diff --git a/.github/actions/build/build-binaries/action.yml b/.github/actions/build/build-binaries/action.yml
index 9864cf0..6a87d59 100644
--- a/.github/actions/build/build-binaries/action.yml
+++ b/.github/actions/build/build-binaries/action.yml
@@ -115,9 +115,11 @@ runs:
           PATHS_TO_ARCHIVE="$PATHS_TO_ARCHIVE ./docker-images/artifacts/binaries"
         fi
 
-        tar -cvpf binaries-${{ inputs.artifactSuffix }}.tar \
+        tar -cvpf binaries-${INPUTS_ARTIFACTSUFFIX}.tar \
           --exclude='**/surefire-reports' \
           $PATHS_TO_ARCHIVE
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
     - name: Upload artifact
       if: ${{ inputs.mainJavaBuild == 'true' }}
diff --git a/.github/actions/build/build-containers/action.yml b/.github/actions/build/build-containers/action.yml
index ccf7389..d6d81cf 100644
--- a/.github/actions/build/build-containers/action.yml
+++ b/.github/actions/build/build-containers/action.yml
@@ -48,7 +48,9 @@ runs:
 
     - name: "Untar binaries archive"
       shell: bash
-      run: tar -xvf binaries-${{ inputs.artifactSuffix }}.tar
+      run: tar -xvf binaries-${INPUTS_ARTIFACTSUFFIX}.tar
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
     - name: Build images
       shell: bash
@@ -64,7 +66,11 @@ runs:
 
     - name: Create tarball with images
       shell: bash
-      run: "tar -cvpf containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar ${{ inputs.imagesLocation }}"
+      run: "tar -cvpf containers-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_ARCHITECTURE}.tar ${INPUTS_IMAGESLOCATION}"
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
+        INPUTS_IMAGESLOCATION: ${{ inputs.imagesLocation }}
 
     - name: Upload containers artifact
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
@@ -76,4 +82,4 @@ runs:
       if: ${{ always() }}
       shell: bash
       run: |
-        docker images -a
\ No newline at end of file
+        docker images -a
diff --git a/.github/actions/build/load-containers/action.yml b/.github/actions/build/load-containers/action.yml
index f2187a7..7e7ae00 100644
--- a/.github/actions/build/load-containers/action.yml
+++ b/.github/actions/build/load-containers/action.yml
@@ -30,11 +30,17 @@ runs:
   steps:
     - name: "Untar ${{ inputs.architecture }} containers"
       shell: bash
-      run: tar -xvf containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar
+      run: tar -xvf containers-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: "Delete the original archive with ${{ inputs.architecture }} containers"
       shell: bash
-      run: rm containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar
+      run: rm containers-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     # This is for loading images into minikube registry
     - name: Load & push images into minikube registry
diff --git a/.github/actions/build/publish-helm-chart/action.yml b/.github/actions/build/publish-helm-chart/action.yml
index 1eac5e3..716b406 100644
--- a/.github/actions/build/publish-helm-chart/action.yml
+++ b/.github/actions/build/publish-helm-chart/action.yml
@@ -41,18 +41,30 @@ runs:
 
     - name: Extract release artifacts
       shell: bash
-      run: tar -xvf release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
+      run: tar -xvf release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+        INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
 
     - name: Login to OCI registry
       shell: bash
-      run: helm registry login -u ${{ inputs.registryUser }} -p ${{ inputs.registryPassword }} ${{ inputs.containerRegistry }}
+      run: helm registry login -u ${INPUTS_REGISTRYUSER} -p ${INPUTS_REGISTRYPASSWORD} ${INPUTS_CONTAINERREGISTRY}
+      env:
+        INPUTS_REGISTRYUSER: ${{ inputs.registryUser }}
+        INPUTS_REGISTRYPASSWORD: ${{ inputs.registryPassword }}
+        INPUTS_CONTAINERREGISTRY: ${{ inputs.containerRegistry }}
 
     - name: Push Helm Chart to OCI registry
       id: helm-push
       shell: bash
       run: |
-        PUSH_OUTPUT=$(helm push ${{ inputs.helmChartName }}-${{ inputs.releaseVersion }}.tgz oci://${{ inputs.containerRegistry }}/${{ inputs.containerOrg }} 2>&1)
+        PUSH_OUTPUT=$(helm push ${INPUTS_HELMCHARTNAME}-${INPUTS_RELEASEVERSION}.tgz oci://${INPUTS_CONTAINERREGISTRY}/${INPUTS_CONTAINERORG} 2>&1)
         echo "$PUSH_OUTPUT"
         DIGEST=$(echo "$PUSH_OUTPUT" | grep "Digest:" | awk '{print $2}')
         echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
-        echo "image=${{ inputs.containerRegistry }}/${{ inputs.containerOrg }}/${{ inputs.helmChartName }}@${DIGEST}" >> "$GITHUB_OUTPUT"
+        echo "image=${INPUTS_CONTAINERREGISTRY}/${INPUTS_CONTAINERORG}/${INPUTS_HELMCHARTNAME}@${DIGEST}" >> "$GITHUB_OUTPUT"
+      env:
+        INPUTS_HELMCHARTNAME: ${{ inputs.helmChartName }}
+        INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
+        INPUTS_CONTAINERREGISTRY: ${{ inputs.containerRegistry }}
+        INPUTS_CONTAINERORG: ${{ inputs.containerOrg }}
diff --git a/.github/actions/build/push-containers/action.yml b/.github/actions/build/push-containers/action.yml
index e04d5be..e96cc4c 100644
--- a/.github/actions/build/push-containers/action.yml
+++ b/.github/actions/build/push-containers/action.yml
@@ -66,20 +66,27 @@ runs:
     - name: Extract container archives
       shell: bash
       run: |
-        IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
+        IFS=',' read -ra ARCH_ARRAY <<< "${INPUTS_ARCHITECTURES}"
         for arch in "${ARCH_ARRAY[@]}"; do
-          tar -xvf "containers-${{ inputs.artifactSuffix }}-${arch}.tar"
-          rm "containers-${{ inputs.artifactSuffix }}-${arch}.tar"
+          tar -xvf "containers-${INPUTS_ARTIFACTSUFFIX}-${arch}.tar"
+          rm "containers-${INPUTS_ARTIFACTSUFFIX}-${arch}.tar"
         done
+      env:
+        INPUTS_ARCHITECTURES: ${{ inputs.architectures }}
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
     - name: Login to container registry
       shell: bash
-      run: docker login -u ${{ inputs.registryUser }} -p ${{ inputs.registryPassword }} ${{ inputs.containerRegistry }}
+      run: docker login -u ${INPUTS_REGISTRYUSER} -p ${INPUTS_REGISTRYPASSWORD} ${INPUTS_CONTAINERREGISTRY}
+      env:
+        INPUTS_REGISTRYUSER: ${{ inputs.registryUser }}
+        INPUTS_REGISTRYPASSWORD: ${{ inputs.registryPassword }}
+        INPUTS_CONTAINERREGISTRY: ${{ inputs.containerRegistry }}
 
