diff --git a/.github/scripts/generate-release-contributors.sh b/.github/scripts/generate-release-contributors.sh
index 3219318d3..f7f903153 100755
--- a/.github/scripts/generate-release-contributors.sh
+++ b/.github/scripts/generate-release-contributors.sh
@@ -10,7 +10,7 @@
 from_version=$1
 
 # get the date of the first commit that was not in the from_version
-from=$(git log --reverse --pretty=format:"%cI" $from_version..HEAD | head -1)
+from=$(git log --reverse --pretty=format:"%cI" "$from_version..HEAD" | head -1)
 
 # get the last commit on main that was included in the release
 to=$(git merge-base origin/main HEAD | xargs git log -1 --pretty=format:"%cI")
@@ -52,6 +52,8 @@ query($q: String!, $endCursor: String) {
 
 # this query captures authors of issues which have had PRs in the current range reference the issue
 # but not necessarily through closingIssuesReferences (e.g. addressing just a part of an issue)
+#
+# note: [^0-9<&#;] below excludes HTML entity markers to avoid matching &#1234; as issue #1234
 contributors2=$(gh api graphql --paginate -F q="repo:$GITHUB_REPOSITORY is:pr base:main is:merged merged:$from..$to" -f query='
 query($q: String!, $endCursor: String) {
   search(query: $q, type: ISSUE, first: 100, after: $endCursor) {
@@ -76,15 +78,15 @@ query($q: String!, $endCursor: String) {
   | sed 's/^\["//' \
   | sed 's/".*//')
 
-# TODO (trask) can remove dependabot line after next release
-echo $contributors1 $contributors2 \
+echo "$contributors1" "$contributors2" \
   | sed 's/ /\n/g' \
   | sort -uf \
+  | grep -v codecov \
   | grep -v copilot-pull-request-reviewer \
   | grep -v copilot-swe-agent \
   | grep -v github-actions \
   | grep -v github-advanced-security \
   | grep -v linux-foundation-easycla \
-  | grep -v renovate \
   | grep -v otelbot \
+  | grep -v renovate \
   | sed 's/^/@/'