diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
new file mode 100644
index 0000000..f21b009
--- /dev/null
+++ b/.github/workflows/actionlint.yaml
@@ -0,0 +1,12 @@
+name: Lint GitHub Actions
+on:
+  push:
+    paths: ['.github/**']
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          show-progress: false
+      - uses: alphagov/govuk-infrastructure/.github/actions/actionlint@main
diff --git a/.github/workflows/build-multiarch.yaml b/.github/workflows/build-multiarch.yaml
index 25d03fc..817abc9 100644
--- a/.github/workflows/build-multiarch.yaml
+++ b/.github/workflows/build-multiarch.yaml
@@ -36,9 +36,11 @@ jobs:
           show-progress: false
       - id: set-matrix
         run: |
-          echo "matrix=$(jq -c . < build-matrix.json)" >> $GITHUB_OUTPUT
-          echo "matrix_versions=$(jq -c .version < build-matrix.json)" >> $GITHUB_OUTPUT
-          echo "runs_on=$(jq -c .runs_on < build-matrix.json)" >> $GITHUB_OUTPUT
+          {
+            echo "matrix=$(jq -c . < build-matrix.json)"
+            echo "matrix_versions=$(jq -c .version < build-matrix.json)"
+            echo "runs_on=$(jq -c .runs_on < build-matrix.json)"
+          } >> "$GITHUB_OUTPUT"
 
   build_and_push_image:
     name: Build ruby_${{ join(matrix.version.rubyver, '.') }} for ${{ matrix.runs_on.arch }} and push to GHCR
@@ -67,7 +69,7 @@ jobs:
         id: calculate-image-tags
         run: |
           CREATED_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
-          echo "createdDate=${CREATED_DATE}" >> $GITHUB_OUTPUT
+          echo "createdDate=${CREATED_DATE}" >> "$GITHUB_OUTPUT"
 
       - name: Generate Base Image Metadata
         uses: docker/metadata-action@v5
@@ -190,7 +192,7 @@ jobs:
         id: calculate-image-tags
         run: |
           CREATED_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')"
-          echo "createdDate=${CREATED_DATE}" >> $GITHUB_OUTPUT
+          echo "createdDate=${CREATED_DATE}" >> "$GITHUB_OUTPUT"
 
       - name: Login to GHCR
         uses: docker/login-action@v3
@@ -224,6 +226,7 @@ jobs:
       - name: Create Manifest Lists (for Base)
         working-directory: /tmp/digests/base
         run: |
+          # shellcheck disable=SC2046
           docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
             $(printf '${{ env.REGISTRY_BASE }}/govuk-ruby-base@sha256:%s ' *)  
 
@@ -252,6 +255,7 @@ jobs:
       - name: Create Manifest Lists (for Builder)
         working-directory: /tmp/digests/builder
         run: |
+          # shellcheck disable=SC2046
           docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
             $(printf '${{ env.REGISTRY_BASE }}/govuk-ruby-builder@sha256:%s ' *)  
 
diff --git a/.github/workflows/gc.yaml b/.github/workflows/gc.yaml
index 1927764..d50ccec 100644
--- a/.github/workflows/gc.yaml
+++ b/.github/workflows/gc.yaml
@@ -25,7 +25,7 @@ jobs:
             jq <build-matrix.json -cr '[.version[].rubyver[:2] | join("\\.")] | join("|")'
           ))(-.*)?|$(
             jq <build-matrix.json -cr '[.version[].extra | select(length > 0)] | join("|")'
-          ))\$" >> $GITHUB_OUTPUT
+          ))\$" >> "$GITHUB_OUTPUT"
 
   gc_old_images:
     name: GC old images