     - name: Push containers and create manifests
       shell: bash
       run: |
-        IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
+        IFS=',' read -ra ARCH_ARRAY <<< "${INPUTS_ARCHITECTURES}"
         for arch in "${ARCH_ARRAY[@]}"; do
           echo "Processing architecture: ${arch}"
           export DOCKER_ARCHITECTURE="${arch}"
@@ -91,6 +98,7 @@ runs:
         DOCKER_REGISTRY: ${{ inputs.containerRegistry }}
         DOCKER_ORG: ${{ inputs.containerOrg }}
         DOCKER_TAG: ${{ inputs.containerTag }}
+        INPUTS_ARCHITECTURES: ${{ inputs.architectures }}
 
     - name: Create multi-platform manifests
       shell: bash
@@ -126,7 +134,7 @@ runs:
       if: ${{ github.event_name != 'pull_request' }}
       shell: bash
       run: |
-        IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
+        IFS=',' read -ra ARCH_ARRAY <<< "${INPUTS_ARCHITECTURES}"
         for arch in "${ARCH_ARRAY[@]}"; do
           echo "Generating SBOM for architecture: ${arch}"
           export DOCKER_ARCHITECTURE="${arch}"
@@ -138,6 +146,7 @@ runs:
         DOCKER_REGISTRY: ${{ inputs.containerRegistry }}
         DOCKER_ORG: ${{ inputs.containerOrg }}
         DOCKER_TAG: ${{ inputs.containerTag }}
+        INPUTS_ARCHITECTURES: ${{ inputs.architectures }}
 
     # Generates a list of images and it's digest for attestation
     - name: Discover container images for attestation
@@ -148,8 +157,8 @@ runs:
         if [ -d "./sbom" ]; then
           for sbom_file in $(find ./sbom -name "*.json" -type f | sort); do
             relative="${sbom_file#./sbom/}"
-            after_org="${relative#*${{ inputs.containerRegistry }}/${{ inputs.containerOrg }}/}"
-            name="${{ inputs.containerRegistry }}/${{ inputs.containerOrg }}/${after_org%%/*}"
+            after_org="${relative#*${INPUTS_CONTAINERREGISTRY}/${INPUTS_CONTAINERORG}/}"
+            name="${INPUTS_CONTAINERREGISTRY}/${INPUTS_CONTAINERORG}/${after_org%%/*}"
             digest=$(basename "$sbom_file" .json)
             images=$(echo "$images" | jq -c --arg n "$name" --arg d "$digest" --arg s "$relative" \
               '. + [{"name": $n, "digest": $d, "sbom": $s}]')
@@ -158,6 +167,9 @@ runs:
         fi
         echo "images=${images}" >> "$GITHUB_OUTPUT"
         echo "Discovered $(echo "$images" | jq 'length') image(s) for attestation"
+      env:
+        INPUTS_CONTAINERREGISTRY: ${{ inputs.containerRegistry }}
+        INPUTS_CONTAINERORG: ${{ inputs.containerOrg }}
 
