diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000000..f6b20859fd0
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,9 @@
+paths:
+  .github/workflows/*.lock.yml:
+    ignore:
+      - ".+"
+
+  # Also generated by gh-aw
+  .github/workflows/agentics-maintenance.yml:
+    ignore:
+      - ".+"
diff --git a/.github/matchers/actionlint.json b/.github/matchers/actionlint.json
new file mode 100644
index 00000000000..4613e1617bf
--- /dev/null
+++ b/.github/matchers/actionlint.json
@@ -0,0 +1,17 @@
+{
+  "problemMatcher": [
+    {
+      "owner": "actionlint",
+      "pattern": [
+        {
+          "regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
+          "file": 1,
+          "line": 2,
+          "column": 3,
+          "message": 4,
+          "code": 5
+        }
+      ]
+    }
+  ]
+}
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
new file mode 100644
index 00000000000..1bd951bbdfa
--- /dev/null
+++ b/.github/workflows/actionlint.yml
@@ -0,0 +1,35 @@
+name: Actionlint
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/**
+  pull_request:
+    paths:
+      - .github/**
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          sparse-checkout: |
+            .github
+
+      # Content copied from https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/.github/actionlint-matcher.json
+      - name: Add ActionLint Problem Matcher
+        run: echo "::add-matcher::.github/matchers/actionlint.json"
+
+      - name: Lint workflows
+        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color -verbose
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 2cf4ff054f7..240bd95462c 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -51,7 +51,7 @@ jobs:
           node-version: "20"
 
       - name: Install golangci-lint
-        run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.11.4/install.sh | sh -s -- -b $(go env GOPATH)/bin v2.11.4
+        run: curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/v2.11.4/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.11.4
 
       - name: Install cspell
         run: npm install -g cspell@8.13.1
diff --git a/.github/workflows/lint-bicep.yml b/.github/workflows/lint-bicep.yml
index 58b0c11e56c..e933237618a 100644
--- a/.github/workflows/lint-bicep.yml
+++ b/.github/workflows/lint-bicep.yml
@@ -17,8 +17,8 @@ jobs:
       - name: Upgrade bicep
         run: |
           which bicep
-          sudo curl -o $(which bicep) -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
-          sudo chmod +x $(which bicep)
+          sudo curl -o "$(which bicep)" -L https://github.com/Azure/bicep/releases/download/v0.44.1/bicep-linux-x64
+          sudo chmod +x "$(which bicep)"
       - name: Lint .bicep files
         run: $ErrorActionPreference='Continue'; eng/scripts/Test-BicepLint.ps1 -Verbose
         shell: pwsh
diff --git a/.github/workflows/test-ext-azure-ai-agents.yml b/.github/workflows/test-ext-azure-ai-agents.yml
index 7f4bde79ec7..3a87e96e9fb 100644
--- a/.github/workflows/test-ext-azure-ai-agents.yml
+++ b/.github/workflows/test-ext-azure-ai-agents.yml
@@ -49,7 +49,7 @@ jobs:
           # Use the canonical ci-build.ps1 which includes security flags
           # (trimpath, pie, cfi, cfg, osusergo) matching release builds.
           # -BuildRecordMode produces both a production and a record-tagged binary.
-          pwsh -File ci-build.ps1 -BuildRecordMode -OutputFileName azure-ai-agents-linux-amd64 -Version $(cat version.txt | tr -d '\r\n')
+          pwsh -File ci-build.ps1 -BuildRecordMode -OutputFileName azure-ai-agents-linux-amd64 -Version "$(cat version.txt | tr -d '\r\n')"
           # Move production binary to bin/ where azd x pack expects it.
           mkdir -p bin
           mv azure-ai-agents-linux-amd64 bin/
diff --git a/.github/workflows/validate-go-version.yml b/.github/workflows/validate-go-version.yml
index 32c7594a168..adeea225de2 100644
--- a/.github/workflows/validate-go-version.yml
+++ b/.github/workflows/validate-go-version.yml
@@ -20,6 +20,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Validate Go version consistency
+        shell: bash
         run: |
           # Source of truth: cli/azd/go.mod
           EXPECTED=$(grep -m1 '^go ' cli/azd/go.mod | awk '{print $2}')
@@ -30,7 +31,7 @@ jobs:
           # Check all go.mod files
           echo ""
           echo "Checking go.mod files..."
-          for f in $(find cli/azd -name 'go.mod'); do
+          while IFS= read -r -d '' f; do
             VERSION=$(grep -m1 '^go ' "$f" | awk '{print $2}')
             if [ "$VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Go version mismatch: found '$VERSION', expected '$EXPECTED'"
@@ -38,7 +39,7 @@ jobs:
             else
               echo "  OK: $f ($VERSION)"
             fi
-          done
+          done < <(find cli/azd -name 'go.mod' -print0)
 
           # Check ADO pipeline template
           echo ""
@@ -57,7 +58,7 @@ jobs:
           # Check Dockerfiles referencing golang:<version> base images
           echo ""
           echo "Checking Dockerfiles..."
-          for f in $(find cli/azd -name 'Dockerfile'); do
+          while IFS= read -r -d '' f; do
             DOCKER_VERSION=$(grep -oP 'golang:\K[\d.]+' "$f" | head -1)
             if [ -n "$DOCKER_VERSION" ] && [ "$DOCKER_VERSION" != "$EXPECTED" ]; then
               echo "::error file=$f::Dockerfile golang version mismatch: found '$DOCKER_VERSION', expected '$EXPECTED'"
@@ -65,7 +66,7 @@ jobs:
             elif [ -n "$DOCKER_VERSION" ]; then
               echo "  OK: $f (golang:$DOCKER_VERSION)"
             fi
-          done
+          done < <(find cli/azd -name 'Dockerfile' -print0)
 
           # Check devcontainer.json Go feature version
           echo ""