diff --git a/.github/workflows/agent-image.yml b/.github/workflows/agent-image.yml
index fff585b..ec250c7 100644
--- a/.github/workflows/agent-image.yml
+++ b/.github/workflows/agent-image.yml
@@ -2,10 +2,15 @@ name: Agent image
 
 on:
   push:
-    branches: [main]
-    paths: ["docker/agent/**", ".github/workflows/agent-image.yml"]
+    branches:
+      - main
+    paths:
+      - "docker/agent/**"
+      - ".github/workflows/agent-image.yml"
   pull_request:
-    paths: ["docker/agent/**", ".github/workflows/agent-image.yml"]
+    paths:
+      - "docker/agent/**"
+      - ".github/workflows/agent-image.yml"
   workflow_dispatch:
 
 permissions:
@@ -21,7 +26,9 @@ jobs:
       attestations: write
     strategy:
       matrix:
-        agent: [claude, codex]
+        agent:
+          - claude
+          - codex
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -29,7 +36,7 @@ jobs:
       - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
-        if: github.event_name != 'pull_request'
+        if: ${{ github.event_name != 'pull_request' }}
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -46,7 +53,7 @@ jobs:
             ghcr.io/${{ github.repository }}-agent:${{ matrix.agent }}
             ghcr.io/${{ github.repository }}-agent:${{ matrix.agent }}-${{ github.sha }}
       - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
-        if: github.event_name != 'pull_request'
+        if: ${{ github.event_name != 'pull_request' }}
         with:
           subject-name: ghcr.io/${{ github.repository }}-agent
           subject-digest: ${{ steps.push.outputs.digest }}
@@ -56,7 +63,7 @@ jobs:
   # through a reviewed pull request.
   pin:
     needs: image
-    if: github.event_name != 'pull_request'
+    if: ${{ github.event_name != 'pull_request' }}
     runs-on: ubuntu-latest
     permissions:
       contents: write
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d5ce46..d24466c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,7 +2,8 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
   pull_request:
 
 permissions:
@@ -56,7 +57,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        agent: [claude, codex]
+        agent:
+          - claude
+          - codex
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 59183ab..a5936fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,7 +2,8 @@ name: Release
 
 on:
   push:
-    tags: ["v[0-9]+.[0-9]+.[0-9]+.[0-9]+"]
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+.[0-9]+"
 
 permissions:
   contents: read