     - name: Create SBOM archive
       # This condition is required for properly running the tests
@@ -181,7 +193,7 @@ runs:
       if: ${{ startsWith(github.ref, 'refs/heads/release-') }}
       shell: bash
       run: |
-        IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
+        IFS=',' read -ra ARCH_ARRAY <<< "${INPUTS_ARCHITECTURES}"
         for arch in "${ARCH_ARRAY[@]}"; do
           echo "Pushing SBOM for architecture: ${arch}"
           export DOCKER_ARCHITECTURE="${arch}"
@@ -194,4 +206,5 @@ runs:
         BUILD_COMMIT: ${{ github.sha }}
         DOCKER_REGISTRY: ${{ inputs.containerRegistry }}
         DOCKER_ORG: ${{ inputs.containerOrg }}
-        DOCKER_TAG: ${{ inputs.containerTag }}
\ No newline at end of file
+        DOCKER_TAG: ${{ inputs.containerTag }}
+        INPUTS_ARCHITECTURES: ${{ inputs.architectures }}
diff --git a/.github/actions/build/release-artifacts/action.yml b/.github/actions/build/release-artifacts/action.yml
index 02802e9..3d75ef0 100644
--- a/.github/actions/build/release-artifacts/action.yml
+++ b/.github/actions/build/release-artifacts/action.yml
@@ -29,11 +29,14 @@ runs:
     - name: Create release tarball
       shell: bash
       run: |
-        find . -type f \( -iname "*${{ inputs.releaseVersion }}*.tar.gz" -o \
-                          -iname "*${{ inputs.releaseVersion }}*.zip" -o \
-                          -iname "*${{ inputs.releaseVersion }}*.tgz" -o \
-                          -iname "*${{ inputs.releaseVersion }}*.yaml" \) \
-          -exec tar -rvf release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar {} \;
+        find . -type f \( -iname "*${INPUTS_RELEASEVERSION}*.tar.gz" -o \
+                          -iname "*${INPUTS_RELEASEVERSION}*.zip" -o \
+                          -iname "*${INPUTS_RELEASEVERSION}*.tgz" -o \
+                          -iname "*${INPUTS_RELEASEVERSION}*.yaml" \) \
+          -exec tar -rvf release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar {} \;
+      env:
+        INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
     - name: Upload release artifacts
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
diff --git a/.github/actions/dependencies/install-shellcheck/action.yml b/.github/actions/dependencies/install-shellcheck/action.yml
index 0a0c972..eecd97c 100644
--- a/.github/actions/dependencies/install-shellcheck/action.yml
+++ b/.github/actions/dependencies/install-shellcheck/action.yml
@@ -17,6 +17,7 @@ runs:
     - name: Install shellcheck
       shell: bash
       run: |
-        ${{ github.action_path }}/setup_shellcheck.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/setup_shellcheck.sh "${INPUTS_ARCHITECTURE}"
       env:
-        VERSION: ${{ inputs.version }}
\ No newline at end of file
+        VERSION: ${{ inputs.version }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
diff --git a/.github/actions/dependencies/install-syft/action.yml b/.github/actions/dependencies/install-syft/action.yml
index b7c53eb..b6432f9 100644
--- a/.github/actions/dependencies/install-syft/action.yml
+++ b/.github/actions/dependencies/install-syft/action.yml
@@ -17,6 +17,7 @@ runs:
     - name: Install Syft
       shell: bash
       run: |
-        ${{ github.action_path }}/install_syft.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/install_syft.sh "${INPUTS_ARCHITECTURE}"
       env:
         VERSION: ${{ inputs.version }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
diff --git a/.github/actions/dependencies/install-yq/action.yml b/.github/actions/dependencies/install-yq/action.yml
index dc4c934..b108682 100644
--- a/.github/actions/dependencies/install-yq/action.yml
+++ b/.github/actions/dependencies/install-yq/action.yml
@@ -17,6 +17,7 @@ runs:
     - name: Install yq
       shell: bash
       run: |
-        ${{ github.action_path }}/install_yq.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/install_yq.sh "${INPUTS_ARCHITECTURE}"
       env:
         VERSION: ${{ inputs.version }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
diff --git a/.github/actions/dependencies/setup-kind/action.yml b/.github/actions/dependencies/setup-kind/action.yml
index f2dd87f..715f3a0 100644
--- a/.github/actions/dependencies/setup-kind/action.yml
+++ b/.github/actions/dependencies/setup-kind/action.yml
@@ -41,14 +41,19 @@ runs:
       if: steps.cache-registry.outputs.cache-hit == 'true'
       shell: bash
       run: |
-        docker load -i /tmp/registry-image-${{ inputs.architecture }}.tar
+        docker load -i /tmp/registry-image-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Pull and save registry Docker image if cache miss
       if: steps.cache-registry.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        docker pull ${{ inputs.registry }}
-        docker save ${{ inputs.registry }} -o /tmp/registry-image-${{ inputs.architecture }}.tar
+        docker pull ${INPUTS_REGISTRY}
+        docker save ${INPUTS_REGISTRY} -o /tmp/registry-image-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_REGISTRY: ${{ inputs.registry }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Cache cloud-provider-kind container image
       id: cache-cloud-provider-kind
@@ -61,39 +66,49 @@ runs:
       if: steps.cache-cloud-provider-kind.outputs.cache-hit == 'true'
       shell: bash
       run: |
-        docker load -i /tmp/cloud-provider-kind-image-${{ inputs.architecture }}.tar
+        docker load -i /tmp/cloud-provider-kind-image-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Pull and save cloud-provider-kind container image if cache miss
       if: steps.cache-cloud-provider-kind.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        docker pull registry.k8s.io/cloud-provider-kind/cloud-controller-manager:v${{ inputs.cloudProviderVersion }}
-        docker save registry.k8s.io/cloud-provider-kind/cloud-controller-manager:v${{ inputs.cloudProviderVersion }} -o /tmp/cloud-provider-kind-image-${{ inputs.architecture }}.tar
+        docker pull registry.k8s.io/cloud-provider-kind/cloud-controller-manager:v${INPUTS_CLOUDPROVIDERVERSION}
+        docker save registry.k8s.io/cloud-provider-kind/cloud-controller-manager:v${INPUTS_CLOUDPROVIDERVERSION} -o /tmp/cloud-provider-kind-image-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_CLOUDPROVIDERVERSION: ${{ inputs.cloudProviderVersion }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Setup Kind
       shell: bash
       run: |
-        ${{ github.action_path }}/setup-kind.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/setup-kind.sh "${INPUTS_ARCHITECTURE}"
       env:
         REGISTRY_IMAGE: ${{ inputs.registry }}
         CONTROL_NODES: ${{ inputs.controlNodes }}
         WORKER_NODES: ${{ inputs.workerNodes }}
         KIND_CLOUD_PROVIDER_VERSION: v${{ inputs.cloudProviderVersion }}
         KIND_VERSION: v${{ inputs.kindVersion }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Set DOCKER_REGISTRY
       shell: bash
-      run: |
+      # Exporting the registry address to the calling job is the purpose of this step;
+      # the value comes from the runner or cluster, not from user input
+      run: | # zizmor: ignore[github-env]
         echo "DOCKER_REGISTRY=$(hostname --all-ip-addresses | awk '{ print $1 }'):5001" >> $GITHUB_ENV
 
     # This is used for building connect image used withing STs for runs where already existing images are used (releases)
     - name: Set CONNECT_BUILD_REGISTRY
       shell: bash
-      run: |
+      # Exporting the registry address to the calling job is the purpose of this step;
+      # the value comes from the runner or cluster, not from user input
+      run: | # zizmor: ignore[github-env]
         echo "CONNECT_BUILD_REGISTRY=$(hostname --all-ip-addresses | awk '{ print $1 }'):5001" >> $GITHUB_ENV
 
     - name: Print registry values
       shell: bash
       run: |
         echo "DOCKER_REGISTRY=${DOCKER_REGISTRY}"
-        echo "CONNECT_BUILD_REGISTRY=${CONNECT_BUILD_REGISTRY}"
\ No newline at end of file
+        echo "CONNECT_BUILD_REGISTRY=${CONNECT_BUILD_REGISTRY}"
diff --git a/.github/actions/dependencies/setup-minikube/action.yml b/.github/actions/dependencies/setup-minikube/action.yml
index 961df68..a84cbec 100644
--- a/.github/actions/dependencies/setup-minikube/action.yml
+++ b/.github/actions/dependencies/setup-minikube/action.yml
@@ -39,13 +39,15 @@ runs:
       if: steps.cache-registry.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        docker pull ${{ inputs.registry }}
-        docker save ${{ inputs.registry }} -o /tmp/registry-image.tar
+        docker pull ${INPUTS_REGISTRY}
+        docker save ${INPUTS_REGISTRY} -o /tmp/registry-image.tar
+      env:
+        INPUTS_REGISTRY: ${{ inputs.registry }}
 
     - name: Setup Minikube
       shell: bash
       run: |
-        ${{ github.action_path }}/setup-minikube.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/setup-minikube.sh "${INPUTS_ARCHITECTURE}"
 
       env:
         TEST_CLUSTER: minikube
@@ -54,6 +56,7 @@ runs:
         TEST_MINIKUBE_VERSION: ${{ inputs.minikubeVersion }}
         REGISTRY_IMAGE: ${{ inputs.registry }}
         RETRIES: ${{ inputs.retries }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Set DOCKER_REGISTRY
       shell: bash
@@ -63,7 +66,9 @@ runs:
     # This is used for building connect image used withing STs for runs where already existing images are used (releases)
     - name: Set CONNECT_BUILD_REGISTRY
       shell: bash
-      run: |
+      # Exporting the registry address to the calling job is the purpose of this step;
+      # the value comes from the runner or cluster, not from user input
+      run: | # zizmor: ignore[github-env]
         echo "CONNECT_BUILD_REGISTRY=$(kubectl get service registry -n kube-system -o=jsonpath='{.spec.clusterIP}'):80" >> $GITHUB_ENV
 
