving subnet ID..."
-          SUBNET_ID=$(az network vnet list --resource-group ${RUNNER_RG} --query "[?contains(location, '${LOCATION}')].{SUBNETS:subnets}" | jq -r ".[0].SUBNETS[0].id")
+          SUBNET_ID=$(az network vnet list --resource-group "$RUNNER_RG" --query "[?contains(location, '${LOCATION}')].{SUBNETS:subnets}" | jq -r ".[0].SUBNETS[0].id")
           if [[ -z "${SUBNET_ID}" ]]; then
             echo "ERROR: Failed to retrieve Subnet ID."
             exit 1
@@ -158,7 +158,7 @@ jobs:
 
           # Extract image ID from the runner VM
           echo "Retrieving image ID..."
-          IMAGE_ID=$(az image show --resource-group ${RUNNER_RG} --name ${VM_IMAGE_NAME} --query "id" -o tsv)
+          IMAGE_ID=$(az image show --resource-group "$RUNNER_RG" --name "$VM_IMAGE_NAME" --query "id" -o tsv)
           if [[ -z "${IMAGE_ID}" ]]; then
             echo "ERROR: Failed to retrieve Image ID."
             exit 1
@@ -166,24 +166,24 @@ jobs:
 
           # Create VM
           az vm create \
-            --resource-group ${RG} \
-            --name ${VM_NAME} \
-            --subnet ${SUBNET_ID} \
-            --size ${VM_SKU} \
-            --location ${LOCATION} \
-            --image ${IMAGE_ID} \
-            --os-disk-size-gb ${OS_DISK_SIZE} \
+            --resource-group "${RG}" \
+            --name "${VM_NAME}" \
+            --subnet "${SUBNET_ID}" \
+            --size "${VM_SKU}" \
+            --location "${LOCATION}" \
+            --image "${IMAGE_ID}" \
+            --os-disk-size-gb "${OS_DISK_SIZE}" \
             --public-ip-sku Standard \
             --storage-sku Premium_LRS \
             --public-ip-address "" \
-            --admin-username ${USERNAME} \
-            --ssh-key-value  ~/.ssh/${KEY}.pub \
+            --admin-username "${USERNAME}" \
+            --ssh-key-value  ~/.ssh/"${KEY}".pub \
             --security-type Standard \
             --output json
 
-          az vm boot-diagnostics enable --name ${VM_NAME} --resource-group ${RG}
+          az vm boot-diagnostics enable --name "${VM_NAME}" --resource-group "${RG}"
 
-          echo "VM_NAME=${VM_NAME}" >> $GITHUB_OUTPUT
+          echo "VM_NAME=${VM_NAME}" >> "$GITHUB_OUTPUT"
           echo "VM creation process completed successfully."
 
       - name: Get VM Private IP
@@ -195,12 +195,12 @@ jobs:
           set -e
           echo "Retrieving VM Private IP address..."
           # Retrieve VM Private IP address
-          PRIVATE_IP=$(az vm show -g ${RG} -n ${VM_NAME} -d --query privateIps -o tsv)
+          PRIVATE_IP=$(az vm show -g "${RG}" -n "${VM_NAME}" -d --query privateIps -o tsv)
           if [[ -z "$PRIVATE_IP" ]]; then
             echo "ERROR: Failed to retrieve private IP address."
             exit 1
           fi
-          echo "PRIVATE_IP=$PRIVATE_IP" >> $GITHUB_OUTPUT
+          echo "PRIVATE_IP=$PRIVATE_IP" >> "$GITHUB_OUTPUT"
 
       - name: Wait for SSH availability
         env:
@@ -209,7 +209,7 @@ jobs:
           USERNAME: ${{ secrets.USERNAME }}
         run: |
           echo "Waiting for SSH to be accessible..."
-          timeout 120 bash -c 'until ssh -o StrictHostKeyChecking=no -i ~/.ssh/${KEY} ${USERNAME}@${PRIVATE_IP} "exit" 2>/dev/null; do sleep 5; done'
+          timeout 120 bash -c 'until ssh -o StrictHostKeyChecking=no -i ~/.ssh/"${KEY}" -- "${USERNAME}@${PRIVATE_IP}" "exit" 2>/dev/null; do sleep 5; done'
           echo "VM is accessible!"
 
