diff --git a/.github/workflows/ci-release-create.yaml b/.github/workflows/ci-release-create.yaml
index 7dc496fcf5..0e37e5b3e7 100644
--- a/.github/workflows/ci-release-create.yaml
+++ b/.github/workflows/ci-release-create.yaml
@@ -18,24 +18,33 @@ on:
         default: true
         description: Create a release after merging the PR
 
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
 jobs:
   create_pr:
     timeout-minutes: 10
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           ref: ${{ github.event.inputs.ref }}
 
       - name: Sanitize version
         id: sanitize
+        env:
+          RAW_VERSION: ${{ github.event.inputs.version }}
         run: |
-          echo version=$(echo ${{ github.event.inputs.version }} | sed 's/^v//') >> $GITHUB_OUTPUT
+          VERSION="${RAW_VERSION#v}"
+          printf 'version=%s\n' "$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Update versions
+        env:
+          VERSION: ${{ steps.sanitize.outputs.version }}
         run: |
-          echo ${{ steps.sanitize.outputs.version }} > version.txt
+          printf '%s\n' "$VERSION" > version.txt
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@v6
diff --git a/.github/workflows/ci-release-merge.yaml b/.github/workflows/ci-release-merge.yaml
index e204949aff..a398fc96a9 100644
--- a/.github/workflows/ci-release-merge.yaml
+++ b/.github/workflows/ci-release-merge.yaml
@@ -8,6 +8,10 @@ on:
     types:
       - closed
 
+defaults:
+  run:
+    shell: bash --noprofile --norc -euo pipefail {0}
+
 jobs:
   tag_and_release:
     timeout-minutes: 10
@@ -16,33 +20,40 @@ jobs:
     steps:
       - name: Check PR Author
         id: check_author
+        env:
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
         run: |
-          if [[ "${{ github.event.pull_request.user.login }}" != "github-actions[bot]" ]]; then
-            echo "PR author (${AUTHOR}) is not trusted. Exiting."
+          set -euo pipefail
+          if [[ "$PR_AUTHOR" != "github-actions[bot]" ]]; then
+            echo "PR author ($PR_AUTHOR) is not trusted. Exiting."
             exit 1
           fi
 
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
         with:
           ref: main
 
       - name: Get version from PR title
         id: extract_version
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
-          VERSION=$(echo "${{ github.event.pull_request.title }}" | sed -n 's/.*Release v\([0-9.]*\).*/\1/p')
+          set -euo pipefail
+          VERSION=$(printf '%s' "$PR_TITLE" | sed -n 's/.*Release v\([0-9][0-9.]*\).*/\1/p')
           if [ -z "$VERSION" ]; then
             echo "No valid version found in PR title. Exiting."
             exit 1
           fi
-          echo "VERSION=$VERSION" >> $GITHUB_ENV
+          printf 'VERSION=%s\n' "$VERSION" >> "$GITHUB_ENV"
 
       - name: Push new tag
         run: |
+          set -euo pipefail
           git config --global user.name 'Github Action Deploy'
           git config --global user.email 'github-action-deploy@twenty.com'
-          git tag v${{ env.VERSION }}
-          git push origin v${{ env.VERSION }}
+          git tag "v${{ env.VERSION }}"
+          git push origin "v${{ env.VERSION }}"
 
       - uses: release-drafter/release-drafter@v5
         if: contains(github.event.pull_request.labels.*.name, 'create_release')