     - name: DEBUG - check running containers
diff --git a/.github/actions/security/fossa-container-scan/action.yml b/.github/actions/security/fossa-container-scan/action.yml
index 38562df..1c95301 100644
--- a/.github/actions/security/fossa-container-scan/action.yml
+++ b/.github/actions/security/fossa-container-scan/action.yml
@@ -35,6 +35,7 @@ runs:
           https://raw.githubusercontent.com/fossas/fossa-cli/f9cd35ff5d917672d5433c46603de4ed92c53a0d/install-latest.sh | bash # v3.17.12
 
     - name: Load container image
+      id: load
       shell: bash
       env:
         IMAGE_FILE: ${{ inputs.imageFile }}
@@ -54,44 +55,51 @@ runs:
           exit 1
         fi
 
-        echo "LOADED_IMAGE=$LOADED_IMAGE" >> "$GITHUB_ENV"
+        echo "loaded-image=$LOADED_IMAGE" >> "$GITHUB_OUTPUT"
 
     - name: Run FOSSA Container Analyze
+      id: analyze
       shell: bash
       continue-on-error: true
       run: |
         ANALYZE_LOG=$(mktemp)
         set +e
-        SCAN_NAME="${{ inputs.scanName }}"
+        SCAN_NAME="${INPUTS_SCANNAME}"
         if [ -z "$SCAN_NAME" ]; then
-          SCAN_NAME="${{ inputs.image }}"
+          SCAN_NAME="${INPUTS_IMAGE}"
         fi
         fossa container analyze \
           --project "$SCAN_NAME" \
-          --team "${{ inputs.fossaTeam }}" \
-          --branch "${{ inputs.branch }}" \
+          --team "${INPUTS_FOSSATEAM}" \
+          --branch "${INPUTS_BRANCH}" \
           "$LOADED_IMAGE" > "$ANALYZE_LOG" 2>&1
         set -e
         cat "$ANALYZE_LOG"
         FOSSA_URL=$(grep -o 'https://app.fossa.com[^ ]*' "$ANALYZE_LOG" | head -1 || true)
-        echo "FOSSA_URL=$FOSSA_URL" >> "$GITHUB_ENV"
+        echo "fossa-url=$FOSSA_URL" >> "$GITHUB_OUTPUT"
         rm -f "$ANALYZE_LOG"
+      env:
+        LOADED_IMAGE: ${{ steps.load.outputs.loaded-image }}
+        INPUTS_SCANNAME: ${{ inputs.scanName }}
+        INPUTS_IMAGE: ${{ inputs.image }}
+        INPUTS_FOSSATEAM: ${{ inputs.fossaTeam }}
+        INPUTS_BRANCH: ${{ inputs.branch }}
 
     - name: Run FOSSA Test and Write Summary
       if: always()
       shell: bash
       run: |
         set +e
-        SCAN_NAME="${{ inputs.scanName }}"
+        SCAN_NAME="${INPUTS_SCANNAME}"
         if [ -z "$SCAN_NAME" ]; then
-          SCAN_NAME="${{ inputs.image }}"
+          SCAN_NAME="${INPUTS_IMAGE}"
         fi
         TEST_OUTPUT=$(fossa container test --project "$SCAN_NAME" "$LOADED_IMAGE" 2>&1)
         TEST_EXIT_CODE=$?
         set -e
         echo "$TEST_OUTPUT"
 
-        if [ "${{ inputs.fossaTest }}" == "true" ]; then
+        if [ "${INPUTS_FOSSATEST}" == "true" ]; then
           if [ "$TEST_EXIT_CODE" -eq 0 ]; then
             TEST_RESULT="✅ passed"
           else
@@ -106,9 +114,15 @@ runs:
         echo "| Type | Image | Report | Test |" >> "$GITHUB_STEP_SUMMARY"
         echo "|------|-------|--------|------|" >> "$GITHUB_STEP_SUMMARY"
         if [ -n "$FOSSA_URL" ]; then
-          echo "| Container | ${{ inputs.image }} | [View in FOSSA]($FOSSA_URL) | $TEST_RESULT |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Container | ${INPUTS_IMAGE} | [View in FOSSA]($FOSSA_URL) | $TEST_RESULT |" >> "$GITHUB_STEP_SUMMARY"
         else
-          echo "| Container | ${{ inputs.image }} | ❌ upload failed | $TEST_RESULT |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Container | ${INPUTS_IMAGE} | ❌ upload failed | $TEST_RESULT |" >> "$GITHUB_STEP_SUMMARY"
           echo "::error::FOSSA container analyze failed — no report URL found in output"
           exit 1
         fi
+      env:
+        LOADED_IMAGE: ${{ steps.load.outputs.loaded-image }}
+        FOSSA_URL: ${{ steps.analyze.outputs.fossa-url }}
+        INPUTS_SCANNAME: ${{ inputs.scanName }}
+        INPUTS_IMAGE: ${{ inputs.image }}
+        INPUTS_FOSSATEST: ${{ inputs.fossaTest }}
diff --git a/.github/actions/security/fossa-maven-scan/action.yml b/.github/actions/security/fossa-maven-scan/action.yml
index ff5ee92..22b39cf 100644
--- a/.github/actions/security/fossa-maven-scan/action.yml
+++ b/.github/actions/security/fossa-maven-scan/action.yml
@@ -40,18 +40,21 @@ runs:
           cp "${{ github.action_path }}/.fossa.yml" .fossa.yml
         fi
 
-        if [ -n "${{ inputs.exclude }}" ]; then
+        if [ -n "${INPUTS_EXCLUDE}" ]; then
           echo "" >> .fossa.yml
           echo "paths:" >> .fossa.yml
           echo "  exclude:" >> .fossa.yml
-          IFS=',' read -ra DIRS <<< "${{ inputs.exclude }}"
+          IFS=',' read -ra DIRS <<< "${INPUTS_EXCLUDE}"
           for dir in "${DIRS[@]}"; do
             dir=$(echo "$dir" | xargs)
             echo "    - $dir/" >> .fossa.yml
           done
         fi
+      env:
+        INPUTS_EXCLUDE: ${{ inputs.exclude }}
 
     - name: Run FOSSA Analyze
+      id: analyze
       shell: bash
       continue-on-error: true
       run: |
@@ -59,26 +62,30 @@ runs:
         set +e
         fossa analyze \
           --experimental-block-first-party-scans \
-          --project "${{ inputs.scanName }}" \
-          --team "${{ inputs.fossaTeam }}" \
-          --branch "${{ inputs.branch }}" > "$ANALYZE_LOG" 2>&1
+          --project "${INPUTS_SCANNAME}" \
+          --team "${INPUTS_FOSSATEAM}" \
+          --branch "${INPUTS_BRANCH}" > "$ANALYZE_LOG" 2>&1
         set -e
         cat "$ANALYZE_LOG"
         FOSSA_URL=$(grep -o 'https://app.fossa.com[^ ]*' "$ANALYZE_LOG" | head -1 || true)
-        echo "FOSSA_URL=$FOSSA_URL" >> "$GITHUB_ENV"
+        echo "fossa-url=$FOSSA_URL" >> "$GITHUB_OUTPUT"
         rm -f "$ANALYZE_LOG"
+      env:
+        INPUTS_SCANNAME: ${{ inputs.scanName }}
+        INPUTS_FOSSATEAM: ${{ inputs.fossaTeam }}
+        INPUTS_BRANCH: ${{ inputs.branch }}
 
