diff --git a/.github/workflows/doc-link-check.yml b/.github/workflows/doc-link-check.yml
index 372ac9d..795b336 100644
--- a/.github/workflows/doc-link-check.yml
+++ b/.github/workflows/doc-link-check.yml
@@ -33,7 +33,7 @@ jobs:
           restore-keys: cache-lychee-
 
       - name: Run lychee
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411  # v2.8.0
         with:
           args: >-
             --no-progress
diff --git a/.github/workflows/rules-lint.yml b/.github/workflows/rules-lint.yml
index d0a7b93..b11f36e 100644
--- a/.github/workflows/rules-lint.yml
+++ b/.github/workflows/rules-lint.yml
@@ -57,11 +57,13 @@ jobs:
           echo "Validator self-test passed: good fixture accepted, bad fixture rejected."
 
       - name: Done Criteria schema validation
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           set -e
           # Find any plan files added or modified in this PR.
           # Plans live under plans/ at the repo root or examples/plans/.
-          changed=$(git diff --name-only --diff-filter=AM "${{ github.event.pull_request.base.sha || github.event.before }}" HEAD -- 'plans/**/*.md' 'examples/plans/**/*.md' 2>/dev/null || true)
+          changed=$(git diff --name-only --diff-filter=AM "$BASE_SHA" HEAD -- 'plans/**/*.md' 'examples/plans/**/*.md' 2>/dev/null || true)
           if [ -z "$changed" ]; then
             echo "No plan files added/modified in this PR — skipping Done Criteria validation."
             exit 0
@@ -85,10 +87,12 @@ jobs:
           echo "Empty-rule-body gate self-test passed: real rules accepted, stub rejected."
 
       - name: Empty-rule-body gate on changed rule files
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }}
         run: |
           set -e
           # Find rule files added/modified in this PR.
-          changed=$(git diff --name-only --diff-filter=AM "${{ github.event.pull_request.base.sha || github.event.before }}" HEAD -- 'examples/claude-code-rules/**/*.md' 2>/dev/null || true)
+          changed=$(git diff --name-only --diff-filter=AM "$BASE_SHA" HEAD -- 'examples/claude-code-rules/**/*.md' 2>/dev/null || true)
           if [ -z "$changed" ]; then
             echo "No rule files added/modified in this PR — skipping per-file check."
             exit 0