       - name: Remove Old Host Key
@@ -218,7 +218,7 @@ jobs:
         run: |
           set -e
           echo "Removing the old host key"
-          ssh-keygen -R $PRIVATE_IP
+          ssh-keygen -R "$PRIVATE_IP"
 
       - name: SSH into VM and Install Dependencies
         env:
@@ -227,7 +227,7 @@ jobs:
           USERNAME: ${{ secrets.USERNAME }}
         run: |
           set -e
-          ssh -i ~/.ssh/${KEY} -o StrictHostKeyChecking=no ${USERNAME}@${PRIVATE_IP} << EOF
+          ssh -i ~/.ssh/"${KEY}" -o StrictHostKeyChecking=no -- "${USERNAME}@${PRIVATE_IP}" << EOF
             set -e
             echo "Logged in successfully."
             echo "Installing dependencies..."
@@ -243,6 +243,6 @@ jobs:
             sudo systemctl enable containerd.service
             sudo systemctl start docker
             sudo groupadd -f docker
-            sudo usermod -a -G docker ${USERNAME}
+            sudo usermod -a -G docker "${USERNAME}"
             sudo systemctl restart docker
           EOF
diff --git a/.github/workflows/mshv-integration.yaml b/.github/workflows/mshv-integration.yaml
index ad544249e..1b83b5d29 100644
--- a/.github/workflows/mshv-integration.yaml
+++ b/.github/workflows/mshv-integration.yaml
@@ -38,7 +38,7 @@ jobs:
         run: |
           set -e
           echo "Connecting to the VM via SSH..."
-          ssh -i ~/.ssh/${KEY} -o StrictHostKeyChecking=no ${USERNAME}@${PRIVATE_IP} << EOF
+          ssh -i ~/.ssh/"${KEY}" -o StrictHostKeyChecking=no -- "${USERNAME}@${PRIVATE_IP}" << EOF
             set -e
             echo "Logged in successfully."
             export PATH="\$HOME/.cargo/bin:\$PATH"
@@ -87,9 +87,7 @@ jobs:
           PRIVATE_IP: ${{ needs.infra-setup.outputs.PRIVATE_IP }}
           USERNAME: ${{ secrets.MSHV_USERNAME }}
         run: |
-          ssh -i ~/.ssh/${KEY} -o StrictHostKeyChecking=no ${USERNAME}@${PRIVATE_IP} << EOF
-            sudo dmesg
-          EOF
+          ssh -i ~/.ssh/"${KEY}" -o StrictHostKeyChecking=no -- "${USERNAME}@${PRIVATE_IP}" sudo dmesg
 
       - name: Dump serial console logs
         if: always()
@@ -111,8 +109,8 @@ jobs:
         env:
           RG: MSHV-INTEGRATION-${{ github.run_id }}
         run: |
-          if az group exists --name ${RG}; then
-            az group delete --name ${RG} --yes --no-wait
+          if az group exists --name "${RG}"; then
+            az group delete --name "${RG}" --yes --no-wait
           else
             echo "Resource Group ${RG} does not exist. Skipping deletion."
           fi
@@ -122,8 +120,8 @@ jobs:
         env:
           KEY: azure_key_${{ github.run_id }}
         run: |
-          if [ -f ~/.ssh/${KEY} ]; then
-            rm -f ~/.ssh/${KEY} ~/.ssh/${KEY}.pub
+          if [ -f ~/.ssh/"${KEY}" ]; then
+            rm -f ~/.ssh/"${KEY}" ~/.ssh/"${KEY}.pub"
             echo "SSH key deleted successfully."
           else
             echo "SSH key does not exist. Skipping deletion."