     - name: Run FOSSA Test and Write Summary
       if: always()
       shell: bash
       run: |
         set +e
-        TEST_OUTPUT=$(fossa test --project "${{ inputs.scanName }}" 2>&1)
+        TEST_OUTPUT=$(fossa test --project "${INPUTS_SCANNAME}" 2>&1)
         TEST_EXIT_CODE=$?
         set -e
         echo "$TEST_OUTPUT"
 
-        if [ "${{ inputs.fossaTest }}" == "true" ]; then
+        if [ "${INPUTS_FOSSATEST}" == "true" ]; then
           if [ "$TEST_EXIT_CODE" -eq 0 ]; then
             TEST_RESULT="✅ passed"
           else
@@ -93,9 +100,13 @@ runs:
         echo "| Type | Project | Report | Test |" >> "$GITHUB_STEP_SUMMARY"
         echo "|------|---------|--------|------|" >> "$GITHUB_STEP_SUMMARY"
         if [ -n "$FOSSA_URL" ]; then
-          echo "| Maven | ${{ inputs.scanName }} | [View in FOSSA]($FOSSA_URL) | $TEST_RESULT |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Maven | ${INPUTS_SCANNAME} | [View in FOSSA]($FOSSA_URL) | $TEST_RESULT |" >> "$GITHUB_STEP_SUMMARY"
         else
-          echo "| Maven | ${{ inputs.scanName }} | ❌ upload failed | $TEST_RESULT |" >> "$GITHUB_STEP_SUMMARY"
+          echo "| Maven | ${INPUTS_SCANNAME} | ❌ upload failed | $TEST_RESULT |" >> "$GITHUB_STEP_SUMMARY"
           echo "::error::FOSSA analyze failed — no report URL found in output"
           exit 1
         fi
+      env:
+        FOSSA_URL: ${{ steps.analyze.outputs.fossa-url }}
+        INPUTS_SCANNAME: ${{ inputs.scanName }}
+        INPUTS_FOSSATEST: ${{ inputs.fossaTest }}
diff --git a/.github/actions/security/snyk-container-scan/action.yml b/.github/actions/security/snyk-container-scan/action.yml
index 4b7d4d0..cf5608d 100644
--- a/.github/actions/security/snyk-container-scan/action.yml
+++ b/.github/actions/security/snyk-container-scan/action.yml
@@ -28,6 +28,7 @@ runs:
       uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
 
     - name: Load and scan image
+      id: load
       shell: bash
       continue-on-error: true
       env:
@@ -48,7 +49,7 @@ runs:
           exit 1
         fi
 
-        echo "LOADED_IMAGE=$LOADED_IMAGE" >> "$GITHUB_ENV"
+        echo "loaded-image=$LOADED_IMAGE" >> "$GITHUB_OUTPUT"
 
         snyk container test "$LOADED_IMAGE" \
           --sarif-file-output="snyk-container-${IMAGE_NAME}.sarif" \
@@ -94,6 +95,7 @@ runs:
       shell: bash
       continue-on-error: true
       env:
+        LOADED_IMAGE: ${{ steps.load.outputs.loaded-image }}
         TARGET_REFERENCE: ${{ inputs.snykMonitorTargetReference }}
       run: |
         if [ -n "$LOADED_IMAGE" ]; then
diff --git a/.github/actions/security/snyk-maven-scan/action.yml b/.github/actions/security/snyk-maven-scan/action.yml
index b1ac2bb..b22ddd7 100644
--- a/.github/actions/security/snyk-maven-scan/action.yml
+++ b/.github/actions/security/snyk-maven-scan/action.yml
@@ -29,14 +29,17 @@ runs:
       continue-on-error: true
       run: |
         EXCLUDE_FLAG=""
-        if [ -n "${{ inputs.exclude }}" ]; then
-          EXCLUDE_FLAG="--exclude=${{ inputs.exclude }}"
+        if [ -n "${INPUTS_EXCLUDE}" ]; then
+          EXCLUDE_FLAG="--exclude=${INPUTS_EXCLUDE}"
         fi
         snyk test \
           --all-projects \
           $EXCLUDE_FLAG \
-          --sarif-file-output=snyk-maven-${{ inputs.scanName }}.sarif \
+          --sarif-file-output=snyk-maven-${INPUTS_SCANNAME}.sarif \
           --json-file-output=snyk-results.json
+      env:
+        INPUTS_EXCLUDE: ${{ inputs.exclude }}
+        INPUTS_SCANNAME: ${{ inputs.scanName }}
 
     # This is used to:
     # - Set severity score to 0.0 for those results that has empty value for it (empty value is not supported by GitHub Code Scanning)
@@ -46,9 +49,9 @@ runs:
     - name: Sanitize SARIF security-severity values
       shell: bash
       run: |
-        SARIF_FILE="snyk-maven-${{ inputs.scanName }}.sarif"
+        SARIF_FILE="snyk-maven-${INPUTS_SCANNAME}.sarif"
         if [ -f "$SARIF_FILE" ]; then
-          jq --arg name "Snyk Maven (${{ inputs.scanName }})" --arg category "snyk-maven-${{ inputs.scanName }}" '
+          jq --arg name "Snyk Maven (${INPUTS_SCANNAME})" --arg category "snyk-maven-${INPUTS_SCANNAME}" '
             (.runs[].tool.driver.name) = $name |
             (.runs[].tool.driver.rules[]?.properties."security-severity") |=
               if . == null or . == "undefined" or (tostring | test("^[0-9]") | not) then "0.0"
@@ -59,6 +62,8 @@ runs:
               .value
             ))' "$SARIF_FILE" > "${SARIF_FILE}.tmp" && mv "${SARIF_FILE}.tmp" "$SARIF_FILE"
         fi
+      env:
+        INPUTS_SCANNAME: ${{ inputs.scanName }}
 
     - name: Upload SARIF to GitHub Code Scanning
       uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
@@ -83,7 +88,9 @@ runs:
       continue-on-error: true
       run: |
         EXCLUDE_FLAG=""
-        if [ -n "${{ inputs.exclude }}" ]; then
-          EXCLUDE_FLAG="--exclude=${{ inputs.exclude }}"
+        if [ -n "${INPUTS_EXCLUDE}" ]; then
+          EXCLUDE_FLAG="--exclude=${INPUTS_EXCLUDE}"
         fi
         snyk monitor --all-projects $EXCLUDE_FLAG --target-reference="${GITHUB_REF_NAME}"
+      env:
+        INPUTS_EXCLUDE: ${{ inputs.exclude }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bb6792d..01f1318 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -20,6 +20,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
diff --git a/.github/workflows/cve-notifier.yml b/.github/workflows/cve-notifier.yml
index f2b39a8..56c1f73 100644
--- a/.github/workflows/cve-notifier.yml
+++ b/.github/workflows/cve-notifier.yml
@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Checkout CVE notifier tool
       # It is expected to checkout it from frawless user
@@ -27,6 +29,7 @@ jobs:
           repository: frawless/cve-notifier
           ref: 5417b2e520cadae203ab82dd3b063bcbe638df64
           path: cve-notifier
+          persist-credentials: false
 
       - name: Copy projects.yaml config
         run: cp configs/cve-notifier-projects.yaml cve-notifier/config/projects.yaml
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 6fce371..ec78e37 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: docker://rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 # v1.7.12
         with:
           args: -color
@@ -25,7 +27,32 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/dependencies/install-shellcheck
       - uses: ./.github/actions/dependencies/install-yq
       - name: Run ShellCheck on scripts and composite actions
         run: .github/tests/shellcheck.sh
+
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write   # upload SARIF to code scanning
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Reports all findings to code scanning (does not fail the job)
+      - name: Report findings to code scanning
+        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
+        with:
+          version: "1.32.0"
+      # Fails the job on medium and higher findings
+      - name: Check for medium and higher findings
+        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
+        with:
+          version: "1.32.0"
+          advanced-security: false
+          annotations: true
+          min-severity: medium
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1884dd..3e5d9b7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Validate branch
         id: branch
         run: |
-          BRANCH="${{ github.ref_name }}"
+          BRANCH="${GITHUB_REF_NAME}"
           
           echo "Validating branch: ${BRANCH}"
           if [[ ! "$BRANCH" =~ ^release-([0-9]+)\.x$ ]]; then
@@ -33,8 +33,9 @@ jobs:
           fi
           echo "major=${BASH_REMATCH[1]}" >> "$GITHUB_OUTPUT"
 
+      # Credentials are kept because this job pushes release tags; it uploads no artifacts
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked]
         with:
           fetch-depth: 0
 
@@ -42,9 +43,10 @@ jobs:
         id: version
         env:
           MAJOR: ${{ steps.branch.outputs.major }}
+          INPUTS_VERSION: ${{ inputs.version }}
         run: |
-          if [[ -n "${{ inputs.version }}" ]]; then
-            VERSION="${{ inputs.version }}"
+          if [[ -n "${INPUTS_VERSION}" ]]; then
+            VERSION="${INPUTS_VERSION}"
             if [[ ! "$VERSION" =~ ^${MAJOR}\.[0-9]+$ ]]; then
               echo "::error::Version $VERSION does not match branch major version $MAJOR"
               exit 1
@@ -86,6 +88,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           TAG: ${{ steps.version.outputs.tag }}
           MAJOR: ${{ steps.branch.outputs.major }}
+          INPUTS_DESCRIPTION: ${{ inputs.description }}
         run: |
           PREV_TAG=$(git tag -l "v${MAJOR}.*" --sort=-v:refname | grep -v "^${TAG}$" | head -n1)
 
@@ -96,7 +99,7 @@ jobs:
           AUTO_NOTES=$(gh api repos/${{ github.repository }}/releases/generate-notes \
             "${API_ARGS[@]}" --jq '.body')
 
-          DESCRIPTION="${{ inputs.description }}"
+          DESCRIPTION="${INPUTS_DESCRIPTION}"
           if [[ -n "$DESCRIPTION" ]]; then
             printf '%s\n\n---\n\n%s' "$DESCRIPTION" "$AUTO_NOTES" > release-notes.md
           else
diff --git a/.github/workflows/reusable-attest.yml b/.github/workflows/reusable-attest.yml
index 46d390a..15bdffa 100644
--- a/.github/workflows/reusable-attest.yml
+++ b/.github/workflows/reusable-attest.yml
@@ -60,7 +60,10 @@ jobs:
         shell: bash
         run: |
           mkdir -p release-workdir
-          tar -xf release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar -C release-workdir
+          tar -xf "release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar" -C release-workdir
+        env:
+          INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+          INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
 
       - name: Download SBOMs artifact
         if: ${{ inputs.sbomsArtifact != '' }}
@@ -77,9 +80,9 @@ jobs:
         id: find-archives
         shell: bash
         run: |
-          FILES=$(find release-workdir -type f \( -iname "*${{ inputs.releaseVersion }}*.tar.gz" -o \
-                                                   -iname "*${{ inputs.releaseVersion }}*.zip" -o \
-                                                   -iname "*${{ inputs.releaseVersion }}*.tgz" \))
+          FILES=$(find release-workdir -type f \( -iname "*${INPUTS_RELEASEVERSION}*.tar.gz" -o \
+                                                   -iname "*${INPUTS_RELEASEVERSION}*.zip" -o \
+                                                   -iname "*${INPUTS_RELEASEVERSION}*.tgz" \))
           if [ -n "$FILES" ]; then
             echo "found=true" >> "$GITHUB_OUTPUT"
             {
@@ -92,6 +95,8 @@ jobs:
             echo "found=false" >> "$GITHUB_OUTPUT"
             echo "No release archives found for attestation"
           fi
+        env:
+          INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
 
       - name: Attest release archives
         if: ${{ steps.find-archives.outputs.found == 'true' }}
@@ -104,14 +109,14 @@ jobs:
         if: ${{ steps.find-archives.outputs.found == 'true' }}
         shell: bash
         run: |
-          cp "${{ steps.attest.outputs.bundle-path }}" "release-workdir/release-${{ inputs.releaseVersion }}.intoto.jsonl"
-          rm release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
-          TARBALL="../release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar"
+          cp "${STEPS_ATTEST_OUTPUTS_BUNDLE_PATH}" "release-workdir/release-${INPUTS_RELEASEVERSION}.intoto.jsonl"
+          rm "release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar"
+          TARBALL="../release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar"
           cd release-workdir
-          find . -type f \( -iname "*${{ inputs.releaseVersion }}*.tar.gz" -o \
-                            -iname "*${{ inputs.releaseVersion }}*.zip" -o \
-                            -iname "*${{ inputs.releaseVersion }}*.tgz" -o \
-                            -iname "*${{ inputs.releaseVersion }}*.yaml" -o \
+          find . -type f \( -iname "*${INPUTS_RELEASEVERSION}*.tar.gz" -o \
+                            -iname "*${INPUTS_RELEASEVERSION}*.zip" -o \
+                            -iname "*${INPUTS_RELEASEVERSION}*.tgz" -o \
+                            -iname "*${INPUTS_RELEASEVERSION}*.yaml" -o \
                             -iname "*.intoto.jsonl" -o \
                             -name "sbom.tar.gz" \) \
             -exec tar -rvf "${TARBALL}" {} \;
@@ -120,6 +125,10 @@ jobs:
             echo "::error::Attestation bundle missing from rebuilt release tar"
             exit 1
           fi
+        env:
+          STEPS_ATTEST_OUTPUTS_BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
+          INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
+          INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
       - name: Re-upload release artifact with attestation
         if: ${{ steps.find-archives.outputs.found == 'true' }}
@@ -140,9 +149,11 @@ jobs:
         id: parse
         shell: bash
         run: |
-          IMAGE="${{ inputs.helmChartImage }}"
+          IMAGE="${INPUTS_HELMCHARTIMAGE}"
           echo "subject-name=${IMAGE%%@*}" >> "$GITHUB_OUTPUT"
           echo "subject-digest=${IMAGE##*@}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_HELMCHARTIMAGE: ${{ inputs.helmChartImage }}
 
       - name: Attest Helm chart
         uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
diff --git a/.github/workflows/reusable-test-integrations.yml b/.github/workflows/reusable-test-integrations.yml
index 759a0fb..5f189a8 100644
--- a/.github/workflows/reusable-test-integrations.yml
+++ b/.github/workflows/reusable-test-integrations.yml
@@ -84,6 +84,7 @@ jobs:
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -91,6 +92,7 @@ jobs:
           repository: strimzi/github-actions
           ref: ${{ inputs.githubActionsRef || github.sha }}
           path: github-actions
+          persist-credentials: false
 
       - name: Setup actions for testing
         run: |
@@ -144,14 +146,16 @@ jobs:
 
       - name: Verify binaries artifact was created
         run: |
-          if [ ! -f "binaries-${{ inputs.artifactSuffix }}.tar" ]; then
+          if [ ! -f "binaries-${INPUTS_ARTIFACTSUFFIX}.tar" ]; then
             echo "❌ Binaries artifact not created"
             exit 1
           fi
 
           echo "Binaries artifact contents:"
-          tar -tf binaries-${{ inputs.artifactSuffix }}.tar
+          tar -tf "binaries-${INPUTS_ARTIFACTSUFFIX}.tar"
           echo "✓ Binaries artifact created successfully"
+        env:
+          INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
       - name: Verify test results exist
         if: ${{ inputs.checkTests == true }}
@@ -176,6 +180,7 @@ jobs:
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -183,6 +188,7 @@ jobs:
           repository: strimzi/github-actions
           ref: ${{ inputs.githubActionsRef || github.sha }}
           path: github-actions
+          persist-credentials: false
 
       - name: Setup Nexus
         run: github-actions/.github/tests/setup-nexus.sh
@@ -234,7 +240,9 @@ jobs:
       - name: Set SNAPSHOT version for testing
         shell: bash
         run: |
-          mvn versions:set -DnewVersion=${{ inputs.releaseVersion }}-SNAPSHOT -DgenerateBackupPoms=false
+          mvn versions:set -DnewVersion="${INPUTS_RELEASEVERSION}-SNAPSHOT" -DgenerateBackupPoms=false
+        env:
+          INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
 
       - name: Deploy to local Maven repository using deploy-java action
         uses: ./.github/actions/build/deploy-java
@@ -257,8 +265,8 @@ jobs:
           while [ $ELAPSED -lt $TIMEOUT ]; do
               echo "Checking for artifacts... (${ELAPSED}s/${TIMEOUT}s)"
               
-              SEARCH_RESULT=$(curl -s -u admin:${{ env.NEXUS_PASSWORD }} \
-                  "http://localhost:8081/service/rest/v1/search?repository=maven-snapshots&name=${{ inputs.nexusCheck }}" 2>/dev/null)
+              SEARCH_RESULT=$(curl -s -u "admin:${NEXUS_PASSWORD}" \
+                  "http://localhost:8081/service/rest/v1/search?repository=maven-snapshots&name=${INPUTS_NEXUSCHECK}" 2>/dev/null)
               
               ARTIFACT_COUNT=$(echo "$SEARCH_RESULT" | jq -r '.items | length' 2>/dev/null || echo "0")
               
@@ -278,6 +286,8 @@ jobs:
           echo "Last search result:"
           echo "$SEARCH_RESULT" | jq '.' || echo "No valid response"
           exit 1
+        env:
+          INPUTS_NEXUSCHECK: ${{ inputs.nexusCheck }}
 
   test-build-containers:
     name: Build Containers
@@ -292,6 +302,7 @@ jobs:
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -299,6 +310,7 @@ jobs:
           repository: strimzi/github-actions
           ref: ${{ inputs.githubActionsRef || github.sha }}
           path: github-actions
+          persist-credentials: false
 
       - name: Setup actions for testing
         run: |
@@ -335,6 +347,7 @@ jobs:
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -342,6 +355,7 @@ jobs:
           repository: strimzi/github-actions
           ref: ${{ inputs.githubActionsRef || github.sha }}
           path: github-actions
+          persist-credentials: false
 
       - name: Setup actions for testing
         run: |
@@ -377,7 +391,7 @@ jobs:
       - name: Verify images discovery output
         if: ${{ github.event_name != 'pull_request' }}
         run: |
-          IMAGES='${{ steps.push.outputs.images }}'
+          IMAGES="${STEPS_PUSH_OUTPUTS_IMAGES}"
           COUNT=$(echo "$IMAGES" | jq 'length')
           if [ "$COUNT" -eq 0 ]; then
             echo "❌ No images discovered for attestation"
@@ -385,6 +399,8 @@ jobs:
           fi
           echo "✓ Discovered $COUNT image(s) for attestation:"
           echo "$IMAGES" | jq '.'
+        env:
+          STEPS_PUSH_OUTPUTS_IMAGES: ${{ steps.push.outputs.images }}
 
   test-release-artifacts:
     name: Release Artifacts
@@ -400,6 +416,7 @@ jobs:
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -407,6 +424,7 @@ jobs:
           repository: strimzi/github-actions
           ref: ${{ inputs.githubActionsRef || github.sha }}
           path: github-actions
+          persist-credentials: false
 
       - name: Setup actions for testing
         run: |
@@ -439,7 +457,7 @@ jobs:
 
       - name: Verify release outputs
         run: |
-          TARBALL="release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar"
+          TARBALL="release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar"
 
           if [ ! -f "$TARBALL" ]; then
             echo "❌ Release tarball not found: $TARBALL"
@@ -454,12 +472,15 @@ jobs:
           echo "Release tarball contents:"
           tar -tf "$TARBALL"
           echo "✓ Release artifacts created successfully"
+        env:
+          INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+          INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
 
       # This check is currently only for Operators repo as yamls were missing in release tar ball
       - name: Verify YAML release artifacts in tarball
         if: ${{ inputs.clusterOperatorBuild == true }}
         run: |
-          TARBALL="release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar"
+          TARBALL="release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar"
 
           YAML_COUNT=$(tar -tf "$TARBALL" | grep -c '\.yaml$' || true)
           if [ "$YAML_COUNT" -eq 0 ]; then
@@ -471,6 +492,9 @@ jobs:
 
           echo "Found $YAML_COUNT YAML file(s) in release tarball:"
           tar -tf "$TARBALL" | grep '\.yaml$'
+        env:
+          INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+          INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
 
   test-publish-helm:
     name: Publish Helm Charts
@@ -486,6 +510,7 @@ jobs:
         with:
           repository: ${{ inputs.repo }}
           ref: ${{ inputs.ref }}
+          persist-credentials: false
 
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -493,6 +518,7 @@ jobs:
           repository: strimzi/github-actions
           ref: ${{ inputs.githubActionsRef || github.sha }}
           path: github-actions
+          persist-credentials: false
 
       - name: Setup actions for testing
         run: |
diff --git a/.github/workflows/test-dependencies.yml b/.github/workflows/test-dependencies.yml
index 691b21a..0388db5 100644
--- a/.github/workflows/test-dependencies.yml
+++ b/.github/workflows/test-dependencies.yml
@@ -24,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run install-docker action
         uses: ./.github/actions/dependencies/install-docker
@@ -54,6 +56,8 @@ jobs:
         - 'v3.16.0'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run install-helm action
         uses: ./.github/actions/dependencies/install-helm
@@ -84,6 +88,8 @@ jobs:
           - '0.10.0'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run install-shellcheck action
         uses: ./.github/actions/dependencies/install-shellcheck
@@ -115,6 +121,8 @@ jobs:
           - '1.20.0'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run install-syft action
         uses: ./.github/actions/dependencies/install-syft
@@ -138,6 +146,8 @@ jobs:
           - '1.2.3'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run install-oras action
         uses: ./.github/actions/dependencies/install-oras
@@ -162,6 +172,8 @@ jobs:
           - 'v4.52.2'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run install-yq action
         uses: ./.github/actions/dependencies/install-yq
@@ -186,6 +198,8 @@ jobs:
         mavenVersion: ['3.9.9', '3.8.8']
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run setup-java action
         uses: ./.github/actions/dependencies/setup-java
@@ -231,6 +245,8 @@ jobs:
             expectedK8sVersion: "1.37"
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run setup-kind action
         uses: ./.github/actions/dependencies/setup-kind
@@ -327,6 +343,8 @@ jobs:
           - 'v1.37.0'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run setup-minikube action
         uses: ./.github/actions/dependencies/setup-minikube
diff --git a/.github/workflows/test-fossa.yml b/.github/workflows/test-fossa.yml
index 9645624..61a05ed 100644
--- a/.github/workflows/test-fossa.yml
+++ b/.github/workflows/test-fossa.yml
@@ -25,6 +25,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
+          persist-credentials: false
 
       - name: Checkout strimzi/drain-cleaner
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -32,6 +33,7 @@ jobs:
           repository: strimzi/drain-cleaner
           ref: 1.6.1
           path: drain-cleaner
+          persist-credentials: false
 
       - name: Copy drain-cleaner project to workspace root
         run: rsync -a --exclude='.git' --exclude='.github' drain-cleaner/ ./
@@ -155,6 +157,8 @@ jobs:
     steps:
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Docker
         uses: ./.github/actions/dependencies/install-docker
diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml
index 5b7bdc7..1ccf83f 100644
--- a/.github/workflows/test-integrations.yml
+++ b/.github/workflows/test-integrations.yml
@@ -12,8 +12,6 @@ on:
 # Declare default permissions as read only
 permissions:
   contents: read
-  id-token: write       # Required for OIDC keyless signing
-  attestations: write   # Required for actions/attest provenance
 
 # Cancel previous builds on the same branch/PR
 concurrency:
@@ -23,6 +21,10 @@ concurrency:
 jobs:
   test-integration:
     name: Integration Test - ${{ matrix.project.repo }}
+    permissions:
+      contents: read
+      id-token: write       # Required for OIDC keyless signing
+      attestations: write   # Required for actions/attest provenance
     strategy:
       fail-fast: false
       matrix:
@@ -239,7 +241,6 @@ jobs:
       clusterOperatorBuild: ${{ matrix.project.clusterOperatorBuild || false }}
       skipTests: ${{ matrix.project.skipTests }}
       checkTests: ${{ matrix.project.checkTests }}
-    secrets: inherit
 
   test-oci-artifact:
     name: Test push and pull OCI artifact
@@ -247,6 +248,8 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup local registry
         run: .github/tests/setup-registry.sh
diff --git a/.github/workflows/test-snyk.yml b/.github/workflows/test-snyk.yml
index 8fe2ef4..f41d2f1 100644
--- a/.github/workflows/test-snyk.yml
+++ b/.github/workflows/test-snyk.yml
@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.sha }}
+          persist-credentials: false
 
       - name: Checkout strimzi/drain-cleaner
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -34,6 +35,7 @@ jobs:
           repository: strimzi/drain-cleaner
           ref: 1.6.1
           path: drain-cleaner
+          persist-credentials: false
 
       - name: Copy drain-cleaner project to workspace root
         run: rsync -a --exclude='.git' --exclude='.github' drain-cleaner/ ./
@@ -192,6 +194,8 @@ jobs:
     steps:
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Docker
         uses: ./.github/actions/dependencies/install-docker
@@ -245,6 +249,8 @@ jobs:
     steps:
       - name: Checkout github-actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Docker
         uses: ./.github/actions/dependencies/install-docker
diff --git a/.github/workflows/test-utils.yml b/.github/workflows/test-utils.yml
index c081cbe..fc7a74f 100644
--- a/.github/workflows/test-utils.yml
+++ b/.github/workflows/test-utils.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Install dependencies
       - name: Install act
@@ -111,6 +113,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Install dependencies
       - name: Install act
@@ -189,4 +193,4 @@ jobs:
           fi
 
           echo "───────────────────────────────────────"
-          echo "🎉 All $TOTAL should-run scenarios passed!"
\ No newline at end of file
+          echo "🎉 All $TOTAL should-run scenarios passed!"
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..6c59ff8
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,4 @@
+rules:
+  # Our tests check out and call this repository's own actions and workflows on purpose
+  self-repository:
+    disable: true